A method and system for detecting a fraudulent website

Abstract

The application discloses a fraud website detection method and system, applied to the field of artificial intelligence technology, comprising: acquiring the multi-modal features of a webpage to be detected; respectively preprocessing pictures, webpage documents and website information to obtain logo pictures, texts and domain name information; according to the logo pictures and texts, using a multi-modal retriever to retrieve a plurality of brands and their corresponding brand information similar to the webpage to be detected from a brand knowledge base; according to the texts, domain name information and each brand and its corresponding brand information, judging whether a target brand exists in each brand; if so, according to the domain name list of the target brand, judging whether the webpage to be detected is a suspected fraud webpage; if so, according to the domain name information, calculating a comprehensive score; when the comprehensive score is less than a preset threshold, determining that the webpage to be detected is a fraud webpage. Thus, efficient and accurate detection of fraud websites is realized, thereby avoiding the problem of misjudgment.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a method and system for detecting fraudulent websites. Background Technology

[0002] With the rapid development of the internet, online fraud methods have become more covert and diversified, with phishing attacks becoming a major form of fraud. Attackers impersonate legitimate websites or well-known brands, tricking users into entering sensitive information such as usernames, passwords, and bank account details, leading to serious economic losses and privacy breaches for individuals, businesses, and governments. Since attacks typically target a few well-known brands, how to efficiently and accurately detect fraudulent websites, especially phishing websites impersonating well-known brands, has become a key research topic in the field of cybersecurity.

[0003] Traditional methods for detecting fraudulent websites mainly include blacklists, rule matching, and machine learning models. Blacklisting relies on lists of known fraudulent websites but struggles to detect newly emerging ones, leading to false positives. Rule matching identifies fraudulent websites by analyzing features such as URLs, HTML structure, and keywords; however, because the rules are fixed, they are ill-suited to adapt to constantly evolving fraud techniques, resulting in false positives as well. Machine learning methods train models to distinguish between legitimate and fraudulent websites, but as fraudulent websites become increasingly visually and content-wise similar to legitimate websites, they too are prone to false positives. Therefore, addressing new types of fraudulent websites, improving detection accuracy, and avoiding false positives have become important research directions. Summary of the Invention

[0004] In view of the shortcomings of the prior art, this application provides a method and system for detecting fraudulent websites, so as to improve the accuracy of detecting fraudulent websites and avoid the problem of misjudgment.

[0005] To achieve the above objectives, this application provides the following technical solution:

[0006] The first aspect of this application provides a method for detecting fraudulent websites, including:

[0007] Obtain the multimodal features of the webpage to be detected; wherein, the multimodal features include at least images, webpage documents, and URL information;

[0008] The image, the webpage document, and the URL information are preprocessed respectively to obtain the logo image corresponding to the image, the text corresponding to the webpage document, and the domain name information corresponding to the URL information;

[0009] Based on the logo image and the text, a multimodal retrieval tool is used to retrieve multiple brands similar to the webpage to be detected and their corresponding brand information from the brand knowledge base; wherein, the multimodal retrieval tool is pre-extracted from brand data in open source databases and authoritative brand lists using optical character recognition technology, and the extracted data is constructed by adding change tasks;

[0010] Based on the text, the domain name information, and each of the brands and their corresponding brand information, determine whether the target brand exists among the brands;

[0011] If the target brand exists among the various brands, then based on the domain name list of the target brand, it is determined whether the webpage to be detected is a suspected fraudulent webpage;

[0012] If the webpage to be detected is a suspected fraudulent webpage, then a comprehensive score is calculated based on the domain name information;

[0013] If the overall score is less than a preset threshold, the webpage to be detected is determined to be a fraudulent webpage.

[0014] Optionally, in the above-mentioned method for detecting fraudulent websites, the preprocessing of the image, the webpage document, and the URL information to obtain the logo image corresponding to the image, the text corresponding to the webpage document, and the domain name information corresponding to the URL information includes:

[0015] The image is input into the target detection model to obtain multiple candidate label images and their corresponding confidence scores;

[0016] Extract the confidence score with the highest value from all confidence scores, and use the candidate label image corresponding to the confidence score with the highest value as the label image corresponding to the image;

[0017] Using regular expressions and tag filtering rules, target text that meets preset requirements is filtered out from the web page document, and the target text is organized and cleaned to obtain the text corresponding to the web page document;

[0018] The URL information is parsed to obtain the domain name information corresponding to the URL information.

[0019] Optionally, in the above-described method for detecting fraudulent websites, the step of retrieving multiple brands similar to the webpage to be detected and their corresponding brand information from a brand knowledge base using a multimodal retrieval tool based on the logo image and the text includes:

[0020] The text is encoded using a text encoder to obtain encoded text, and the logo image is encoded using an image encoder to obtain an encoded image;

[0021] The encoded text and the encoded image are weighted and summed to obtain a weighted vector, and the weighted vector is normalized to obtain the combined webpage encoding;

[0022] The image encoder is used to encode the brand name and brand logo in the brand knowledge base to obtain the coded brand name and coded brand logo, and the brand combination code is calculated based on the coded brand name and the coded brand logo.

[0023] Calculate the cosine similarity between the combined webpage encoding and the combined brand encoding, and use a multimodal retrieval tool to retrieve from the brand knowledge base the multiple brands that match the highest cosine similarity and their corresponding brand information.

[0024] Optionally, in the above-mentioned method for detecting fraudulent websites, determining whether the target brand exists among the various brands based on the text, the domain name information, and each brand and its corresponding brand information includes:

[0025] The text, the domain name information, and each of the brands and their corresponding brand information are input into a large language model for recognition, and the recognition result is obtained.

[0026] When the identification result contains the target brand and its corresponding identification data, it is determined that the target brand exists among the various brands.

[0027] When the recognition result is that no target brand is found, the logo image and each of the brands and their corresponding brand information are input into the large language model for recognition to obtain the target recognition result.

[0028] When the target identification result is a result containing the target brand and its corresponding identification data, it is determined that the target brand exists among the various brands.

[0029] When the identification result is that no target brand is found, it is determined that the target brand does not exist among the various brands.

[0030] Optionally, in the above-described method for detecting fraudulent websites, determining whether the webpage to be detected is a suspected fraudulent webpage based on the domain name list of the target brand includes:

[0031] Determine whether the domain name corresponding to the webpage to be detected matches the target domain name in the list of legitimate domain names of the target brand;

[0032] If the domain name corresponding to the webpage to be detected does not match the target domain name in the list of legitimate domain names of the target brand, then for each target domain name in the list of legitimate domain names, the distance between the domain name corresponding to the webpage to be detected and the target domain name is calculated using a distance algorithm.

[0033] Based on the domain name corresponding to the webpage to be detected, the target domain name, and the distance, the similarity between the webpage to be detected and the target domain name is calculated;

[0034] Extract the maximum similarity from all similarities and determine whether the maximum similarity is greater than a preset threshold;

[0035] If the maximum similarity is greater than the preset threshold, then the webpage to be detected is determined to be a suspected fraudulent webpage;

[0036] If the maximum similarity is not greater than the preset threshold, then the webpage to be detected is determined to be a fraudulent webpage.

[0037] Optionally, in the above-mentioned method for detecting fraudulent websites, the step of calculating a comprehensive score based on the domain name information includes:

[0038] Retrieve resource data corresponding to the domain name information from the online resource library; wherein, the resource data includes at least the number of search results, ranking position, content relevance, and official statement data;

[0039] Calculate the scores for the number of search results, the ranking position, the content relevance, and the official statement data, respectively; and calculate the authority score and the maximum similarity score for the webpage to be detected.

[0040] Based on preset weights, the scores for the number of search results, the ranking position, the content relevance, the official statement data, the authority score, and the maximum similarity score are weighted and summed to obtain a comprehensive score.

[0041] The second aspect of this application provides a detection system for fraudulent websites, the detection system comprising: a preprocessing module, a multimodal brand recognition module, a domain name matching and verification module, and a comprehensive evaluation module;

[0042] The preprocessing module is used to acquire the multimodal features of the webpage to be detected, and to preprocess the image, webpage document, and URL information respectively to obtain the marker image corresponding to the image, the text corresponding to the webpage document, and the domain name information corresponding to the URL information; wherein, the multimodal features include at least the image, the webpage document, and the URL information;

[0043] The multimodal brand recognition module is used to retrieve multiple brands and their corresponding brand information that are similar to the webpage to be detected from the brand knowledge base based on the logo image and the text using a multimodal retrieval device; wherein, the multimodal retrieval device is pre-extracted from brand data in an open-source database and an authoritative brand list using optical character recognition technology, and the extracted data is constructed by adding a change task;

[0044] The domain name matching and verification module is used to determine whether a target brand exists among the various brands based on the text, the domain name information, and each brand and its corresponding brand information, and if the target brand exists among the various brands, to determine whether the webpage to be detected is a suspected fraudulent webpage based on the domain name list of the target brand.

[0045] The comprehensive evaluation module is used to calculate a comprehensive score based on the domain name information if the webpage to be detected is a suspected fraudulent webpage, and to determine that the webpage to be detected is a fraudulent webpage when the comprehensive score is less than a preset threshold.

[0046] Optionally, in the aforementioned fraudulent website detection system, the preprocessing module performs preprocessing on the image, the webpage document, and the URL information respectively to obtain the logo image corresponding to the image, the text corresponding to the webpage document, and the domain name information corresponding to the URL information, specifically for:

[0047] The image is input into the target detection model to obtain multiple candidate label images and their corresponding confidence scores;

[0048] Extract the confidence score with the highest value from all confidence scores, and use the candidate label image corresponding to the confidence score with the highest value as the label image corresponding to the image;

[0049] Using regular expressions and tag filtering rules, target text that meets preset requirements is filtered out from the web page document, and the target text is organized and cleaned to obtain the text corresponding to the web page document;

[0050] The URL information is parsed to obtain the domain name information corresponding to the URL information.

[0051] Optionally, in the aforementioned fraudulent website detection system, the multimodal brand recognition module performs the following: based on the logo image and the text, it uses a multimodal retrieval device to retrieve multiple brands similar to the webpage to be detected and their corresponding brand information from the brand knowledge base. Specifically, this is used for:

[0052] The text is encoded using a text encoder to obtain encoded text, and the logo image is encoded using an image encoder to obtain an encoded image;

[0053] The encoded text and the encoded image are weighted and summed to obtain a weighted vector, and the weighted vector is normalized to obtain the combined webpage encoding;

[0054] The image encoder is used to encode the brand name and brand logo in the brand knowledge base to obtain the coded brand name and coded brand logo, and the brand combination code is calculated based on the coded brand name and the coded brand logo.

[0055] Calculate the cosine similarity between the combined webpage encoding and the combined brand encoding, and use a multimodal retrieval tool to retrieve from the brand knowledge base the multiple brands that match the highest cosine similarity and their corresponding brand information.

[0056] Optionally, in the aforementioned fraudulent website detection system, the domain name matching and verification module performs a function to determine whether the target brand exists among the various brands based on the text, the domain name information, and each brand and its corresponding brand information. Specifically, this is used for:

[0057] The text, the domain name information, and each of the brands and their corresponding brand information are input into a large language model for recognition, and the recognition result is obtained.

[0058] When the identification result contains the target brand and its corresponding identification data, it is determined that the target brand exists among the various brands.

[0059] When the recognition result is that no target brand is found, the logo image and each of the brands and their corresponding brand information are input into the large language model for recognition to obtain the target recognition result.

[0060] When the target identification result is a result containing the target brand and its corresponding identification data, it is determined that the target brand exists among the various brands.

[0061] When the identification result is that no target brand is found, it is determined that the target brand does not exist among the various brands.

[0062] Optionally, in the aforementioned fraudulent website detection system, the domain name matching and verification module determines whether the webpage to be detected is a suspected fraudulent webpage based on the domain name list of the target brand, specifically for:

[0063] Determine whether the domain name corresponding to the webpage to be detected matches the target domain name in the list of legitimate domain names of the target brand;

[0064] If the domain name corresponding to the webpage to be detected does not match the target domain name in the list of legitimate domain names of the target brand, then for each target domain name in the list of legitimate domain names, the distance between the domain name corresponding to the webpage to be detected and the target domain name is calculated using a distance algorithm.

[0065] Based on the domain name corresponding to the webpage to be detected, the target domain name, and the distance, the similarity between the webpage to be detected and the target domain name is calculated;

[0066] Extract the maximum similarity from all similarities and determine whether the maximum similarity is greater than a preset threshold;

[0067] If the maximum similarity is greater than the preset threshold, then the webpage to be detected is determined to be a suspected fraudulent webpage;

[0068] If the maximum similarity is not greater than the preset threshold, then the webpage to be detected is determined to be a fraudulent webpage.

[0069] Optionally, in the aforementioned fraudulent website detection system, the comprehensive evaluation module calculates a comprehensive score based on the domain name information, specifically for:

[0070] Retrieve resource data corresponding to the domain name information from the online resource library; wherein, the resource data includes at least the number of search results, ranking position, content relevance, and official statement data;

[0071] Calculate the scores for the number of search results, the ranking position, the content relevance, and the official statement data, respectively; and calculate the authority score and the maximum similarity score for the webpage to be detected.

[0072] Based on preset weights, the scores for the number of search results, the ranking position, the content relevance, the official statement data, the authority score, and the maximum similarity score are weighted and summed to obtain a comprehensive score.

[0073] This application provides a method for detecting fraudulent websites. The method involves acquiring multimodal features of the webpage to be detected, including at least images, webpage documents, and URL information. These features are then preprocessed to obtain a logo image corresponding to the image, text corresponding to the webpage document, and domain name information corresponding to the URL. Next, based on the logo image and text, a multimodal retrieval tool is used to retrieve multiple brands similar to the webpage to be detected and their corresponding brand information from a brand knowledge base. The multimodal retrieval tool is pre-constructed by extracting brand data from an open-source database and an authoritative brand list using optical character recognition technology, and then adding modification tasks to the extracted data. Based on the text, the domain name information, and each brand and its corresponding brand information, the method determines whether a target brand exists among the brands. If the target brand exists, the method determines whether the webpage to be detected is a suspected fraudulent webpage based on the domain name list of the target brand. If the webpage to be detected is a suspected fraudulent webpage, a comprehensive score is calculated based on the domain name information. Finally, if the comprehensive score is less than a preset threshold, the webpage to be detected is determined to be a fraudulent webpage. By extracting key information from webpage screenshots, HTML documents, and URLs, and combining this with steps such as brand recognition, domain name matching verification, and comprehensive scoring, the system can efficiently and accurately detect fraudulent websites, thereby avoiding misjudgments. Attached Figure Description

[0074] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0075] Figure 1 This is a schematic diagram of the structure of a fraudulent website detection system provided in an embodiment of this application;

[0076] Figure 2 A flowchart illustrating a method for detecting fraudulent websites provided in this application embodiment;

[0077] Figure 3 A flowchart illustrating a preprocessing method for multimodal features provided in another embodiment of this application;

[0078] Figure 4 A flowchart illustrating a method for obtaining a brand and its brand information, provided as another embodiment of this application;

[0079] Figure 5A flowchart illustrating a method for determining a target brand, provided as another embodiment of this application;

[0080] Figure 6 A flowchart illustrating a method for identifying a suspected fraudulent webpage, provided as another embodiment of this application;

[0081] Figure 7 A flowchart illustrating a method for calculating a comprehensive score, provided in another embodiment of this application;

[0082] Figure 8 This is a schematic diagram of the structure of a fraudulent website detection system provided in another embodiment of this application. Detailed Implementation

[0083] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0084] In this application, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0085] This application provides a method for detecting fraudulent websites, which is applied to a fraudulent website detection system to improve the accuracy of detecting fraudulent websites and avoid misjudgments.

[0086] Optionally, such as Figure 1 As shown in the figure, this application provides a detection system for fraudulent websites, including: a preprocessing module, a multimodal brand recognition module, a domain name matching and verification module, and a comprehensive evaluation module.

[0087] The preprocessing module is used to obtain screenshots, HTML documents, and URL information of the detected webpage, and to preprocess the screenshots, HTML documents, and URL information.

[0088] The multimodal brand recognition module consists of a multimodal retriever and a multimodal brand recognizer. The multimodal brand recognition module is used to determine whether a website to be detected is a fraudulent website. The multimodal retriever is used to retrieve the target brand range for the detected webpage. The multimodal brand recognizer is used to identify the brand of the website to be detected.

[0089] The domain name matching verification module is used to verify whether the domain name of the webpage to be detected is consistent with the legitimate domain name of the target brand, thereby further determining whether the webpage is a fraudulent website.

[0090] The comprehensive evaluation module is used to prevent misjudging real websites. It combines the confidence score of the multimodal brand recognizer for webpage brand recognition and the webpage domain similarity score to calculate a comprehensive score, and then uses the comprehensive score to determine the final judgment result of the webpage to be detected.

[0091] Therefore, based on the fraudulent website detection system provided above, this application embodiment provides a method for detecting fraudulent websites, such as... Figure 2 As shown, the specific steps include:

[0092] S201. Obtain the multimodal features of the webpage to be detected.

[0093] Multimodal features can include images, web page documents, and URL information. By comprehensively reflecting the attributes of web pages from three dimensions—visual, textual, and structural—it ensures that the information extracted from the web page to be detected is complete and can accurately describe the characteristics of the web page to be detected, thus providing a data foundation for subsequent analysis and scoring of fraudulent websites.

[0094] In addition, the web page document is an HTML document, and the URL information is URL information.

[0095] S202. Preprocess the images, web page documents, and URL information respectively to obtain the logo images corresponding to the images, the text corresponding to the web page documents, and the domain information corresponding to the URL information.

[0096] Preprocessing methods can include model detection, rule filtering, and parsing techniques, among others.

[0097] Optionally, in another embodiment of this application, one specific implementation of step S202 is as follows: Figure 3 As shown, the specific steps include:

[0098] S301. Input the image into the object detection model to obtain multiple candidate label images and their corresponding confidence scores.

[0099] It is understandable that object detection models are trained based on deep learning mechanisms, such as Faster R-CNN or YOLO series, which are customized to train the base network. Therefore, as long as an image is input into the object detection model, the object detection model will output a set of candidate images and their corresponding confidence scores.

[0100] S302. Extract the confidence score with the highest value from all confidence scores, and use the candidate label image corresponding to the confidence score with the highest value as the label image corresponding to the image.

[0101] Specifically, in order to select the best logo image as the subsequent evaluation criterion, the highest confidence score is extracted from all confidence scores, and the candidate logo image corresponding to that confidence score is taken as the extraction result, which is denoted as the logo image. .

[0102] S303. Use regular expressions and tag filtering rules to filter out target text that meets preset requirements from web page documents, and organize and clean the target text to obtain the text corresponding to the web page documents.

[0103] It should be noted that, in order to clean and process the extracted text, removing redundant spaces and special characters to reduce the amount of input content and improve model processing efficiency, the HTML document of the website to be tested is first parsed. Then, regular expressions and tag filtering rules are written to remove various tags in the HTML (such as...). 、 The code extracts only the plain text content, including layout tags, CSS style code, JavaScript (including tracing code), and other irrelevant information, to obtain the target text. Then, it combines the tags and attributes in the tag filtering rules to extract key text content from the target text, including the webpage title, meta description, tag-related text, header and footer text, etc., to obtain the text corresponding to the webpage document, denoted as . .

[0104] S304. Parse the URL information to obtain the domain name information corresponding to the URL information.

[0105] Specifically, the input URL information is parsed to extract the domain name portion, and further information such as the path and parameters in the URL is extracted, denoted as... This is used to check if a domain name exists within a specified set of domain names to determine whether it is a legitimate website.

[0106] S203. Based on the logo image and text, use a multimodal search engine to retrieve multiple brands similar to the webpage to be detected and their corresponding brand information from the brand knowledge base.

[0107] The multimodal retrieval system first extracts brand data from open-source databases (such as PhishTank and KnowPhish) and authoritative brand lists using optical character recognition (OCR) technology, and then adds change tasks to the extracted data to build the system.

[0108] Understandably, in order to determine whether a webpage to be tested is a fraudulent website, it is first necessary to determine whether the webpage to be tested imitates a well-known brand. Therefore, a multimodal search engine is needed to identify the brand and further verify it against potential imitation brands one by one. So, by searching the webpage to be tested through the modal search engine, multiple brands similar to the webpage to be tested and their corresponding brand information will be obtained. In other words, the webpage to be tested may imitate a well-known brand.

[0109] The brand knowledge base is a multimodal database that includes the brand names of potential target brands for fraudulent websites. ), Brand logo ( ),domain name( Basic information such as ) is built from open source databases, using open source data such as PhishTank and KnowPhish.

[0110] Optionally, in another embodiment of this application, one specific implementation of step S203 is as follows: Figure 4 As shown, the specific steps include:

[0111] S401. Use a text encoder to encode the text to obtain encoded text, and use an image encoder to encode the logo image to obtain encoded image.

[0112] Specifically, to determine whether a webpage being inspected imitates a well-known brand, it is first necessary to use a text encoder to analyze the text. Encode the text to generate an encoded vector that represents the information, which is the encoded text. The text encoder first uses a pre-trained large language model to directly call the text encoding layers of models such as GPT-4 and Claude3, and then uses a multimodal large language model for unified processing. Finally, a lightweight approach is adopted, using a Transformer model, with cleaned HTML text (such as titles and descriptions) as input for training.

[0113] Secondly, using an image encoder logo image Encode the image to obtain the encoded image. Among them, the image encoder Use existing models (such as CLIP-ViT or DINOv2 models).

[0114] S402. Perform a weighted summation on the encoded text and encoded image to obtain a weighted vector, and then normalize the weighted vector to obtain the combined webpage encoding.

[0115] Understandably, to ensure that different encodings in the vector space have the same length, it is necessary to first perform a weighted summation of the encoded text and encoded image, and then normalize the summation to obtain the combined webpage encoding. .

[0116] Specifically, the normalization formula is as follows:

[0117]

[0118] in, , They are respectively the codes and The weight parameters are as follows. If no brand logo is detected in the webpage to be detected, the webpage encoding is calculated only from the text features (i.e., the encoding result of the HTML text of the webpage to be detected), which means that there is no encoding processing for the logo image.

[0119] S403. Use an image encoder to encode the brand name and brand logo in the brand knowledge base to obtain the coded brand name and coded brand logo, and calculate the brand combination code based on the coded brand name and coded brand logo.

[0120] Specifically, in order to subsequently retrieve brands from the brand knowledge base that may be imitating the grid to be detected, it is necessary to analyze the brand names in the brand knowledge base. and brand logo The two variables are encoded using an image encoder to obtain the encoded brand name. and coding brand logo And calculate the brand portfolio code. The specific calculation method is as follows:

[0121]

[0122] in, , They are respectively the codes and The weight parameters are calculated as follows: If the brand has no associated logo, the brand code is calculated solely from text features. If the brand has multiple logos, the combined code for each logo is calculated separately. For example, for the three logos of brand A, the combined codes are generated as follows: BrandVec_A1 = α·v_name + β·v_logo1, BrandVec_A2 = α·v_name + β·v_logo2, BrandVec_A3 = α·v_name + β·v_logo3. Here, α is the weight of the text encoding, β is the weight of the image encoding, v_name is the brand name, and v_logo is the brand logo.

[0123] S404. Calculate the cosine similarity between the combined webpage encoding and the combined brand encoding, and use a multimodal retrieval tool to retrieve the multiple brands with the highest cosine similarity and their corresponding brand information from the brand knowledge base.

[0124] Understandably, to measure the degree of matching between the webpage to be tested and the brands in the brand knowledge base, we can first calculate the cosine similarity between the combined webpage code and the combined brand code, and then use a dot product retrieval method, i.e., a multimodal retrieval tool, to find the top k brands with the highest cosine similarity from the brand knowledge base (BKB).

[0125] Specifically, the search method is as follows:

[0126]

[0127] in, This indicates a multimodal search engine. This indicates the webpage to be tested. Represents the brand knowledge base. This indicates the desired number of target brands. Encoding for web pages Code the brand portfolio.

[0128] Therefore, after the above search operations, the final search results will be k brands and their corresponding brand information, including brand names and legal domain names.

[0129] S204. Based on the text, domain name information, and information about each brand and its corresponding brand, determine whether the target brand exists among the various brands.

[0130] Specifically, the target brand refers to the brand whose imitation behavior is observed on the webpage to be detected. Therefore, in order to identify the target brand from the brands obtained in step S203, a large language model can be used to determine whether the target brand exists among the various brands based on the text, domain name information, and each brand and its corresponding brand information. Thus, while ensuring recognition accuracy, the computational load and resource investment are optimized. If the target brand is found among the various brands, it indicates that the webpage to be detected is imitating a well-known brand, so step S205 is executed.

[0131] Alternatively, if the target brand is not among the brands listed, it indicates that the webpage under test does not imitate well-known brands, thus further demonstrating that the webpage under test is a legitimate website and not a fraudulent website.

[0132] Optionally, in another embodiment of this application, one specific implementation of step S204 is as follows: Figure 5 As shown, the specific steps include:

[0133] S501. Input the text, domain name information, and each brand and its corresponding brand information into the large language model for recognition to obtain the recognition results.

[0134] It should be noted that, in order to pinpoint the target brand, the text of the webpage to be detected, the domain name information, and the various brands and their corresponding brand information retrieved by the multimodal retrieval module need to be input into the large language model for identification. The large language model then designs corresponding prompts and, referring to the list of imitated brands, accurately identifies a target brand. Simultaneously, the large language model is allowed to use online information for retrieval, so the final brand identification result is not limited to a list of potential imitated brands. To make the answers provided by the large language model more logical and confident, thought chains are incorporated into the prompts to guide reasoning. After analysis and processing by the large language model, the final output identification result includes the extracted target brand name, confidence score, and supporting evidence. The confidence score is a quantitative assessment of the accuracy of the identified target brand, ranging from 0 to 1; the closer the value is to 1, the higher the confidence level. Supporting evidence is the basis for identifying the target brand, including specific brand identifiers in the HTML, and the association characteristics between the domain name and the target brand. The expression of the large language model is:

[0135]

[0136] in, The detected target brand name, For the target brand domain name, Score for confidence. To support the evidence.

[0137] It should also be noted that if the target brand cannot be identified during the analysis process, the large language model will directly output "No relevant brand found," and thus step S503 will be executed. If the target brand can be identified during the analysis process, the large language model will directly output the recognition result, and thus step S502 will be executed.

[0138] In addition, to ensure the reliability of the recognition results, a preset threshold is set. When the output confidence score is less than the preset threshold, it indicates that the large language model has a low grasp of the current recognition results, and it will also enter the image recognition module, that is, execute step S503.

[0139] S502. When the identification result contains the target brand and its corresponding identification data, determine that the target brand exists among the various brands.

[0140] S503. When the recognition result is that the target brand is not found, the logo image and each brand and its corresponding brand information are input into the large language model for recognition to obtain the target recognition result.

[0141] Specifically, if text-based brand recognition fails to identify the target brand (i.e., the result is "no target brand found"), or if the output confidence score is below a preset threshold, the image brand recognition module will be activated. This module uses a multimodal large language model to analyze the webpage screenshot. Specifically, the logo image and the various brands and their corresponding brand information are input into the large language model for recognition. The resulting target brand recognition result also includes the target brand name, confidence score, and supporting evidence. The supporting evidence includes the specific features, colors, and layout of the brand logo in the webpage screenshot. The expression of the large language model at this time is:

[0142]

[0143] in, The detected target brand name, For the target brand domain name, Score for confidence. To support the evidence.

[0144] Furthermore, if neither the text nor the image information can identify the target brand, it is considered that the webpage to be detected does not imitate a well-known brand and is therefore determined not to be a fraudulent webpage, which means step S505 is executed.

[0145] If the target brand can be identified through the image information, then proceed to step S504.

[0146] S504. When the target identification result is a result containing the target brand and its corresponding identification data, it is determined that the target brand exists among the various brands.

[0147] S505. When the identification result is that the target brand is not found, determine that the target brand does not exist among the various brands.

[0148] Understandably, when the identification result is that no result for the target brand is found, it means that the webpage to be detected is a legitimate webpage.

[0149] S205. Based on the target brand's domain name list, determine whether the webpage to be detected is a suspected fraudulent webpage.

[0150] It should be noted that after identifying the target brand through the multimodal brand module, it is necessary to further check whether the domain name of the webpage to be tested is consistent with the legitimate domain name of the detected target brand. This is to determine whether the webpage to be tested is a fraudulent website. That is, based on the domain name list of the target brand, it is determined whether the webpage to be tested is a suspected fraudulent webpage. If the webpage to be tested is determined to be a suspected fraudulent webpage, it means that it cannot be accurately determined that the webpage to be tested is a fraudulent webpage at this time. The final judgment process needs to be executed to avoid misjudgment. Therefore, step S206 is executed.

[0151] Optionally, if the webpage to be tested is not a suspected fraudulent webpage, it means that the webpage to be tested is a legitimate webpage.

[0152] Optionally, in another embodiment of this application, one specific implementation of step S205 is as follows: Figure 6 As shown, the specific steps include:

[0153] S601. Determine whether the domain name corresponding to the webpage to be detected matches the target domain name in the list of legitimate domain names of the target brand.

[0154] Specifically, a string matching algorithm is used to determine whether the domain name corresponding to the webpage to be detected completely matches a domain name in the list of legitimate domain names of the target brand in the offline knowledge base. If the domain name is suspected of being fraudulent, further fuzzy matching analysis of the domain name should be performed, thus step S602 is executed. Optionally, if the match is successful, the domain name is preliminarily considered legitimate.

[0155] S602. For each target domain in the list of legitimate domains, calculate the distance between the domain corresponding to the webpage to be detected and the target domain using a distance algorithm.

[0156] It should be noted that when the domain name of the webpage to be detected does not match the target domain name in the legitimate domain name list of the target brand, the Levenshtein distance algorithm needs to be used to calculate the distance between the webpage domain name and each domain name in the legitimate domain name list, and then a similarity score needs to be calculated. This similarity score is then used to determine whether the webpage to be detected is a fraudulent website imitating a well-known brand. Therefore, it is necessary to first use the distance algorithm to calculate the distance between the domain name of the webpage to be detected and the target domain name. The specific calculation formula is as follows: .

[0157] in, For the target domain, The domain name of the website to be tested.

[0158] S603. Calculate the similarity between the webpage to be detected and the target domain based on the domain name corresponding to the webpage to be detected, the target domain name, and the distance.

[0159] Specifically, the formula for calculating the similarity between the webpage to be detected and the target domain is:

[0160]

[0161] in, and The target domain names of the target brands are respectively and the domain name of the website to be tested The absolute value of the length, This represents the Levenshtein distance between two domain name strings.

[0162] S604. Extract the maximum similarity from all similarities and determine whether the maximum similarity is greater than a preset threshold.

[0163] It is important to note that a brand domain name may include multiple subdomains or domain name variations, so it is necessary to extract the maximum similarity from all similarities.

[0164] Specifically, in order to determine whether the website to be detected is a fraudulent website that imitates a well-known brand, a threshold can be set, that is, whether the maximum similarity is greater than the preset threshold. If the maximum similarity is greater than the preset threshold, it means that the website to be detected is still a suspected fraudulent website, and it needs to be marked as a suspected match. A comprehensive score is calculated for the final judgment, so step S605 is executed.

[0165] S605. The webpage to be detected is determined to be a suspected fraudulent webpage.

[0166] Specifically, when the maximum similarity is greater than the preset threshold, it indicates that the webpage to be detected may be a suspected fraudulent webpage, so further judgment is needed, and therefore step S206 is executed.

[0167] S606. The webpage to be detected has been determined to be a fraudulent webpage.

[0168] Specifically, when the maximum similarity is no greater than a preset threshold, the website to be detected can be considered a fraudulent website that imitates a well-known brand.

[0169] S206. Calculate the overall score based on the domain name information.

[0170] It should be noted that, in order to prevent misidentification of legitimate websites and to avoid overlooking fraudulent websites with similar domain names, a comprehensive score needs to be calculated based on the domain name information when the webpage to be detected is suspected of being fraudulent.

[0171] Optionally, in another embodiment of this application, one specific implementation of step S206 is as follows: Figure 7 As shown, the specific steps include:

[0172] S701. Query the resource data corresponding to the domain name information from the online resource library.

[0173] The resource data includes at least the number of search results, ranking position, content relevance, and official statement data.

[0174] Specifically, to reduce the risk of misidentifying legitimate websites and ensure that fraudulent websites with similar domain names are not missed, a comprehensive score is calculated by combining the confidence score of the multimodal brand identifier for webpage brand recognition and the similarity score of the webpage domain name. This score is used to identify fraudulent websites with similarly spelled domain names. Therefore, it is necessary to use search engines to query online resources for information related to the domain name of the webpage to be detected. The number of search results needs to be considered separately. Ranking position Content relevance And whether there is an official statement Four variables are used, and the corresponding scores are calculated for each variable to obtain the score. , , , In addition, tools such as Moz's Domain Authority can be used to calculate a website's authority score. Also consider domain similarity score .

[0175] S702. Calculate the scores for the number of search results, ranking position, content relevance, and official statement data, and calculate the authority score and maximum similarity score of the webpage to be detected.

[0176] Specifically, the formula for calculating the score based on the number of search results is:

[0177]

[0178] in, This represents the current number of search results. This represents the maximum number of search results during the test.

[0179] The formula for calculating the score for ranking position is:

[0180]

[0181] in, This represents the number of search results pages. This refers to the ranking of the target domain in search results.

[0182] The formula for calculating the score of the official statement data is:

[0183]

[0184] If an official statement appears in the search results, you get 100 points; otherwise, you get 0 points.

[0185] The formula for calculating the content relevance score is: or .in, , The confidence score is calculated for the large language model in the multimodal brand recognizer.

[0186] The formula for calculating the authority score of the webpage to be tested is: , This represents the domain authority of Moz.

[0187] The formula for calculating the maximum similarity score is: , A score is given for domain name similarity.

[0188] S703. Based on preset weights, the scores for the number of search results, ranking position, content relevance, official statement data, authority, and maximum similarity are weighted and summed to obtain a comprehensive score.

[0189] Specifically, the scores for the number of search results, ranking position, content relevance, official statement data, authority, and maximum similarity are weighted according to preset criteria. We perform a weighted summation to obtain the overall score. :

[0190]

[0191] Among them, the preset weights satisfy .

[0192] S207. When the overall score is less than the preset threshold, the webpage to be detected is determined to be a fraudulent webpage.

[0193] It's important to note that the overall score comprehensively estimates the website's popularity and brand relevance. If the domain information of the webpage being tested is retrieved by major search engines and receives a high score, it indicates that the webpage is likely a legitimate website. Legitimate websites typically have a long lifespan, high-quality content, and meet search engine algorithm requirements, making them easier to index and gain higher ranking. In contrast, most fraudulent websites have a short lifespan, usually only active for a short period to commit fraud or spread malicious content. Because these websites have a short lifespan, low-quality content, and are likely to be reported by users or security agencies, they are usually not indexed by search engines.

[0194] Specifically, based on the overall assessment above, when the domain information appears to match a legitimate domain and the overall score is greater than a preset threshold, the website being tested is considered a legitimate website. When the domain appears to match a legitimate domain but the overall score is less than the threshold, or when the domain does not have a fuzzy match with a legitimate domain, the webpage being tested is deemed to pose a fraud risk.

[0195]

[0196] in, The preset threshold for similarity, This is the preset threshold for the overall score.

[0197] This application provides a method for detecting fraudulent websites. The method involves acquiring multimodal features of the webpage to be detected, including at least images, webpage documents, and URL information. These features are then preprocessed to obtain a logo image corresponding to the image, text corresponding to the webpage document, and domain name information corresponding to the URL. Next, based on the logo image and text, a multimodal retrieval tool is used to retrieve multiple brands similar to the webpage to be detected and their corresponding brand information from a brand knowledge base. Specifically, the multimodal retrieval tool first extracts brand data from an open-source database and an authoritative brand list using optical character recognition technology, and then constructs the extracted data by adding modification tasks. Based on the text, domain name information, and the information of each brand and its corresponding brand, the method determines whether the target brand exists among the brands. If the target brand exists, the method determines whether the webpage to be detected is a suspected fraudulent webpage based on the domain name list of the target brand. If the webpage to be detected is a suspected fraudulent webpage, a comprehensive score is calculated based on the domain name information. Finally, if the comprehensive score is less than a preset threshold, the webpage to be detected is determined to be a fraudulent webpage. By extracting key information from webpage screenshots, HTML documents, and URLs, and combining this with steps such as brand recognition, domain name matching verification, and comprehensive scoring, the system can efficiently and accurately detect fraudulent websites, thereby avoiding misjudgments.

[0198] Another embodiment of this application provides a system for detecting fraudulent websites, such as... Figure 8 As shown, the detection system includes: a preprocessing module 801, a multimodal brand recognition module 802, a domain name matching and verification module 803, and a comprehensive evaluation module 804.

[0199] The preprocessing module 801 is used to acquire the multimodal features of the webpage to be detected, and to preprocess the images, webpage documents, and URL information respectively to obtain the corresponding tag images, text corresponding to the webpage documents, and domain information corresponding to the URL information. The multimodal features include at least images, webpage documents, and URL information.

[0200] The multimodal brand recognition module 802 is used to retrieve multiple brands and their corresponding brand information that are similar to the webpage to be detected from the brand knowledge base based on the logo image and text using a multimodal retrieval device. The multimodal retrieval device is pre-constructed by extracting brand data from open-source databases and authoritative brand lists using optical character recognition technology, and then adding modification tasks to the extracted data.

[0201] The domain name matching and verification module 803 is used to determine whether the target brand exists among the various brands based on the text, domain name information, and each brand and its corresponding brand information. If the target brand exists among the various brands, it is used to determine whether the webpage to be detected is a suspected fraudulent webpage based on the domain name list of the target brand.

[0202] The comprehensive evaluation module 804 is used to calculate a comprehensive score based on the domain name information if the webpage to be detected is a suspected fraudulent webpage, and to determine that the webpage to be detected is a fraudulent webpage when the comprehensive score is less than a preset threshold.

[0203] It should be noted that the specific working process of the above modules in the embodiments of this application can be referred to steps S201 to S207 in the above method embodiments, and will not be repeated here.

[0204] Optionally, in another embodiment of this application, a fraudulent website detection system includes a preprocessing module that preprocesses images, web page documents, and URL information to obtain a marker image corresponding to the image, text corresponding to the web page document, and domain name information corresponding to the URL information. Specifically, this module is used for:

[0205] The images are input into the object detection model to obtain multiple candidate label images and their corresponding confidence scores.

[0206] Extract the confidence score with the highest value from all confidence scores, and use the candidate label image corresponding to the confidence score with the highest value as the label image corresponding to the image.

[0207] Using regular expressions and tag filtering rules, target text that meets preset requirements is filtered out from web page documents, and the target text is then organized and cleaned to obtain the text corresponding to the web page documents.

[0208] The URL information is parsed to obtain the domain name information corresponding to the URL.

[0209] Optionally, in another embodiment of this application, a fraudulent website detection system includes a multimodal brand recognition module that retrieves multiple brands similar to the webpage to be detected and their corresponding brand information from a brand knowledge base based on logo images and text using a multimodal retrieval tool. Specifically, this module is used for:

[0210] The text is encoded using a text encoder to obtain encoded text, and the logo image is encoded using an image encoder to obtain encoded image.

[0211] The encoded text and encoded image are weighted and summed to obtain a weighted vector. The weighted vector is then normalized to obtain the combined webpage encoding.

[0212] The brand name and brand logo in the brand knowledge base are encoded using an image encoder to obtain coded brand name and coded brand logo, and the brand combination code is calculated based on the coded brand name and coded brand logo.

[0213] Calculate the cosine similarity between the combined webpage encoding and the combined brand encoding, and use a multimodal retrieval tool to retrieve the brands with the highest cosine similarity and their corresponding brand information from the brand knowledge base.

[0214] Optionally, in another embodiment of this application, a fraudulent website detection system includes a domain name matching and verification module that determines whether the target brand exists among the various brands based on the text, domain name information, and each brand and its corresponding brand information. Specifically, this module is used for:

[0215] The text, domain name information, and various brands and their corresponding brand information are input into a large language model for recognition, and the recognition results are obtained.

[0216] When the identification result contains the target brand and its corresponding identification data, it is determined that the target brand exists among the various brands.

[0217] When the recognition result is that no target brand is found, the logo image and each brand and its corresponding brand information are input into the large language model for recognition to obtain the target recognition result.

[0218] When the target identification result contains the target brand and its corresponding identification data, it is determined that the target brand exists among the various brands.

[0219] When the identification result is that the target brand is not found, it is determined that the target brand does not exist among the various brands.

[0220] Optionally, in another embodiment of this application, a fraudulent website detection system includes a domain name matching and verification module that determines whether a webpage to be detected is a suspected fraudulent webpage based on a list of domain names belonging to the target brand. Specifically, this module is used for:

[0221] Determine whether the domain name corresponding to the webpage to be detected matches the target domain name in the list of legitimate domain names of the target brand.

[0222] If the domain name corresponding to the webpage to be detected does not match the target domain name in the list of legitimate domain names of the target brand, then for each target domain name in the list of legitimate domain names, the distance between the domain name corresponding to the webpage to be detected and the target domain name is calculated using a distance algorithm.

[0223] The similarity between the webpage to be detected and the target domain is calculated based on the domain name corresponding to the webpage to be detected, the target domain name, and the distance.

[0224] Extract the maximum similarity from all similarities and determine whether the maximum similarity is greater than a preset threshold.

[0225] If the maximum similarity is greater than the preset threshold, the webpage to be detected is determined to be a suspected fraudulent webpage.

[0226] If the maximum similarity is not greater than the preset threshold, the webpage to be detected is determined to be a fraudulent webpage.

[0227] Optionally, in another embodiment of this application, a fraudulent website detection system includes a comprehensive evaluation module that calculates a comprehensive score based on domain name information, specifically used for:

[0228] Retrieve resource data corresponding to the domain name information from the online resource library; the resource data includes at least the number of search results, ranking position, content relevance, and official statement data;

[0229] Calculate scores for the number of search results, ranking position, content relevance, and official statement data, and calculate the authority score and maximum similarity score of the webpage to be tested.

[0230] Based on preset weights, the scores for the number of search results, ranking position, content relevance, official statement data, authority, and maximum similarity are weighted and summed to obtain a comprehensive score.

[0231] It should be noted that the specific working process of each module provided in the above embodiments of this application can be referred to the corresponding steps in the above method embodiments, and will not be repeated here.

[0232] It should also be noted that the fraudulent website detection system provided in this application has the technical effects of any of the above embodiments, and will not be described in detail here.

[0233] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0234] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting fraudulent websites, characterized in that, include: Obtain the multimodal features of the webpage to be detected; wherein, the multimodal features include at least images, webpage documents, and URL information; The image, the webpage document, and the URL information are preprocessed respectively to obtain the logo image corresponding to the image, the text corresponding to the webpage document, and the domain name information corresponding to the URL information; Based on the logo image and the text, a multimodal retrieval tool is used to retrieve multiple brands similar to the webpage to be detected and their corresponding brand information from the brand knowledge base; wherein, the multimodal retrieval tool is pre-extracted from brand data in open source databases and authoritative brand lists using optical character recognition technology, and the extracted data is constructed by adding change tasks; Based on the text, the domain name information, and each of the brands and their corresponding brand information, determine whether the target brand exists among the brands; If the target brand exists among the various brands, then based on the domain name list of the target brand, it is determined whether the webpage to be detected is a suspected fraudulent webpage; If the webpage to be detected is a suspected fraudulent webpage, then a comprehensive score is calculated based on the domain name information; When the overall score is less than a preset threshold, the webpage to be detected is determined to be a fraudulent webpage. The step of preprocessing the image, the webpage document, and the URL information to obtain the logo image corresponding to the image, the text corresponding to the webpage document, and the domain name information corresponding to the URL information includes: The image is input into the target detection model to obtain multiple candidate label images and their corresponding confidence scores; Extract the confidence score with the highest value from all confidence scores, and use the candidate label image corresponding to the confidence score with the highest value as the label image corresponding to the image; Using regular expressions and tag filtering rules, target text that meets preset requirements is filtered out from the web page document, and the target text is organized and cleaned to obtain the text corresponding to the web page document; The URL information is parsed to obtain the domain name information corresponding to the URL information; The step of retrieving multiple brands and their corresponding brand information similar to the webpage to be detected from the brand knowledge base using a multimodal retrieval tool based on the logo image and the text includes: The text is encoded using a text encoder to obtain encoded text, and the logo image is encoded using an image encoder to obtain an encoded image; The encoded text and the encoded image are weighted and summed to obtain a weighted vector, and the weighted vector is normalized to obtain the combined webpage encoding; The image encoder is used to encode the brand name and brand logo in the brand knowledge base to obtain the coded brand name and coded brand logo, and the brand combination code is calculated based on the coded brand name and the coded brand logo. Calculate the cosine similarity between the combined webpage encoding and the combined brand encoding, and use a multimodal retrieval tool to retrieve from the brand knowledge base the multiple brands that match the highest cosine similarity and their corresponding brand information.

2. The method according to claim 1, characterized in that, The step of determining whether a target brand exists among the various brands based on the text, the domain name information, and each brand and its corresponding brand information includes: The text, the domain name information, and each of the brands and their corresponding brand information are input into a large language model for recognition, and the recognition result is obtained. When the identification result contains the target brand and its corresponding identification data, it is determined that the target brand exists among the various brands. When the recognition result is that no target brand is found, the logo image and each of the brands and their corresponding brand information are input into the large language model for recognition to obtain the target recognition result. When the target identification result is a result containing the target brand and its corresponding identification data, it is determined that the target brand exists among the various brands. When the identification result is that no target brand is found, it is determined that the target brand does not exist among the various brands.

3. The method according to claim 1, characterized in that, The step of determining whether the webpage to be detected is a suspected fraudulent webpage based on the domain name list of the target brand includes: Determine whether the domain name corresponding to the webpage to be detected matches the target domain name in the list of legitimate domain names of the target brand; If the domain name corresponding to the webpage to be detected does not match the target domain name in the list of legitimate domain names of the target brand, then for each target domain name in the list of legitimate domain names, the distance between the domain name corresponding to the webpage to be detected and the target domain name is calculated using a distance algorithm. Based on the domain name corresponding to the webpage to be detected, the target domain name, and the distance, the similarity between the webpage to be detected and the target domain name is calculated; Extract the maximum similarity from all similarities and determine whether the maximum similarity is greater than a preset threshold; If the maximum similarity is greater than the preset threshold, then the webpage to be detected is determined to be a suspected fraudulent webpage; If the maximum similarity is not greater than the preset threshold, then the webpage to be detected is determined to be a fraudulent webpage.

4. The method according to claim 3, characterized in that, The step of calculating the comprehensive score based on the domain name information includes: Retrieve resource data corresponding to the domain name information from the online resource library; wherein, the resource data includes at least the number of search results, ranking position, content relevance, and official statement data; Calculate the scores for the number of search results, the ranking position, the content relevance, and the official statement data, respectively; and calculate the authority score and the maximum similarity score for the webpage to be detected. Based on preset weights, the scores for the number of search results, the ranking position, the content relevance, the official statement data, the authority score, and the maximum similarity score are weighted and summed to obtain a comprehensive score.

5. A system for detecting fraudulent websites, characterized in that, The detection system includes: a preprocessing module, a multimodal brand recognition module, a domain name matching and verification module, and a comprehensive evaluation module; The preprocessing module is used to acquire the multimodal features of the webpage to be detected, and to preprocess the image, webpage document, and URL information respectively to obtain the marker image corresponding to the image, the text corresponding to the webpage document, and the domain name information corresponding to the URL information; wherein, the multimodal features include at least the image, the webpage document, and the URL information; The multimodal brand recognition module is used to retrieve multiple brands and their corresponding brand information that are similar to the webpage to be detected from the brand knowledge base based on the logo image and the text using a multimodal retrieval device; wherein, the multimodal retrieval device is pre-extracted from brand data in an open-source database and an authoritative brand list using optical character recognition technology, and the extracted data is constructed by adding a change task; The domain name matching and verification module is used to determine whether a target brand exists among the various brands based on the text, the domain name information, and each brand and its corresponding brand information, and if the target brand exists among the various brands, to determine whether the webpage to be detected is a suspected fraudulent webpage based on the domain name list of the target brand. The comprehensive evaluation module is used to calculate a comprehensive score based on the domain name information if the webpage to be detected is a suspected fraudulent webpage, and to determine that the webpage to be detected is a fraudulent webpage when the comprehensive score is less than a preset threshold. The preprocessing module performs preprocessing on the image, the webpage document, and the URL information respectively to obtain the logo image corresponding to the image, the text corresponding to the webpage document, and the domain name information corresponding to the URL information, specifically for: The image is input into the target detection model to obtain multiple candidate label images and their corresponding confidence scores; Extract the confidence score with the highest value from all confidence scores, and use the candidate label image corresponding to the confidence score with the highest value as the label image corresponding to the image; Using regular expressions and tag filtering rules, target text that meets preset requirements is filtered out from the web page document, and the target text is organized and cleaned to obtain the text corresponding to the web page document; The URL information is parsed to obtain the domain name information corresponding to the URL information; The multimodal brand recognition module performs the following: based on the logo image and the text, it uses a multimodal retrieval device to retrieve multiple brands similar to the webpage to be detected and their corresponding brand information from the brand knowledge base. Specifically, it is used for: The text is encoded using a text encoder to obtain encoded text, and the logo image is encoded using an image encoder to obtain an encoded image; The encoded text and the encoded image are weighted and summed to obtain a weighted vector, and the weighted vector is normalized to obtain the combined webpage encoding; The image encoder is used to encode the brand name and brand logo in the brand knowledge base to obtain the coded brand name and coded brand logo, and the brand combination code is calculated based on the coded brand name and the coded brand logo. Calculate the cosine similarity between the combined webpage encoding and the combined brand encoding, and use a multimodal retrieval tool to retrieve from the brand knowledge base the multiple brands that match the highest cosine similarity and their corresponding brand information.

6. The system according to claim 5, characterized in that, The domain name matching and verification module performs a function based on the text, the domain name information, and each brand and its corresponding brand information to determine whether the target brand exists among the various brands. Specifically, it is used for: The text, the domain name information, and each of the brands and their corresponding brand information are input into a large language model for recognition, and the recognition result is obtained. When the identification result contains the target brand and its corresponding identification data, it is determined that the target brand exists among the various brands. When the recognition result is that no target brand is found, the logo image and each of the brands and their corresponding brand information are input into the large language model for recognition to obtain the target recognition result. When the target identification result is a result containing the target brand and its corresponding identification data, it is determined that the target brand exists among the various brands. When the identification result is that no target brand is found, it is determined that the target brand does not exist among the various brands.

Images