Phishing website detection method and device, electronic equipment and medium

Abstract

The embodiment of the invention discloses a phishing website detection method and device, electronic equipment and a medium, and the method comprises the steps: extracting a structural information feature vector and a content information feature vector of a first HTML document of a target website, and splicing the structural information feature vector and the content information feature vector to obtain a first feature vector of the target website; extracting a structural information feature vector and a content information feature vector of a second HTML document of the suspicious website, and splicing the structural information feature vector and the content information feature vector to obtain a second feature vector of the suspicious website; and according to the first feature vector and the second feature vector, detecting the phishing website through a pre-trained prediction model. Compared with the detection of the phishing website only depending on the content displayed in the website page, the method provided by the invention has the advantages that the feature vectors of the structure information and the content information of the HMTL document are respectively extracted and calculated, so that the model can comprehensively capture the overall features of the website, and the accuracy of the detection of the phishing website is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a phishing website detection method, device, electronic device and medium. Background Art

[0002] Phishing website detection plays a crucial role in cybersecurity. With the rapid development of internet technology, phishing attacks are becoming increasingly sophisticated, posing a serious threat to personal privacy, financial security, and corporate reputation. Phishing websites disguise themselves as legitimate websites to trick users into entering sensitive information, resulting in significant financial and trust losses for both users and organizations.

[0003] Existing detection models rely solely on the content displayed on website pages to detect phishing websites. Existing technologies rely solely on the text and images displayed on website pages to detect phishing websites. However, this approach, which only extracts and detects information from website pages, often leads to misjudgments when encountering complex phishing websites, reducing the accuracy and robustness of phishing website detection. Therefore, the development of accurate phishing website detection methods is extremely urgent. Summary of the Invention

[0004] The present application provides a phishing website detection method, device, electronic device and medium for improving the accuracy of phishing website detection.

[0005] The present invention provides a method for detecting phishing websites, the method comprising:

[0006] Receiving an input uniform resource locator (URL) of a target website; replacing at least one character in the URL to generate a plurality of suspicious URLs; obtaining a first hypertext markup language (HTML) document of the target website and a second HTML document of each suspicious website based on the URL and each suspicious URL;

[0007] For each suspicious website, the structural information feature vector and the content information feature vector of the first HTML document and the second HTML document of the suspicious website are respectively extracted based on the website encoder; the corresponding structural information feature vector and content information feature vector are spliced ​​to obtain a first feature vector of the first HTML document and a second feature vector of the second HTML document; the first feature vector and the second feature vector are spliced ​​to obtain a first comprehensive feature vector; the first comprehensive feature vector is input into a pre-trained prediction model, and based on the prediction model, it is determined whether the suspicious website is a phishing website of the target website.

[0008] Furthermore, extracting the structural information feature vector and the content information feature vector of the HTML document based on the website encoder includes:

[0009] Extract features from an HTML document using a deep optimization traversal algorithm to generate a tree structure diagram of the HTML document; the tree structure diagram includes leaf nodes and non-leaf nodes of the HTML document, wherein the non-leaf nodes include a root node; encode node information corresponding to each node in the tree structure diagram to obtain a corresponding initial feature vector;

[0010] Based on the tree convolution model in the website encoder and the initial feature vectors corresponding to the non-leaf nodes and their children, a structural information feature vector is obtained;

[0011] Based on the long short-term memory model and all leaf nodes and the corresponding initial feature vectors in the website encoder, a corresponding content information feature vector is obtained.

[0012] Furthermore, the structure information feature vector is obtained based on the tree convolution model in the website encoder and the initial feature vectors corresponding to the non-leaf nodes and the child nodes of the non-leaf nodes, including:

[0013] For each non-leaf node, if the non-leaf node's child nodes are only leaf nodes, then the non-leaf node is regarded as the first non-leaf node; if the non-leaf node's child nodes are only non-leaf nodes, then the non-leaf node is regarded as the second non-leaf node; otherwise, the non-leaf node is regarded as the third non-leaf node;

[0014] For each first non-leaf node, obtain a convolution feature vector of the first non-leaf node based on the tree convolution model and the concatenated initial feature vectors of each child node of the first non-leaf node and the initial feature vector of the first non-leaf node;

[0015] For each second non-leaf node, based on the tree convolution model and the concatenated convolution feature vectors corresponding to each child node of the second non-leaf node and the initial feature vector corresponding to the second non-leaf node, obtain a convolution feature vector of the second non-leaf node;

[0016] For each third non-leaf node, obtain the initial feature vector of the leaf node and the convolution feature vector of the non-leaf node among the child nodes of the third non-leaf node, splice the obtained initial feature vector, convolution feature vector and the initial feature vector of the third non-leaf node and input them into the tree convolution model to obtain the convolution feature vector of the third non-leaf node;

[0017] The convolution feature vector of the root node is determined as the structural information feature vector.

[0018] Furthermore, the content information feature vector corresponding to the website encoder's long short-term memory model, all leaf nodes, and corresponding initial feature vectors is obtained, including:

[0019] Sort each leaf node according to the order in which each node in the tree structure diagram is generated;

[0020] Inputting the initialized feature vector of each leaf node into the long short-term memory model in the order of the sorted leaf nodes, the hidden layer of the long short-term memory model splices the initialized feature vector of the leaf node and the preset initial feature vector for the leaf node ranked first, and calculates the hidden layer state vector of the leaf node ranked first based on the gating mechanism; for the leaf node ranked not first, splicing the hidden layer state vector of the leaf node ranked before the leaf node and the initial feature vector of the leaf node, and calculating the hidden layer state vector of the leaf node based on the gating mechanism;

[0021] The pooling layer of the long short-term memory model performs average pooling and linear transformation on the hidden layer state vectors of all leaf nodes to obtain a content information feature vector.

[0022] Furthermore, the extracting features of the HTML document by using a deep optimization traversal algorithm to generate a tree structure diagram of the HTML document includes:

[0023] Determine the text subnodes, image subnodes and tag subnodes of the HTML document; use the text subnodes and image subnodes of the HTML document as leaf nodes in the tree structure diagram; and use the tag subnodes of the HTML document as non-leaf nodes in the tree structure diagram.

[0024] Furthermore, information corresponding to each node in the tree structure diagram is encoded to obtain a corresponding initial feature vector including:

[0025] For each leaf node in the tree structure diagram, if the leaf node is a text subnode, the bidirectional encoding Bert model is used to encode the text information of the text subnode to obtain the initial feature vector of the leaf node; if the leaf node is an image subnode, the deep convolutional neural network Resnet is used to encode the image information of the image subnode to obtain the initial feature vector corresponding to the leaf node.

[0026] Furthermore, information corresponding to each node in the tree structure diagram is encoded to obtain a corresponding initial feature vector including:

[0027] For each non-leaf node in the tree structure diagram, the label sub-node type is determined according to the label information of the label sub-node corresponding to the non-leaf node; and the initial feature vector corresponding to the non-leaf node is determined according to the pre-saved correspondence between the label sub-node type and the initialization feature vector corresponding to the label sub-node type.

[0028] An embodiment of the present application provides a device for detecting phishing websites, the device comprising:

[0029] A receiving module, configured to receive a uniform resource locator (URL) of a target website;

[0030] A processing module is used to replace at least one character in the URL to generate multiple suspicious URLs; based on the URL and each suspicious URL, obtain a first hypertext markup language HTML document of the target website and a second HTML document of each suspicious website; for each suspicious website, extract the structural information feature vector and the content information feature vector of the first HTML document and the second HTML document of the suspicious website based on a website encoder; concatenate the corresponding structural information feature vector and content information feature vector to obtain a first feature vector of the first HTML document and a second feature vector of the second HTML document; concatenate the first feature vector and the second feature vector to obtain a first comprehensive feature vector; input the first comprehensive feature vector into a pre-trained prediction model, and determine whether the suspicious website is a phishing website of the target website based on the prediction model.

[0031] Furthermore, the processing module is specifically used to extract features from the HTML document through a deep optimization traversal algorithm to generate a tree structure diagram of the HTML document; the tree structure diagram includes leaf nodes and non-leaf nodes of the HTML document, wherein the non-leaf nodes include the root node; the node information corresponding to each node in the tree structure diagram is encoded to obtain the corresponding initial feature vector; based on the tree convolution model in the website encoder and the initial feature vectors corresponding to the non-leaf nodes and the child nodes of the non-leaf nodes, a structural information feature vector is obtained; based on the long short-term memory model in the website encoder and all leaf nodes and the corresponding initial feature vectors, a corresponding content information feature vector is obtained.

[0032] Furthermore, the processing module is specifically used to, for each non-leaf node, if the child nodes of the non-leaf node are only leaf nodes, then the non-leaf node is used as the first non-leaf node; if the child nodes of the non-leaf node are only non-leaf nodes, then the non-leaf node is used as the second non-leaf node, otherwise the non-leaf node is used as the third non-leaf node; for each first non-leaf node, based on the tree convolution model and the initial feature vector of each child node of the first non-leaf node after splicing and the initial feature vector of the first non-leaf node, obtain the convolution feature vector of the first non-leaf node; for each second non-leaf node, based on The tree convolution model and the convolution feature vector corresponding to each child node of the second non-leaf node after splicing, as well as the initial feature vector corresponding to the second non-leaf node, obtain the convolution feature vector of the second non-leaf node; for each third non-leaf node, obtain the initial feature vector of the leaf node among the child nodes of the third non-leaf node and the convolution feature vector of the non-leaf node, splice the obtained initial feature vector, convolution feature vector and the initial feature vector of the third non-leaf node into the tree convolution model to obtain the convolution feature vector of the third non-leaf node; determine the convolution feature vector of the root node as the structural information feature vector.

[0033] Furthermore, the processing module is specifically used to sort each leaf node according to the order of generation of each node in the tree structure diagram; input the initialized feature vector of each leaf node into the long short-term memory model according to the sorted leaf nodes, and the hidden layer of the long short-term memory model splices the initialized feature vector of the leaf node and the preset initial feature vector for the leaf node ranked first, and calculates the hidden layer state vector of the leaf node ranked first based on the gating mechanism; for the leaf node ranked not in the first place, splices the hidden layer state vector of the leaf node ranked before the leaf node and the initial feature vector of the leaf node, and calculates the hidden layer state vector of the leaf node based on the gating mechanism; the pooling layer of the long short-term memory model average pools and linearly transforms the hidden layer state vectors of all leaf nodes to obtain the content information feature vector.

[0034] Furthermore, the processing module is specifically used to determine the text sub-nodes, image sub-nodes and tag sub-nodes of the HTML document; use the text sub-nodes and image sub-nodes of the HTML document as leaf nodes in the tree structure diagram; and use the tag sub-nodes of the HTML document as non-leaf nodes in the tree structure diagram.

[0035] Furthermore, the processing module is specifically used to, for each leaf node in the tree structure diagram, if the leaf node is a text sub-node, use the bidirectional encoding Bert model to encode the text information of the text sub-node to obtain the initial feature vector of the leaf node; if the leaf node is an image sub-node, use the deep convolutional neural network Resnet to encode the image information of the image sub-node to obtain the initial feature vector corresponding to the leaf node.

[0036] Furthermore, the processing module is specifically used to determine the label sub-node type for each non-leaf node in the tree structure diagram based on the label information of the label sub-node corresponding to the non-leaf node; and determine the initial feature vector corresponding to the non-leaf node based on the pre-saved correspondence between the label sub-node type and the initialization feature vector corresponding to the label sub-node type.

[0037] An embodiment of the present application further provides an electronic device, comprising a processor, wherein the processor is configured to implement the steps of any of the above methods when executing a computer program stored in a memory.

[0038] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of any of the above methods are implemented.

[0039] In an embodiment of the present application, the structural information feature vector and content information feature vector of the first HTML document of the target website are extracted and concatenated to obtain the first feature vector of the target website. The structural information feature vector and content information feature vector of the second HTML document of the suspicious website are also extracted and concatenated to obtain the second feature vector of the suspicious website. Based on these first and second feature vectors, a pre-trained prediction model is used to detect phishing websites. Compared to relying solely on the content displayed on the website page to detect phishing websites, the present application extracts and calculates feature vectors for the structural information and content information of the HTML document separately, ensuring that the model can fully capture the overall characteristics of the website, thereby improving the accuracy of phishing website detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0041] Figure 1A schematic diagram of a phishing website detection process provided in an embodiment of the present application;

[0042] Figure 2 A schematic diagram of a process for extracting website structure information feature vectors and content information feature vectors provided in an embodiment of the present application;

[0043] Figure 3 A schematic diagram of a simple tree structure diagram provided in an embodiment of the present application;

[0044] Figure 4 A schematic diagram of a process for determining a website structure information feature vector provided in an embodiment of the present application;

[0045] Figure 5 A schematic diagram of a process for determining a feature vector of website content information provided in an embodiment of the present application;

[0046] Figure 6 A schematic diagram of a process for training a prediction model provided in an embodiment of the present application;

[0047] Figure 7 A schematic diagram of the process of preliminary preparation and training of a training prediction model provided in an embodiment of the present application;

[0048] Figure 8 A schematic diagram of the overall process of the phishing website detection method provided in an embodiment of the present application;

[0049] Figure 9 A schematic diagram of the structure of a device for detecting phishing websites provided in an embodiment of the present application;

[0050] Figure 10 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to make the purpose and implementation of this application clearer, the exemplary implementation of this application will be clearly and completely described below in conjunction with the drawings in the exemplary embodiments of this application. Obviously, the described exemplary embodiments are only part of the embodiments of this application, not all of the embodiments.

[0052] It should be noted that the brief descriptions of terms in this application are only for the purpose of facilitating the understanding of the embodiments described below, and are not intended to limit the embodiments of this application. Unless otherwise specified, these terms should be understood according to their ordinary and usual meanings.

[0053] In the specification and claims of this application and the accompanying drawings, the terms "first," "second," "third," etc. are used to distinguish similar or similar objects or entities, and are not necessarily intended to limit a particular order or sequence, unless otherwise noted. It should be understood that the terms used in this manner are interchangeable under appropriate circumstances.

[0054] The terms "comprise," "include," and "have," and any variations thereof, are intended to cover but not exclude inclusion; for example, a product or device comprising a list of components is not necessarily limited to all the components expressly listed but may include other components not expressly listed or inherent to such product or device.

[0055] The term "module" refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and / or software code that is capable of performing the functionality associated with that element.

[0056] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some or all of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

[0057] For ease of explanation, the above description has been made with reference to specific embodiments. However, the above exemplary discussion is not intended to be exhaustive or to limit the embodiments to the specific forms disclosed above. Based on the above teachings, various modifications and variations are possible. The above embodiments are selected and described to better explain the principles and practical applications, so that those skilled in the art can better utilize the embodiments and various different variations of the embodiments suitable for specific use considerations.

[0058] Example 1:

[0059] Figure 1 A schematic diagram of a phishing website detection process provided in an embodiment of the present application includes the following steps:

[0060] S101: receiving an input uniform resource locator (URL) of a target website; replacing at least one character in the URL to generate a plurality of suspicious URLs.

[0061] The method for detecting phishing websites provided in the embodiments of the present application is applied to an electronic device, which may be a computer (Personal Computer, PC), a server, etc.

[0062] A URL is a complete string containing address information, used to identify and locate website resources on the internet. An electronic device receives a target website URL input by a user and generates multiple suspicious URLs by replacing at least one character in the URL. Specifically, each character replacement in the URL generates a corresponding suspicious URL; multiple replacements are performed to generate multiple suspicious URLs of the URL. Each replacement can be a single character or multiple characters, without limitation.

[0063] In a possible implementation, the domain name contained in the URL of the target website may be determined first; then the domain name may be processed using a domain name fuzzy algorithm to generate multiple suspicious URLs of the target website.

[0064] S102: Based on the URL and each suspicious URL, a first Hypertext Markup Language (HTML) document of the target website and a second HTML document of each suspicious website are obtained.

[0065] For the URL entered by the user, a web crawler is used to obtain the first HTML document of the target website. For each suspicious URL generated in step 101, a web crawler is used to obtain the second HTML document of the suspicious website. The suspicious website refers to a phishing website that may be malicious on the network.

[0066] S103: For each suspicious website, extract the structural information feature vector and the content information feature vector of the first HTML document and the second HTML document of the suspicious website based on the network encoder, and concatenate the corresponding structural information feature vectors and content information feature vectors to obtain a first feature vector of the first HTML document and a second feature vector of the second HTML document.

[0067] The structural information feature vector refers to the feature vector of all structures in the HTML document. The content information feature vector refers to the feature vector of all displayed contents in the HTML document.

[0068] The electronic device parses a first HTML document of a target website to generate a first tree structure graph of the target website; and parses a second HTML document of a suspicious website to generate a second tree structure graph of the suspicious website, wherein the tree structure graph includes leaf nodes and non-leaf nodes. Based on the hierarchical relationship between each node in the tree structure graph, a tree convolutional model in a network encoder is used to obtain structural information feature vectors corresponding to the first and second HTML documents. Based on the node information corresponding to each node in the tree structure graph, a long short-term memory model in the network encoder is used to obtain content information feature vectors corresponding to the first and second HTML documents. Node information refers to the specific content of the node.

[0069] For the same HTML document, the feature vector of the concatenated HTML document is determined based on the obtained structural information feature vector and content information feature vector and their corresponding weights. For example, the feature vector can be calculated by the preset formula e=W3*(W1*v root +W2*q root +b) to obtain the feature vector of the HTML document, where v root is the structural information feature vector, q root The content information feature vector, W1, W2, W3, and b are preset parameters. These parameters can be determined based on the user's actual needs. If the user prioritizes the website's content, the coefficients corresponding to the content information feature vector are set higher; if the user prioritizes the website's structure, the coefficients corresponding to the structure information feature vector are set higher. This feature vector contains both the HTML document's structural and content information. In other words, the final website feature vector is determined by both the webpage's structural and content information.

[0070] S104: Concatenate the first feature vector and the second feature vector to obtain a first comprehensive feature vector; input the first comprehensive feature vector into a pre-trained prediction model, and determine whether the suspicious website is a phishing website of the target website based on the prediction model.

[0071] For each suspicious website, the first feature vector of the target website and the second feature vector of the suspicious website are concatenated to obtain a first comprehensive feature vector.

[0072] The electronic device is pre-installed with a trained prediction model that can calculate based on the input first comprehensive feature vector and output a "yes" or "no" result. The prediction model output is used to determine whether the suspicious website is a phishing website of the target website.

[0073] The first comprehensive feature vector includes the first feature vector of the target website and the second feature vector of the suspicious website. If the prediction model outputs a "yes" result, it proves that the suspicious website is a phishing website of the target website; if the prediction model outputs a "no" result, it proves that the suspicious website is not a phishing website of the target website.

[0074] In one possible implementation, the identified phishing websites are reported and added to a blacklist to prevent users from accessing them.

[0075] In an embodiment of the present application, the structural information feature vector and content information feature vector of the first HTML document of the target website are extracted and concatenated to obtain the first feature vector of the target website. The structural information feature vector and content information feature vector of the second HTML document of the suspicious website are also extracted and concatenated to obtain the second feature vector of the suspicious website. Based on these first and second feature vectors, a pre-trained prediction model is used to detect phishing websites. Compared to relying solely on the content displayed on the website page to detect phishing websites, the present application extracts and calculates feature vectors for the structural information and content information of the HTML document separately, ensuring that the model can fully capture the overall characteristics of the website, thereby improving the accuracy of phishing website detection.

[0076] Example 2:

[0077] In order to improve the ability to parse complex websites. Figure 2 A schematic diagram of a process for extracting a website structure information feature vector and a content information feature vector provided in an embodiment of the present application, the process comprising the following steps:

[0078] S201: Extract features of an HTML document using a deep optimization traversal algorithm to generate a tree structure diagram of the HTML document; the tree structure diagram includes leaf nodes and non-leaf nodes of the HTML document, wherein the non-leaf nodes include a root node.

[0079] An HTML document is a document consisting of a series of elements, which are defined by tags. Each element usually consists of a start tag and an end tag, and the content is placed between the tags, for example, " This is a paragraph In this example, is the start tag, It is the end tag, and "this is a paragraph" is the content. It can also be understood that "this is a paragraph" is a child element of this element.

[0080] In this application, the tree structure diagram includes leaf nodes and non-leaf nodes of the HTML document, wherein the non-leaf nodes include the root node. The specific process of determining the leaf nodes and non-leaf nodes in the tree structure diagram is as follows:

[0081] Determine the text subnodes, image subnodes and tag subnodes of the HTML document; use the text subnodes and image subnodes of the HTML document as leaf nodes in the tree structure diagram; and use the tag subnodes of the HTML document as non-leaf nodes in the tree structure diagram.

[0082] The specific content in an HTML document includes text content, image content, etc. For the text content in an HTML document, a text child node is created for it, and the text child node is displayed as "text" in the tree structure diagram, where the text content is the node information of the text child node. Text content can also be called text information. For the image content in an HTML document, an image child node is created for it, and the image child node is displayed as "image" in the tree structure diagram. For the image child node, it is necessary to crawl the corresponding website database to obtain the specific image content, where the image content is the node information of the image child node. Image content can also be called image information. For each start tag in an HTML document, a tag child node is created for it, and the tag child node is displayed as the specific tag content of the start tag in the tree structure diagram, where the specific tag content of the start tag is the node information of the tag child node. Specific tag content can also be called tag information.

[0083] A leaf node is a node that has no child elements or child nodes. Therefore, the text child nodes and image child nodes in the tree structure diagram are considered leaf nodes in the tree structure diagram. A non-leaf node is a node that has child elements or child nodes. Therefore, the label child nodes in the tree structure diagram are considered non-leaf nodes in the tree structure diagram. Since the root node has child elements or child nodes, the root node is a type of non-leaf node.

[0084] The tree structure diagram refers to a tree structure diagram generated based on the content of the HTML document. The electronic device extracts features of the first HTML document and the second HTML document obtained in step 102 through a deep optimization traversal algorithm to generate a tree structure diagram of the HTML document. The specific process is as follows:

[0085] (1) First, create a root node representing an HTML document and name it "html". This means setting the root node for the HTML document. "html" is used as the node information of the root node. Different HTML documents can be named "html 1" or "html 2". When constructing the tree structure diagram, use this root node as the starting node and create the tree structure diagram from top to bottom.

[0086] (2) Determine each tag and the sub-elements between tags in the HTML document through a depth-first traversal algorithm, wherein each tag includes a start tag and an end tag. Specifically, determine each start tag and its corresponding end tag in the HTML document through a depth-first traversal algorithm; when traversing to a start tag, create a tag child node for the start tag in the tree structure diagram, and use the specific tag content of the start tag as the node information of the tag child node, and then save the start tag in the node list to indicate that a corresponding tag child node has been created for the start tag. Continue traversing, and when traversing to a sub-element between the end tags corresponding to the start tag, create a corresponding sub-node for the sub-element in the tree structure diagram, and use the content of the sub-element as the node information of the sub-node, wherein the sub-element may be text, an image, or other start tags. If the child element is text, a corresponding text child node is created for the child element, and the information corresponding to the text is used as the node information of the text child node; if the child element is an image, a corresponding image child node is created for the child element, and the information corresponding to the image is used as the node information of the image child node; if the child element is another start tag, a label child node is also created for the other start tag in the tree structure diagram, and the specific label content of the other start tag is used as the node information of the label child node, and the child elements between the other start tag and the corresponding end tag are continued to be traversed. In addition, the label child node is connected to the child node corresponding to its corresponding child element, that is, if the child node corresponding to the child element is a text child node, the label child node is connected to the text child node; if the child node corresponding to the child element is an image child node, the label child node is connected to the image child node; if the child node corresponding to the child element is a label child node corresponding to another start tag, the label child node is connected to the label child node corresponding to the other start tag.

[0087] (3) Repeat the above step (2) until a complete tree structure diagram is generated. That is, when the traversal of the HTML document is completed, a complete tree structure diagram is constructed.

[0088] For easier understanding, the following HTML document is used as an example:

[0089]

[0090]

[0091] <title> Sample Page< / title>

[0092]

[0093]

[0094] <h1> This is a title< / h1>

[0095]

[0096] When constructing the tree structure diagram, first construct a root node and use "html" as the node information of the root node. Then when traversing to the start tag, create a tag child node for the start tag in the tree structure diagram, and use "head" as the node information of the tag child node, where the root node is the parent node of the tag child node, and connect the tag child node to the root node; then continue to traverse the child elements between the start tag and the end tag, and determine that the child element is <title> When the tag is started, it is<title> The start tag creates a <title> tag child node and sets "title" as the node information for this tag child node. The <head> tag child node is the parent node of the <title> tag child node, and the <title> tag child node is connected to the <head> tag child node. Traversal continues, connecting the start tag <title> to the end tag < / title> When the child element is determined to be the "sample page" text, a corresponding text child node is created in the tree structure diagram, and "sample page" is used as the node information of the text child node. <title> tag child node. When the traversal reaches the child element of the end tag < / title> , it proves that the start tag in the HTML document <title> corresponding to the <title> start tag, parsing is complete, meaning that the < / title> <title> tag child node in the tree diagram is generated. When traversing to the convolution feature vector of < / title> When the end tag corresponds to the start tag, it proves that the parsing of the child elements of the start tag in the HTML document is completed, that is, the tag child node in the tree diagram is generated.

[0097] Continue to traverse the HTML document. When traversing to another start tag, create another tag child node in the tree structure diagram, use "body" as the node information of the tag child node, where the root node is the parent node of the tag child node, and connect the tag child node to the root node; and traverse the child elements between the start tag and the end tag in the HTML document to generate a complete tree structure diagram, where the tag child nodes in the tree structure diagram are other brother nodes of the tag child node.

[0098] That is to say, for each start tag in the HTML document, a new child node is created in the tree structure diagram corresponding to this start tag, and the newly created child node is used as the parent node, and the child nodes of the newly created parent node are continued to be generated; for each end tag, it means that the child node generation of the newly created parent node in the tree structure diagram is completed, and then the creation of other sibling nodes is continued.

[0099] Generate the corresponding tree structure diagram according to the order of traversal query and from left to right, from root node to non-leaf node to leaf node. Figure 3 A schematic diagram of a simple tree structure diagram provided in an embodiment of the present application is shown as follows: Figure 3 As shown, the tree structure diagram contains a root node; <title>、< / title> <meta> 、<img.> 、 、 <h1>There are child nodes in the node, so, <title>、< / title> <meta> 、<img.> 、 、 < / h1> <h1>As non-leaf nodes, the text subnodes and image subnodes of the HTML document are regarded as leaf nodes in the tree structure diagram; <name> 、 <content>There are no child nodes, so <text>, <image>, <name> 、 <content>As leaf nodes, the tag child nodes of the HTML document are regarded as non-leaf nodes in the tree structure diagram, where <name> 、 <content>A type of <text> child node.

[0100] S202: Encode the node information corresponding to each node in the tree structure diagram to obtain a corresponding initial feature vector.

[0101] Each node in the tree structure diagram includes non-leaf nodes and leaf nodes, wherein the leaf nodes include text sub-nodes, image sub-nodes, etc. The specific label content of the label sub-node corresponding to the non-leaf node is determined, which is the node information corresponding to the node. For example, when creating a non-leaf node, the specific label content corresponding to the label sub-node is "head", then the node information of the non-leaf node is "head"; if the leaf node is a text sub-node, the text content corresponding to the text sub-node is determined, which is the node information corresponding to the node. For example, when creating a leaf node <text>, the text content corresponding to the text sub-node is "sample page", then the node information of the leaf node is "sample page"; if the leaf node is an image sub-node, the image content corresponding to the image sub-node is determined, which is the node information corresponding to the node. For example, when creating a leaf node <image>, the image content corresponding to the image sub-node is "image 1", then the node information of the leaf node is "image 1".

[0102] For different nodes, the node information is encoded in different pre-set ways to obtain the initial feature vector corresponding to each node.

[0103] S203: Obtain a structural information feature vector based on the tree convolution model in the network encoder and the initial feature vectors corresponding to the non-leaf nodes and the child nodes of the non-leaf nodes.

[0104] Obtain the initial feature vectors corresponding to non-leaf nodes and their child nodes. Based on the tree convolution model in the network encoder, perform recursive convolution calculations layer by layer from leaf nodes to root nodes to obtain the structural information feature vector of the HTML document. The structural information feature vector contains all the structural information in the tree structure diagram.

[0105] S204: Obtaining a corresponding content information feature vector based on the long short-term memory model in the network encoder, all leaf nodes, and the corresponding initial feature vectors.

[0106] The leaf nodes of this application are text sub-nodes and image sub-nodes. Therefore, based on the long short-term memory model in the network encoder and the initial feature vectors corresponding to all leaf nodes, a content information feature vector is obtained. The obtained content information feature vector contains all content information in the tree structure diagram.

[0107] In an embodiment of the present application, a tree structure diagram of the HTML document is generated by extracting features of the HTML document; based on the initial feature vectors of the leaf nodes and non-leaf nodes in the tree structure diagram, the structural information and content information of the HTML document are obtained, that is, the structural information feature vector and content information feature vector of the corresponding website, which fully prepares for the subsequent phishing website identification process and converts the HTML document into a concise and clear tree structure diagram, ensuring the device's ability to parse complex websites, thereby improving the accuracy of phishing website identification.

[0108] Example 3:

[0109] In order to fundamentally and deeply mine the hierarchical structure information of the website and ensure comprehensive capture of the overall layout and hierarchical relationship of the website, the embodiment of the present application describes in detail the process of determining the structural information feature vector of the website. Figure 4 A schematic diagram of a process for determining a website structure information feature vector provided in an embodiment of the present application includes the following steps:

[0110] S401: For each non-leaf node, if the child nodes of the non-leaf node are only leaf nodes, then the non-leaf node is used as the first non-leaf node; if the child nodes of the non-leaf node are only non-leaf nodes, then the non-leaf node is used as the second non-leaf node; otherwise, the non-leaf node is used as the third non-leaf node.

[0111] For each non-leaf node in the tree structure diagram, the non-leaf node is classified, where if the child nodes of the non-leaf node are only leaf nodes, the leaf node is regarded as the first non-leaf node; if the child nodes of the non-leaf node are only non-leaf nodes, the non-leaf node is regarded as the second non-leaf node, otherwise the non-leaf node is regarded as the third non-leaf node.

[0112] like Figure 3 As shown in the figure, <title>、< / title> <meta> 、<img.> 、 、 <h1>The child nodes of nodes such as <text> and <image> are only leaf nodes, for example, <text> and <image> are all leaf nodes. Therefore, <title>、< / title> <meta> 、<img.> 、 、 < / h1> <h1>The nodes are divided into the first non-leaf nodes. In this graph, the child nodes of the nodes are only non-leaf nodes, for example, <title>、< / title> <meta> 、<img.> etc. nodes, and <title>、< / title> <meta> 、<img.> Nodes such as are all non-leaf nodes, so the nodes such as in the graph are divided into the second non-leaf nodes.

[0113] For some complex tree graph structures, there may be a situation where the child nodes of the upper non-leaf nodes include both leaf nodes and non-leaf nodes. The electronic device divides the non-leaf nodes in this case into third non-leaf nodes.

[0114] S402: For each first non-leaf node, based on the tree convolution model and the initial feature vectors of each child node of the first non-leaf node after splicing and the initial feature vector of the first non-leaf node, obtain the convolution feature vector of the first non-leaf node.

[0115] For each first non-leaf node, first determine each child node of the first non-leaf node; then determine the initial feature vector corresponding to each child node, and splice the initial feature vectors of the child nodes of the first non-leaf node to obtain a spliced ​​vector; input the spliced ​​vector and the initial feature vector of the first non-leaf node into a pre-set tree convolution model for convolution calculation and average pooling to obtain the convolution feature vector of the first non-leaf node.

[0116] like Figure 3 As shown in the lower content of the "Structural Information Encoding Based on Tree Convolution" section, for the first non-leaf node<img.> The convolution feature vector of the leaf node <image> and <text> is obtained by concatenating the initial feature vectors of the leaf nodes <image> and <text> to obtain vector C; then the vector C and<img.> The initial feature vector of the child node is input into the pre-set tree convolution model for convolution calculation and average pooling to obtain<img.> Convolution feature vector of child node. For the first non-leaf node , the initial feature vector of its lower-layer leaf node <text> and the initial feature vector of the child node are input into the preset tree convolution model for convolution calculation and average pooling to obtain the convolution feature vector of the child node. For the convolution feature vector of the first non-leaf node < / h1> <h1> , the initial feature vector of its lower leaf node <text> and the initial feature vector of the < / h1> <h1> child node are input into the preset tree convolution model for convolution calculation and average pooling, and the results are < / h1> <h1>Convolutional feature vector of the child node.

[0117] Based on the tree convolution model, the process of obtaining the convolution feature vector of the first non-leaf node according to the initial feature vector of each child node of the first non-leaf node after splicing and the initial feature vector of the first non-leaf node is specifically as follows: determining the specific total number of nodes according to the initial feature vector of each child node of the first non-leaf node after splicing and the initial feature vector of the first non-leaf node; judging whether the total number of nodes is less than the first preset total number of nodes, if less than, determining the first difference between the total number of nodes and the first preset total number of nodes, and filling the initial feature vector of each child node of the first non-leaf node after splicing and the initial feature vector of the first non-leaf node with the preset feature vector corresponding to the first difference; if not less than, directly extracting the initial feature vectors corresponding to the preset number of child nodes of the first non-leaf node according to the preset sliding window size, splicing the extracted initial feature vectors of multiple child nodes and the initial feature vector of the first non-leaf node, and performing convolution calculation to generate the convolution vector under the window. According to the preset convolution step size, multiple sliding windows are extracted, and convolution calculation is performed on each sliding window to obtain the corresponding convolution vector; according to the convolution vectors of multiple sliding windows, average pooling, full connection layer, and ReLu activation function processing, the convolution feature vector of the first non-leaf node is obtained.

[0118] Among them, the total number of the first preset nodes can be set by the user according to actual conditions, or it can be set by determining the number of child nodes corresponding to the first non-leaf node with the most child nodes in the tree structure diagram; the preset sliding window size and convolution step size are set according to the total number of the first preset nodes, wherein the sliding window size and the convolution step size are both smaller than the total number of the first preset nodes. For example, if the number of child nodes corresponding to the first non-leaf node with the most child nodes in the tree structure diagram is 10, then the total number of the first preset nodes is set to 10, and the sliding window size can be set to 3, and the convolution step size can be set to 1. In one possible implementation, in order to ensure the accuracy of the convolution calculation, you can also choose to set a smaller sliding window size and convolution step size, and set the filled preset feature vector to 0.

[0119] For example, define the first non-leaf node as the parent node p, and the initial eigenvector of the parent node p is h p , all child nodes of the parent node p are {c1,c2,…,c m }, where the i-th child node c i The eigenvector of h is ci . Based on the tree convolution model and the initial feature vector of each child node of the first non-leaf node after splicing and the initial feature vector of the first non-leaf node, the convolution feature vector of the first non-leaf node is obtained. The specific process is: the electronic device determines the specific total number of nodes m+1 according to the initial feature vector of each child node of the first non-leaf node after splicing and the initial feature vector of the first non-leaf node; judges whether the total number of nodes m+1 is less than the first preset total number of nodes N. If less than, determines the first difference N-(m+1) between the total number of nodes and the first preset total number of nodes, and fills the initial feature vector of each child node of the first non-leaf node after splicing and the initial feature vector of the first non-leaf node with the preset feature vector h0 corresponding to the first difference, that is, obtains {h p , h c1 , h c2 , h c3 ,…,h cm ,h1,…,h N-(m+1) }, where {h1,…,h N-(m+1) }, each element is h0, and then the subsequent convolution calculation is performed; if it is not less than, the initial feature vector corresponding to the child node of the first non-leaf node is directly slid from left to right according to the preset sliding window size k and the convolution step size s, wherein the initial feature vector {h ci ,h ci+1 ,...,h ci+k-1 }. And concatenate the initial feature vector of the parent node and the initial feature vectors corresponding to the k child nodes into feature Figure X ={h p ,h ci ,h ci+1 ,...,h ci+k-1 }, use the convolution kernel F to convolve the feature map: Among them, the size of the convolution kernel F is (k+1)*1. Assuming there are L windows, this convolution will obtain L convolution feature vectors {v1,v2,…,v L }. Then perform average pooling on these L convolution feature vectors: After another fully connected layer and ReLu activation function, the convolution of the subtree can be completed: p =max(0,W*v′+b), where W and b are internal parameters of the convolution, which are pre-set, that is, pre-trained. p That is the convolution feature vector of the parent node p, that is, the convolution feature vector corresponding to the first non-leaf node.

[0120] S403: For each second non-leaf node, based on the tree convolution model and the convolution feature vector corresponding to each child node of the second non-leaf node after splicing and the initial feature vector corresponding to the second non-leaf node, the convolution feature vector of the second non-leaf node is obtained.

[0121] For each second non-leaf node, first determine each child node of the second non-leaf node; then determine the convolution feature vector corresponding to each child node, and splice the convolution feature vectors of the child nodes of the second non-leaf node to obtain a spliced ​​vector; input the spliced ​​vector and the initial feature vector of the second non-leaf node into a pre-set tree convolution model for convolution calculation and average pooling to obtain the convolution feature vector of the second non-leaf node.

[0122] like Figure 3 As shown in the top content of the "Structural Information Encoding Based on Tree Convolution" section, the convolution feature vector of the second non-leaf node is the first non-leaf node below it.<img.> 、 and < / h1> <h1>The convolution feature vectors of the child node are concatenated to obtain vector C; then vector C and the initial feature vector of the child node are input into the pre-set tree convolution model for convolution calculation and average pooling to obtain the convolution feature vector of the child node.

[0123] Based on the tree convolution model, the process of obtaining the convolution feature vector of the second non-leaf node according to the convolution feature vector of each child node of the second non-leaf node after splicing and the initial feature vector of the second non-leaf node is specifically as follows: determine the specific total number of nodes according to the convolution feature vector of each child node of the second non-leaf node after splicing and the initial feature vector of the second non-leaf node; judge whether the total number of nodes is less than the second preset total number of nodes, if less than, determine the second difference between the total number of nodes and the second preset total number of nodes, and fill the initial feature vector of each child node of the second non-leaf node after splicing and the initial feature vector of the second non-leaf node with the preset number of feature vectors corresponding to the second difference; if not less than, directly extract the initial feature vectors corresponding to the preset number of child nodes of the second non-leaf node according to the preset sliding window size, splice the extracted initial feature vectors of multiple child nodes and the initial feature vector of the second non-leaf node, and perform convolution calculation to generate the convolution vector under the window. According to the preset convolution step size, multiple sliding windows are extracted, and convolution calculation is performed on each sliding window to obtain the corresponding convolution vector; according to the convolution vectors of multiple sliding windows, average pooling and the processing of the fully connected layer and ReLu activation function, the convolution feature vector of the second non-leaf node is obtained. Among them, the total number of the second preset nodes can be set by the user according to actual conditions, or it can be set by determining the number of child nodes corresponding to the second non-leaf node with the most child nodes in the tree structure diagram. The total number of the second preset nodes and the total number of the first preset nodes can be the same or different. In one possible embodiment, the preset sliding window size and convolution step size can be set according to the total number of the second preset nodes, wherein the sliding window size and convolution step size are both smaller than the total number of the second preset nodes. The specific convolution calculation process is shown as an example in the above step 402 and will not be repeated.

[0124] S404: For each third non-leaf node, obtain the initial feature vector of the leaf node in the child node of the third non-leaf node and the convolution feature vector of the non-leaf node, splice the obtained initial feature vector, convolution feature vector and the initial feature vector of the third non-leaf node into the tree convolution model to obtain the convolution feature vector of the third non-leaf node.

[0125] For each third non-leaf node, first determine each child node of the third non-leaf node; then determine the initial feature vector of the leaf node and the convolution feature vector of the non-leaf node in the child node of the third non-leaf node, and splice the initial feature vector of the leaf node and the convolution feature vector of the non-leaf node in the child node of the third non-leaf node to obtain a spliced ​​vector; input the spliced ​​vector and the initial feature vector of the third non-leaf node into a pre-set tree convolution model for convolution calculation and average pooling to obtain the convolution feature vector of the third non-leaf node.

[0126] Based on the tree convolution model, according to the initial feature vectors of the leaf nodes and the convolution feature vectors of the non-leaf nodes in the child nodes of the third non-leaf node after splicing, and the initial feature vector of the third non-leaf node, the process of obtaining the convolution feature vector of the third non-leaf node is specifically as follows: according to the initial feature vectors of the leaf nodes and the convolution feature vectors of the non-leaf nodes in the child nodes of the third non-leaf node after splicing, and the initial feature vector of the third non-leaf node, determine the specific total number of nodes; determine whether the total number of nodes is less than the third preset total number of nodes, and if so, determine the total number of nodes. The third difference between the number and the total number of the third preset nodes, and fill the initial feature vector of each child node of the spliced ​​third non-leaf node and the initial feature vector of the third non-leaf node with the preset feature vector corresponding to the third difference; if it is not less than, then directly extract the feature vectors corresponding to the preset number of child nodes of the third non-leaf node according to the preset sliding window size, wherein the corresponding feature vector may be the initial feature vector of the leaf node or the convolution feature vector of the non-leaf node, or there may be both the initial feature vector of the leaf node and the convolution feature vector of the non-leaf node. Splice the feature vectors corresponding to the multiple extracted child nodes and the initial feature vector of the third non-leaf node, and perform convolution calculation to generate the convolution vector under the window. According to the preset convolution step size, extract multiple sliding windows, and perform convolution calculation on each sliding window to obtain the corresponding convolution vector; according to the convolution vectors of multiple sliding windows, average pooling and full connection layer, ReLu activation function processing, obtain the convolution feature vector of the third non-leaf node. Among them, the total number of the third preset nodes can be set by the user according to actual conditions, or it can be set by determining the number of child nodes corresponding to the third non-leaf node with the most child nodes in the tree structure diagram. The total number of the first preset nodes, the total number of the second preset nodes, and the total number of the third preset nodes can be the same or different. In one possible implementation, the preset sliding window size and the convolution step size can be set according to the total number of the third preset nodes, wherein the sliding window size and the convolution step size are both smaller than the total number of the third preset nodes. The specific convolution calculation process is shown as an example in the above step 402 and will not be repeated.

[0127] S405: Determine the convolution feature vector of the root node as the structural information feature vector.

[0128] For each non-leaf node in the tree structure diagram, the convolution feature vector described above is calculated for each non-leaf node from bottom to top according to the tree structure diagram.

[0129] Based on the convolution feature vectors of each non-leaf node determined above, the convolution feature vector corresponding to the root node in the tree structure diagram is determined, and the convolution feature vector is determined as the structural information feature vector. The structural information feature vector contains all the structural information feature vectors in the tree structure diagram, that is, by repeated recursion, the same operation of convolution calculation and average pooling is performed on all parent nodes at each layer until the root node obtains the final global representation, and the final global representation is defined as v root .

[0130] In an embodiment of the present application, the convolution coding of the parent node and its child nodes is completed by using a one-dimensional convolution kernel and an average pooling technique. Through this bottom-up recursive coding, the structural information of the website is extracted layer by layer from the leaf node to the non-leaf node to the root node, and the hierarchical structure of the website is deeply mined, ensuring that the electronic device fully captures the overall layout and hierarchical relationship of the website. Through this innovative structural feature extraction method, not only the parsing ability of the complex website structure is improved, but also the problem of insufficient attention to the hierarchical structure of the website by the traditional detection method is effectively solved, so that when facing complex phishing websites, a more accurate and comprehensive analysis can be provided. In addition, the phishing website detection method (MultiSPD) based on multi-level structure mining proposed in this application, by combining the tree convolution model and the long short-term memory model, fundamentally digs into the hierarchical structure information of the website, ensuring the comprehensive capture of the arrangement layout and hierarchical relationship of the website.

[0131] Example 4:

[0132] In order to further improve the effect of phishing website detection, this application also combines the long short-term memory model to extract features of leaf nodes in the tree structure diagram. The embodiment of this application provides a detailed description of the process of determining the feature vector of the website's content information. Figure 5 A schematic diagram of a process for determining a website content information feature vector provided in an embodiment of the present application includes the following steps:

[0133] S501: Sort each leaf node according to the generation order of each node in the tree structure diagram.

[0134] Each leaf node is sorted according to the order in which each node in the tree structure is generated, that is, according to the order in which the leaf nodes appear during the parsing of the HTML document. Optionally, the leaf node that appears first is placed to the left of the sorted sequence. Because the tree structure is generated in the order in which the query is traversed, and in a left-to-right order from the root node to non-leaf nodes to leaf nodes, to a certain extent, the sequence follows the top-to-bottom order of elements in the website's HTML document.

[0135] S502: Input the initialized feature vector of each leaf node into the long short-term memory model according to the order of the sorted leaf nodes. The hidden layer of the long short-term memory model concatenates the initialized feature vector of the leaf node and the preset initial feature vector for the leaf node ranked first, and calculates the hidden layer state vector of the leaf node ranked first based on the gating mechanism.

[0136] The preset initial eigenvector may be 0, or may be other eigenvectors designed by the user according to actual needs, and there is no limitation on this.

[0137] According to the sorting sequence determined in step 501, the initialized feature vector of each leaf node is input into the long short-term memory model in the order of the sorted leaf nodes. The hidden layer based on the long short-term memory model concatenates the initialized feature vector of the leaf node ranked first and the preset initial feature vector, and calculates the hidden layer state vector of the leaf node ranked first through the gating mechanism.

[0138] S503: For a leaf node that is not ranked first, concatenate the hidden layer state vectors of the leaf nodes that are ranked before the leaf node and the initial feature vector of the leaf node, and calculate the hidden layer state vector of the leaf node based on the gating mechanism.

[0139] For leaf nodes that are not ranked first, based on the hidden layer of the long short-term memory model, the hidden layer state vectors of the leaf nodes before the leaf node and the initial feature vector of the leaf node are spliced, and the hidden layer state vector of the leaf node is calculated through the gating mechanism.

[0140] S504: The pooling layer of the long short-term memory model performs average pooling and linear transformation on the hidden layer state vectors of all leaf nodes to obtain a content information feature vector.

[0141] The pooling layer of the long short-term memory model average-pools and linearly transforms the hidden layer state vectors corresponding to the leaf nodes at each position determined in steps 502 and 503 to obtain the overall feature vector of the sorted sequence, i.e., the content information feature vector. This content information feature vector contains all the content information feature vectors in the tree structure graph.

[0142] like Figure 3 As shown in the entire content of the "Web Content Encoding Based on Long Short-Term Memory Model" section, all leaf nodes of the tree structure diagram are sorted as <text>, <name> 、 <content>, <image>, <text>, <text>, <text>; for the first <text> child node, according to the preset initial feature vector and the initial feature vector corresponding to the first <text> child node, based on the hidden layer of the long short-term memory model, the hidden layer state vector of the first <text> child node is calculated through the gating mechanism; for the second <name>child nodes, according to the hidden layer state vector of the first <text> child node and the second <name>The initial feature vector of the child node is obtained <name>The hidden layer state vector of the child node; calculate the third bit using the second bit calculation method <content>The hidden layer state vector of the child node, the hidden layer state vector of the fourth <image> child node, the hidden layer state vector of the fifth <text> child node, the hidden layer state vector of the sixth <text> child node, and the hidden layer state vector of the seventh <text> child node. Then, through the pooling layer of the long short-term memory model, the hidden layer state vectors of all leaf nodes are average pooled and linearly transformed to obtain the content information feature vector of the tree structure diagram, that is, the content information feature vector of the HTML document. That is to say, the embodiment of the present application is to use the feature vectors of all leaf nodes as the input of the long short-term memory model, and define the hidden layer state of the model at the i-th position as q i , average pooling and linear transformation are performed on all hidden layer state vectors, and the overall feature vector q of the sequence can be obtained root , the specific formula is:

[0143]

[0144] Among them, n is the number of leaf nodes, W and b are model parameters.

[0145] In an embodiment of the present application, content features are extracted for all leaf nodes in the tree structure diagram by using a long short-term memory model. This method not only effectively extracts the content features of the website, but also includes the top-down sequence features of the elements in the HTML document corresponding to the website, enhancing the model's ability to understand the website content and providing more accurate judgments in phishing website detection. Compared to existing phishing website detection technologies, which are usually limited to extracting web page content features and lack in-depth analysis of the order between elements and their mutual relationships, this application enables the device to make more accurate judgments in complex scenarios and improves the reliability of detection.

[0146] Example 5:

[0147] In order to improve the accuracy of identifying phishing websites, the present application also defines the encoding process of each node in the extraction tree structure diagram, thereby ensuring the accuracy of encoding each node.

[0148] The information corresponding to each node in the tree structure diagram is encoded to obtain the corresponding initial feature vector including:

[0149] For each leaf node in the tree structure diagram, if the leaf node is a text subnode, the bidirectional encoding Bert model is used to encode the text information of the text subnode to obtain the initial feature vector of the leaf node; if the leaf node is an image subnode, the deep convolutional neural network Resnet is used to encode the image information of the image subnode to obtain the initial feature vector corresponding to the leaf node.

[0150] Each leaf node in the tree structure can be divided into a text subnode and an image subnode.

[0151] If the leaf node is a text child node, the bidirectional encoding Bert model is used to encode the text information of the text child node to obtain the initial feature vector of the leaf node. Specifically, the text content of the text child node is parsed to obtain the original text string; the text string is segmented and normalized, and the processed text string is input into the pre-set bidirectional encoding Bert model. The Bert model's multi-layer Transformer structure extracts context-aware semantic features, and the vector output by the last layer is used as the initial feature vector of the text child node. In other words, for a text child node, Bert is used to encode the text to obtain the initial feature vector of the text.

[0152] If the leaf node is an image child node, the deep convolutional neural network Resnet is used to encode the image information of the image child node to obtain the initial feature vector corresponding to the leaf node. Specifically, the image resource link of the image child node is parsed to obtain the corresponding image file; the image is size-normalized and input into a pre-set deep convolutional neural network Resnet. The Resnet convolutional layers and residual blocks extract multi-level visual features, and the input after global average pooling in the final layer is used as the initial feature vector of the image child node. In other words, for image child nodes, Resnet is used to encode the image to obtain the image feature vector.

[0153] This application adopts different encoding strategies for different node types and extracts corresponding features in a targeted manner, thereby solving the feature alignment problem caused by modal differences in traditional methods, thereby ensuring the accuracy of encoding each node and further improving the accuracy of phishing website identification.

[0154] Example 6:

[0155] In order to ensure the speed of phishing website detection, this application also limits the encoding process of each node in the extracted tree structure diagram. By setting different initial feature vectors for different types of nodes, it ensures that the hierarchical relationship of the tree structure diagram is fully reflected in the feature space, thereby improving the robustness of phishing website detection. The specific process is as follows:

[0156] For each non-leaf node in the tree structure diagram, the label sub-node type is determined according to the label information of the label sub-node corresponding to the non-leaf node; and the initial feature vector corresponding to the non-leaf node is determined according to the pre-saved correspondence between the label sub-node type and the initialization feature vector corresponding to the label sub-node type.

[0157] For non-leaf nodes in the tree structure graph, for example, <title>、< / title> <meta> 、<img.> 、 、 <h1>The method for generating the initial feature vector is as follows: for each non-leaf node, according to the label information of the label child node corresponding to the non-leaf node, that is, the node information of the label child node, the HTML tag name and its key attributes of the non-leaf node are parsed. For example, the tag name is , the key attribute is paragraph; the tag name is <img.>, the key attribute is image; the tag name is < / h1> <h1>、< / h1> <h2>、< / h2> <h3>, the key attribute is title, etc. According to the predefined label classification rules, the type of the label sub-node is determined. For example, the label with the key attribute of title is classified as type 1, the label with the key attribute of image is classified as type 2, the label with the key attribute of paragraph is classified as type 3, etc. A fixed initialization feature vector is preset for each type of label and stored in a correspondence table between the label sub-node type and the initialization feature vector corresponding to the label sub-node type; during the application process, according to the identified label type, the corresponding initial feature vector is retrieved from the correspondence table as the initial feature vector corresponding to the non-leaf node.

[0158] That is, for the label sub-node, all labels appearing in the target website and the suspicious website are first counted, and a special character is pre-set for each label, and the special character is used as the initial feature vector of the corresponding label sub-node.

[0159] In this embodiment, the initialization feature vector corresponding to each label child node is obtained by directly looking up the table, avoiding deep learning model inference on non-leaf nodes, significantly reducing the computational workload and ensuring the speed of phishing website detection. Furthermore, by setting different initial feature vectors for different types of nodes, the hierarchical relationships of the tree structure diagram are fully reflected in the feature space, thereby improving the robustness of phishing website detection.

[0160] Example 7:

[0161] In order to facilitate the rapid identification of phishing websites, this application also pre-trains a prediction model that can directly identify them. Figure 6 A schematic diagram of a process for training a prediction model provided in an embodiment of the present application, the process includes the following steps:

[0162] S601: Obtain a sample data set.

[0163] The obtained sample data set includes positive sample data pairs and negative sample data pairs; the positive sample data pairs include a first target sample website, a phishing sample website corresponding to the first target sample website, and a relationship label between the phishing sample website and the first target sample website; the negative sample data pairs include a second target sample website, a non-phishing sample website corresponding to the second target sample website, and a relationship label between the non-phishing sample website and the second target sample website.

[0164] The sample data set obtained can be manually input by the user, or the electronic device can automatically collect phishing website data from various open source platforms. The collected phishing website data must include the target website that the phishing website imitates.

[0165] Arrange the acquired data into { <origin i ,sample i ,y i >} form, where origin i Called the target sample website, sample i For phishing sample website, y i is the relationship label between the phishing sample website and the target sample website. If y i =1, then sample i Must be origin i The phishing sample website, that is, the positive sample data pair includes the first target sample website, the phishing sample website corresponding to the first target sample website, and the relationship label between the phishing sample website and the first target sample website; if y i =0, then sample i It must not be origin i Phishing sample website, sample i It can even be a normal website, that is, the negative sample data pair includes the second target sample website, the non-phishing sample website corresponding to the second target sample website, and the relationship label between the non-phishing sample website and the second target sample website.

[0166] S602: Obtain the HTML document of each sample website in each sample data pair.

[0167] By using a web crawler, we can obtain the HTML documents of each sample website in each sample data pair, that is, for each sample data pair, we can obtain the origin of each sample data pair. i The corresponding HTML document and sample i The corresponding HTML document.

[0168] S603: For each sample data pair, extract the structural information feature vector and content information feature vector of the HTML document of each sample website in the sample data pair based on the network encoder, and splice the corresponding structural information feature vector and content information feature vector to obtain a third feature vector of the target sample website and a fourth feature vector of the phishing sample website or the non-phishing sample website in the sample data pair; splice the third feature vector and the fourth information feature vector to obtain a second comprehensive feature vector; input the second comprehensive feature vector and the relationship label corresponding to the sample data pair into the prediction model to be trained, and predict the relationship confidence corresponding to the sample data pair based on the prediction model; determine the loss value according to the predicted relationship confidence corresponding to the sample data pair and the relationship label corresponding to the sample data pair, and train the prediction model according to the loss value.

[0169] If the sample data pair is a positive sample data pair, the electronic device extracts the structural information feature vector and content information feature vector of the third HTML document of the target sample website in the sample data pair based on the network encoder, and obtains the third feature vector of the target website, and the third feature vector includes the structural information feature vector and content information feature vector of the target sample website; extracts the features of the fourth HTML document of the fishing sample website in the sample data pair, and obtains the fourth feature vector of the fishing sample website, and the fourth feature vector includes the structural information feature vector and content information feature vector of the fishing sample website.

[0170] If the sample data pair is a negative sample data pair, the electronic device extracts the structural information feature vector and content information feature vector of the third HTML document of the target sample website in the sample data pair based on the network encoder to obtain the third feature vector of the target website, and the third feature vector includes the structural information feature vector and content information feature vector of the target sample website; extracts the features of the fourth HTML document of the non-fishing sample website in the sample data pair to obtain the fourth feature vector of the non-fishing sample website, and the fourth feature vector includes the structural information feature vector and content information feature vector of the non-fishing sample website.

[0171] The third eigenvector and the fourth information eigenvector of the sample data pair are concatenated to obtain a second comprehensive eigenvector. This second comprehensive eigenvector and the relationship label corresponding to the sample data pair are input into the prediction model to be trained, and the relationship confidence corresponding to the sample data pair is predicted based on the prediction model. The predicted relationship confidence corresponding to the sample data pair is a value between 0 and 1. Based on the predicted relationship confidence corresponding to the sample data pair and the relationship label corresponding to the sample data pair, a loss value is calculated based on the cross-entropy loss function, and the model parameters of the prediction model are adjusted based on the loss value.

[0172] By inputting multiple sample data pairs, the prediction model is iteratively trained. When the loss value reaches the preset target loss value, the trained prediction model is obtained. Or when the number of training times meets the preset target value, the trained prediction model is obtained.

[0173] Figure 7 A schematic diagram of the process of early preparation and training of a training prediction model provided in an embodiment of the present application is shown as follows: Figure 7 As shown, before training the prediction model, that is, in the preliminary preparation stage, a website encoder is first created. The website encoder contains a tree convolution model and a long short-term memory model, which is used to execute all the steps in Example 3 and Example 4. The specific implementation process of the website encoder is: input the target website into the website encoder, and obtain the structural information feature vector and content information feature vector of the target website by extracting features, that is, Figure 7 The structure information and content information of the suspicious website are input into the website encoder, and the structure information feature vector and content information feature vector of the suspicious website are obtained by extracting features. Then the electronic device uses the preset formula, that is, e=W3*(W1*v root +W2*q root +b), after splicing the target website's structure information and content information, the comprehensive feature vector e of the target website is obtained origin , which is the third eigenvector of the target website, that is Figure 8 The website feature vector in the ; after splicing the structure information and content information of the suspicious website, the comprehensive feature vector e of the suspicious website is obtained sample , that is, the fourth eigenvector of the suspicious website, wherein the suspicious website may be a phishing website of the target website, or it may not be a phishing website of the target website; the third eigenvector of the target website and the fourth eigenvector of the suspicious website are concatenated to obtain the second comprehensive eigenvector. The training phase of the prediction model of this application can also be simply understood as: the second comprehensive eigenvector is input into the prediction model to be trained, and after the full understanding layer and activation function, the corresponding relationship confidence of the sample data can be obtained. in, W and b are internal parameters of the model. Then, the confidence of the corresponding relationship is calculated based on the predicted sample data. And the relationship label y corresponding to the sample data pair, determine the loss value, that is, the cross entropy loss in the figure, specifically:

[0174] In the embodiment of the present application, the trained prediction model can directly determine whether the suspicious website to be identified is a phishing website of the target website, which is quick and simple, and improves the speed of phishing website identification.

[0175] Example 8:

[0176] Figure 9 A schematic diagram of the overall process of the phishing website detection method provided in an embodiment of the present application.

[0177] (1) Data acquisition process, namely, the above-mentioned steps 101 and 102.

[0178] (2) MultiSPD website encoding, that is, the process of extracting features of the target website and the suspicious website to obtain the first feature vector corresponding to the target website and the second feature vector corresponding to the suspicious website, specifically: A: Extract the website source code and convert the source code into a tree structure, that is, step 201 in the above embodiment 2, which will not be repeated here. B: Initialize the source code label into a vector, that is, the content in the above embodiment 6, which will not be repeated here. C: The text content is encoded into a vector using Bert, and the image URL is encoded into a vector using Resent after crawling, that is, the above embodiment 5, which will not be repeated here. D: Structural encoding based on tree convolution, that is, the process of obtaining the first feature vector, that is, the above embodiment 3, which will not be repeated here. E: Web page content encoding based on the long short-term memory model, that is, the process of obtaining the second feature vector, that is, the above embodiment 4, which will not be repeated here. F: Construct the semantic vector of the website, that is, step 103, which will not be repeated here.

[0179] (3) Phishing website detection by MultiSPD is specifically as follows: A: obtaining the semantic vector of the target website; obtaining the semantic vector of the suspicious website, that is, the process of extracting the structural information feature vector and the content information feature vector of the first HTML document and the second HTML document of the suspicious website based on the network encoder, respectively, and splicing the corresponding structural information feature vector and content information feature vector to obtain the first feature vector of the first HTML document and the second feature vector of the second HTML document; B: aggregating the semantic vectors of the target website and the suspicious website and classifying them, that is, splicing the first feature vector and the second feature vector to obtain the first comprehensive feature vector; C: updating the model parameters using the classification loss, that is, inputting the relationship label corresponding to the second comprehensive feature vector and the sample data pair into the prediction model to be trained, and predicting the relationship confidence corresponding to the sample data pair based on the prediction model; determining the loss value according to the predicted relationship confidence corresponding to the sample data pair and the relationship label corresponding to the sample data pair, and training the prediction model according to the loss value.

[0180] In practice, the method of the present application can be implemented and applied in multiple scenarios. Specific examples are listed below:

[0181] 1. Security enhancements for online financial services

[0182] The specific steps are:

[0183] Implementation step 1: Collect phishing website data from various open source platforms and organize the data into training samples for the model, which is the model training process in the above-mentioned Example 8 and will not be repeated here.

[0184] Implementation step two: Construct a method for detecting phishing websites designed in this patent, use samples to train the model in this solution, and obtain a trained prediction model.

[0185] Implementation Step 3: An enterprise provides its own website, i.e., inputs the target website's uniform resource locator (URL), referred to as the target website; provides the domain name of the target website URL, uses a domain name fuzzing algorithm to generate suspicious URLs of the website to be detected, crawls the suspicious URLs, and the resulting websites are referred to as suspicious websites; extracts features from the target website and the suspicious website to obtain corresponding comprehensive feature vectors; inputs the comprehensive feature vectors into the prediction model to detect whether the suspicious URL is a phishing website of the target website. Alternatively, this can be simply understood as inputting the target website and the suspicious website into the algorithm designed in this application to detect whether the suspicious URL is a phishing website of the target website.

[0186] Implementation step four: Report and block identified phishing websites to prevent customers from being deceived.

[0187] By applying the phishing website detection method of this application, financial institutions can quickly identify and block these phishing websites, thereby effectively preventing users from mistakenly entering them. To further enhance users' security awareness, financial service platforms can also regularly provide users with security warnings and education to help them understand common phishing tactics and improve their ability to identify phishing websites.

[0188] 2. Daily protection of enterprise networks

[0189] Implementation steps 1 and 2 are similar to those in the above embodiment and will not be repeated here.

[0190] Implementation Step 3: Utilize the Internet Content ICP Database to obtain the domain names of enterprises nationwide, construct URLs based on these domain names, and perform crawling. The crawled websites are enterprise websites, referred to as target websites. For a particular enterprise website, use a domain name fuzzy algorithm to generate suspicious URLs, and perform crawling. The crawled websites are referred to as suspicious websites. Feature extraction is performed on the target website and the suspicious website to obtain corresponding comprehensive feature vectors. The comprehensive feature vectors are input into the prediction model to detect whether the suspicious URL is a phishing website of the target website. This can also be simply understood as inputting the target website and the suspicious website into the algorithm designed in this application to detect whether the suspicious URL is a phishing website of the target website.

[0191] The process of constructing a URL based on a domain name is to add the prefix "http: / / " or "https: / / " to the domain name to construct the URL.

[0192] Implementation step four: Report the identified phishing websites and add them to the blacklist to prevent internal employees from accessing them.

[0193] By deploying phishing detection technology, enterprises can monitor and filter access requests in real time, automatically identifying suspicious websites and blocking access. Furthermore, based on collected phishing site samples, enterprises can conduct feature analysis and provide regular employee training to raise employee awareness of phishing sites, further strengthening their network security defenses. This comprehensive security strategy not only protects their data and assets, but also safeguards their reputation and mitigates the financial losses caused by cyberattacks.

[0194] Example 9:

[0195] Based on the same application concept, the present application embodiment provides a device for detecting phishing websites. Figure 9 For a schematic diagram of a phishing website detection device provided in an embodiment of the present application, please refer to Figure 10 , the device comprises:

[0196] Receiving module 901, for receiving the input uniform resource locator URL of the target website;

[0197] Processing module 902 is used to replace at least one character in the URL to generate multiple suspicious URLs; based on the URL and each suspicious URL, obtain a first hypertext markup language HTML document of the target website and a second HTML document of each suspicious website; for each suspicious website, extract the structural information feature vector and the content information feature vector of the first HTML document and the second HTML document of the suspicious website based on the website encoder; concatenate the corresponding structural information feature vector and content information feature vector to obtain a first feature vector of the first HTML document and a second feature vector of the second HTML document; concatenate the first feature vector and the second feature vector to obtain a first comprehensive feature vector; input the first comprehensive feature vector into a pre-trained prediction model, and determine whether the suspicious website is a phishing website of the target website based on the prediction model.

[0198] Furthermore, the processing module 902 is specifically used to extract features from the HTML document through a deep optimization traversal algorithm to generate a tree structure diagram of the HTML document; the tree structure diagram includes leaf nodes and non-leaf nodes of the HTML document, wherein the non-leaf nodes include root nodes; the node information corresponding to each node in the tree structure diagram is encoded to obtain a corresponding initial feature vector; based on the tree convolution model in the website encoder and the initial feature vectors corresponding to the non-leaf nodes and the child nodes of the non-leaf nodes, a structural information feature vector is obtained; based on the long short-term memory model in the website encoder and all leaf nodes and the corresponding initial feature vectors, a corresponding content information feature vector is obtained.

[0199] Furthermore, the processing module 902 is specifically used to, for each non-leaf node, if the child nodes of the non-leaf node are only leaf nodes, then the non-leaf node is used as the first non-leaf node; if the child nodes of the non-leaf node are only non-leaf nodes, then the non-leaf node is used as the second non-leaf node, otherwise the non-leaf node is used as the third non-leaf node; for each first non-leaf node, based on the tree convolution model and the initial feature vectors of each child node of the first non-leaf node after splicing and the initial feature vector of the first non-leaf node, obtain the convolution feature vector of the first non-leaf node; for each second non-leaf node, based on The convolution feature vector corresponding to each child node of the second non-leaf node after splicing is obtained from the tree convolution model and the initial feature vector corresponding to the second non-leaf node to obtain the convolution feature vector of the second non-leaf node; for each third non-leaf node, the initial feature vector of the leaf node and the convolution feature vector of the non-leaf node among the child nodes of the third non-leaf node are obtained, and the obtained initial feature vector, convolution feature vector and initial feature vector of the third non-leaf node are spliced ​​and input into the tree convolution model to obtain the convolution feature vector of the third non-leaf node; the convolution feature vector of the root node is determined as the structural information feature vector.

[0200] Furthermore, the processing module 902 is specifically used to sort each leaf node according to the order of generation of each node in the tree structure diagram; input the initialized feature vector of each leaf node into the long short-term memory model according to the sorted leaf nodes, and the hidden layer of the long short-term memory model splices the initialized feature vector of the leaf node and the preset initial feature vector for the leaf node ranked first, and calculates the hidden layer state vector of the leaf node ranked first based on the gating mechanism; for the leaf node ranked not in the first place, splices the hidden layer state vector of the leaf node ranked before the leaf node and the initial feature vector of the leaf node, and calculates the hidden layer state vector of the leaf node based on the gating mechanism; the pooling layer of the long short-term memory model average pools and linearly transforms the hidden layer state vectors of all leaf nodes to obtain the content information feature vector.

[0201] Furthermore, the processing module 902 is specifically used to determine the text sub-nodes, image sub-nodes and tag sub-nodes of the HTML document; use the text sub-nodes and image sub-nodes of the HTML document as leaf nodes in the tree structure diagram; and use the tag sub-nodes of the HTML document as non-leaf nodes in the tree structure diagram.

[0202] Furthermore, the processing module 902 is specifically used to, for each leaf node in the tree structure diagram, if the leaf node is a text sub-node, use the bidirectional encoding Bert model to encode the text information of the text sub-node to obtain the initial feature vector of the leaf node; if the leaf node is an image sub-node, use the deep convolutional neural network Resnet to encode the image information of the image sub-node to obtain the initial feature vector corresponding to the leaf node.

[0203] Furthermore, the processing module 902 is specifically used to determine the label sub-node type for each non-leaf node in the tree structure diagram based on the label information of the label sub-node corresponding to the non-leaf node; and determine the initial feature vector corresponding to the non-leaf node based on the pre-saved correspondence between the label sub-node type and the initialization feature vector corresponding to the label sub-node type.

[0204] Example 10:

[0205] Based on the same application concept, an embodiment of the present application provides an electronic device that can implement the steps of the phishing website detection method discussed above. Figure 10 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, it includes: a processor 1001, a communication interface 1002, a memory 1003 and a communication bus 1004, wherein the processor 1001, the communication interface 1002, and the memory 1003 communicate with each other through the communication bus 1004;

[0206] The memory 1003 stores a computer program. When the program is executed by the processor 1001, the processor 1001 performs the following steps:

[0207] Receiving an input uniform resource locator (URL) of a target website; replacing at least one character in the URL to generate a plurality of suspicious URLs; obtaining a first hypertext markup language (HTML) document of the target website and a second HTML document of each suspicious website based on the URL and each suspicious URL;

[0208] For each suspicious website, the structural information feature vector and the content information feature vector of the first HTML document and the second HTML document of the suspicious website are respectively extracted based on the website encoder; the corresponding structural information feature vector and content information feature vector are spliced ​​to obtain a first feature vector of the first HTML document and a second feature vector of the second HTML document; the first feature vector and the second feature vector are spliced ​​to obtain a first comprehensive feature vector; the first comprehensive feature vector is input into a pre-trained prediction model, and based on the prediction model, it is determined whether the suspicious website is a phishing website of the target website.

[0209] Furthermore, the processor 1001 is specifically configured to perform feature extraction on the HTML document using a deep optimization traversal algorithm to generate a tree structure diagram of the HTML document; the tree structure diagram includes leaf nodes and non-leaf nodes of the HTML document, wherein the non-leaf nodes include a root node; and encode node information corresponding to each node in the tree structure diagram to obtain a corresponding initial feature vector.

[0210] Based on the tree convolution model in the website encoder and the initial feature vectors corresponding to the non-leaf nodes and their children, a structural information feature vector is obtained;

[0211] Based on the long short-term memory model and all leaf nodes and the corresponding initial feature vectors in the website encoder, a corresponding content information feature vector is obtained.

[0212] Further, the processor 1001 is specifically configured to, for each non-leaf node, if the child nodes of the non-leaf node are only leaf nodes, use the non-leaf node as the first non-leaf node; if the child nodes of the non-leaf node are only non-leaf nodes, use the non-leaf node as the second non-leaf node; otherwise, use the non-leaf node as the third non-leaf node;

[0213] For each first non-leaf node, obtain a convolution feature vector of the first non-leaf node based on the tree convolution model and the concatenated initial feature vectors of each child node of the first non-leaf node and the initial feature vector of the first non-leaf node;

[0214] For each second non-leaf node, based on the tree convolution model and the concatenated convolution feature vectors corresponding to each child node of the second non-leaf node and the initial feature vector corresponding to the second non-leaf node, obtain a convolution feature vector of the second non-leaf node;

[0215] For each third non-leaf node, obtain the initial feature vector of the leaf node and the convolution feature vector of the non-leaf node among the child nodes of the third non-leaf node, splice the obtained initial feature vector, convolution feature vector and the initial feature vector of the third non-leaf node and input them into the tree convolution model to obtain the convolution feature vector of the third non-leaf node;

[0216] The convolution feature vector of the root node is determined as the structural information feature vector.

[0217] Furthermore, the processor 1001 is specifically configured to sort each leaf node according to the order in which each node in the tree structure diagram is generated;

[0218] Inputting the initialized feature vector of each leaf node into the long short-term memory model in the order of the sorted leaf nodes, the hidden layer of the long short-term memory model splices the initialized feature vector of the leaf node and the preset initial feature vector for the leaf node ranked first, and calculates the hidden layer state vector of the leaf node ranked first based on the gating mechanism; for the leaf node ranked not first, splicing the hidden layer state vector of the leaf node ranked before the leaf node and the initial feature vector of the leaf node, and calculating the hidden layer state vector of the leaf node based on the gating mechanism;

[0219] The pooling layer of the long short-term memory model performs average pooling and linear transformation on the hidden layer state vectors of all leaf nodes to obtain a content information feature vector.

[0220] Furthermore, the processor 1001 is specifically used to determine the text sub-nodes, image sub-nodes and tag sub-nodes of the HTML document; use the text sub-nodes and image sub-nodes of the HTML document as leaf nodes in the tree structure diagram; and use the tag sub-nodes of the HTML document as non-leaf nodes in the tree structure diagram.

[0221] Furthermore, the processor 1001 is specifically used to, for each leaf node in the tree structure diagram, if the leaf node is a text sub-node, use the bidirectional encoding Bert model to encode the text information of the text sub-node to obtain the initial feature vector of the leaf node; if the leaf node is an image sub-node, use the deep convolutional neural network Resnet to encode the image information of the image sub-node to obtain the initial feature vector corresponding to the leaf node.

[0222] Furthermore, the processor 1001 is specifically used to determine the label sub-node type for each non-leaf node in the tree structure diagram based on the label information of the label sub-node corresponding to the non-leaf node; and determine the initial feature vector corresponding to the non-leaf node based on the pre-saved correspondence between the label sub-node type and the initialization feature vector corresponding to the label sub-node type.

[0223] The communication bus mentioned in the above-mentioned electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. The communication interface 1002 is used for communication between the above-mentioned electronic device and other devices. The memory can include a random access memory (RAM) and can also include a non-volatile memory (NVM), such as at least one disk storage. Optionally, the memory can also be at least one storage device located away from the aforementioned processor.

[0224] The above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (NP), etc.; it can also be a digital signal processing processor (DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0225] Example 11:

[0226] Based on the same application concept, embodiments of the present application provide a computer-readable storage medium storing a computer program executable by a processor. When the program is executed on the processor, the processor executes any of the phishing website detection methods discussed above. Because the principles underlying the problem solved by the computer-readable storage medium are similar to those of the phishing website detection method, the implementation of the computer-readable storage medium can be referred to as the implementation of the method, and any repetitions will not be repeated here.

[0227] Based on the same application concept, embodiments of the present application further provide a computer program product, comprising: computer program code, which, when executed on a computer, causes the computer to execute any of the phishing website detection methods discussed above. Because the principles underlying the problems solved by the aforementioned computer program products are similar to those of the phishing website detection methods, the implementation of the aforementioned computer program products can be referenced to the implementation of the methods, and any repetitions will not be repeated.

[0228] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0229] The computer program for performing the operation of the present disclosure can be an assembly instruction, an instruction set architecture (ISA) instruction, a machine instruction, a machine-related instruction, a microcode, a firmware instruction, a state setting data, or a source code or an object code written in any combination of one or more programming languages, wherein the programming language includes an object-oriented programming language such as Smalltalk, C++, and a conventional procedural programming language such as "C" language or similar programming language. The computer readable program instruction can be executed completely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer and partially on a remote computer, or executed completely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer by any type of network including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (such as by using an Internet service provider to connect to the Internet). In certain embodiments, by utilizing the state information of the computer readable program instruction to personalize an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA) or a programmable logic array (PLA), the electronic circuit can execute the computer readable program instruction, thereby realizing various aspects of the present disclosure.

[0230] The computer program product described herein may be implemented in hardware, software, or a combination thereof. In one embodiment, the computer program product is implemented as a computer storage medium. In another embodiment, the computer program product is implemented as a software product, such as a software development kit (SDK).

[0231] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0232] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0233] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. ​ a process or multiple processes and / or boxes ​ The steps for the function specified in one or more boxes.

[0234] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0235] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.< / h3> < / content> < / name> < / name> < / name> < / content> < / name> < / h1> < / content> < / name> < / content> < / name> < / content> < / name> < / h1>

Claims

1. A method for detecting phishing websites, characterized in that: The method comprises: Receiving an input uniform resource locator (URL) of a target website; replacing at least one character in the URL to generate a plurality of suspicious URLs; obtaining a first hypertext markup language (HTML) document of the target website and a second HTML document of each suspicious website based on the URL and each suspicious URL; For each suspicious website, the structural information feature vector and the content information feature vector of the first HTML document and the second HTML document of the suspicious website are respectively extracted based on the website encoder; the corresponding structural information feature vector and content information feature vector are spliced ​​to obtain a first feature vector of the first HTML document and a second feature vector of the second HTML document; the first feature vector and the second feature vector are spliced ​​to obtain a first comprehensive feature vector; the first comprehensive feature vector is input into a pre-trained prediction model, and based on the prediction model, it is determined whether the suspicious website is a phishing website of the target website.

2. The method according to claim 1, characterized in that Extracting the structural information feature vector and content information feature vector of the HTML document based on the website encoder includes: Extract features from an HTML document using a deep optimization traversal algorithm to generate a tree structure diagram of the HTML document; the tree structure diagram includes leaf nodes and non-leaf nodes of the HTML document, wherein the non-leaf nodes include a root node; encode node information corresponding to each node in the tree structure diagram to obtain a corresponding initial feature vector; Based on the tree convolution model in the website encoder and the initial feature vectors corresponding to the non-leaf nodes and their children, a structural information feature vector is obtained; Based on the long short-term memory model and all leaf nodes and the corresponding initial feature vectors in the website encoder, a corresponding content information feature vector is obtained.

3. The method according to claim 2, characterized in that The structure information feature vector obtained based on the tree convolution model in the website encoder and the initial feature vectors corresponding to the non-leaf nodes and the child nodes of the non-leaf nodes includes: For each non-leaf node, if the non-leaf node's child nodes are only leaf nodes, then the non-leaf node is regarded as the first non-leaf node; if the non-leaf node's child nodes are only non-leaf nodes, then the non-leaf node is regarded as the second non-leaf node; otherwise, the non-leaf node is regarded as the third non-leaf node; For each first non-leaf node, obtain a convolution feature vector of the first non-leaf node based on the tree convolution model and the concatenated initial feature vectors of each child node of the first non-leaf node and the initial feature vector of the first non-leaf node; For each second non-leaf node, based on the tree convolution model and the concatenated convolution feature vectors corresponding to each child node of the second non-leaf node and the initial feature vector corresponding to the second non-leaf node, obtain a convolution feature vector of the second non-leaf node; For each third non-leaf node, obtain the initial feature vector of the leaf node and the convolution feature vector of the non-leaf node among the child nodes of the third non-leaf node, splice the obtained initial feature vector, convolution feature vector and the initial feature vector of the third non-leaf node and input them into the tree convolution model to obtain the convolution feature vector of the third non-leaf node; The convolution feature vector of the root node is determined as the structural information feature vector.

4. The method according to claim 2, characterized in that The content information feature vector obtained based on the long short-term memory model of the website encoder and all leaf nodes and the corresponding initial feature vectors includes: Sort each leaf node according to the order in which each node in the tree structure diagram is generated; Inputting the initialized feature vector of each leaf node into the long short-term memory model in the order of the sorted leaf nodes, the hidden layer of the long short-term memory model splices the initialized feature vector of the leaf node and the preset initial feature vector for the leaf node ranked first, and calculates the hidden layer state vector of the leaf node ranked first based on the gating mechanism; for the leaf node ranked not first, splicing the hidden layer state vector of the leaf node ranked before the leaf node and the initial feature vector of the leaf node, and calculating the hidden layer state vector of the leaf node based on the gating mechanism; The pooling layer of the long short-term memory model performs average pooling and linear transformation on the hidden layer state vectors of all leaf nodes to obtain a content information feature vector.

5. The method according to claim 2, characterized in that The step of extracting features from an HTML document using a deep optimization traversal algorithm to generate a tree structure diagram of the HTML document includes: Determine the text subnodes, image subnodes and tag subnodes of the HTML document; use the text subnodes and image subnodes of the HTML document as leaf nodes in the tree structure diagram; and use the tag subnodes of the HTML document as non-leaf nodes in the tree structure diagram.

6. The method according to claim 5, characterized in that The information corresponding to each node in the tree structure diagram is encoded to obtain the corresponding initial feature vector including: For each leaf node in the tree structure diagram, if the leaf node is a text subnode, the bidirectional encoding Bert model is used to encode the text information of the text subnode to obtain the initial feature vector of the leaf node; if the leaf node is an image subnode, the deep convolutional neural network Resnet is used to encode the image information of the image subnode to obtain the initial feature vector corresponding to the leaf node.

7. The method according to claim 5, characterized in that The information corresponding to each node in the tree structure diagram is encoded to obtain the corresponding initial feature vector including: For each non-leaf node in the tree structure diagram, the label sub-node type is determined according to the label information of the label sub-node corresponding to the non-leaf node; and the initial feature vector corresponding to the non-leaf node is determined according to the pre-saved correspondence between the label sub-node type and the initialization feature vector corresponding to the label sub-node type.

8. A device for detecting phishing websites, characterized in that: The device comprises: A receiving module, configured to receive a uniform resource locator (URL) of a target website; A processing module is used to replace at least one character in the URL to generate multiple suspicious URLs; based on the URL and each suspicious URL, obtain a first hypertext markup language HTML document of the target website and a second HTML document of each suspicious website; for each suspicious website, extract the structural information feature vector and the content information feature vector of the first HTML document and the second HTML document of the suspicious website based on a website encoder; concatenate the corresponding structural information feature vector and content information feature vector to obtain a first feature vector of the first HTML document and a second feature vector of the second HTML document; concatenate the first feature vector and the second feature vector to obtain a first comprehensive feature vector; input the first comprehensive feature vector into a pre-trained prediction model, and determine whether the suspicious website is a phishing website of the target website based on the prediction model.

9. An electronic device, characterized in that: The electronic device includes a processor, and the processor is configured to implement the method according to any one of claims 1 to 7 when executing a computer program stored in a memory.

10. A computer-readable storage medium, characterized in that The device stores a computer program, which implements the method according to any one of claims 1 to 7 when executed by a processor.

Images