Nuclear power plant intelligent phishing website identification and early warning system integrated on browser

By integrating a phishing website identification and early warning system based on deep learning algorithms into the browser of nuclear power plants, the problem of difficulty in identifying phishing websites in nuclear power plants has been solved. Efficient and accurate phishing website identification and early warning have been achieved, which has improved network security protection capabilities and emergency response efficiency, and complies with national information security standards.

CN120768577APending Publication Date: 2025-10-10CNNC NUCLEAR POWER OPERATION MANAGEMENT CO LTD
View PDF 7 Cites 0 Cited by

Patent Information

Application Number
CN202510842528.1
Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Filing Date
2025-06-23
Publication Date
2025-10-10

AI Technical Summary

Technical Problem

The existing network security defense system has difficulty in effectively identifying and promptly warning of phishing websites in nuclear power plants, resulting in frequent security incidents. Especially when users frequently visit professional websites, traditional protection measures are unable to accurately identify phishing threats.

Method used

An intelligent phishing website identification and early warning system integrated into the browser of a nuclear power plant is designed. It uses a deep learning algorithm to monitor the web pages visited by users in real time, transmits data to the server for analysis through a client plug-in, combines the deep learning model to identify the characteristics of phishing websites, and provides instant warnings and safety operation suggestions in the browser.

Benefits of technology

It has achieved high-precision identification and timely warning of phishing websites, reduced false alarms and missed alarms, improved the network security protection capabilities of nuclear power plants, reduced sensitive information leakage and operational risks, improved emergency response efficiency, reduced reliance on manual intervention, and complies with national information security standards.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN120768577A_ABST
    Figure CN120768577A_ABST
Patent Text Reader

Abstract

The invention belongs to the technical field of nuclear power plant network security protection, and particularly relates to a browser-integrated intelligent phishing website identification and early warning system for a nuclear power plant. The client plug-in is used for monitoring a webpage accessed by a user in real time and transmitting data back to a server for analysis; the server is used for processing data acquired by the client plug-in, running a deep learning model and storing a phishing website feature library; the intelligent recognition engine is used for recognizing features of phishing websites based on deep learning model training; and the early warning and response module is used for setting an early warning threshold value according to the probability value output by the deep learning model, and triggering early warning if the probability value is higher than the threshold value, namely identifying a phishing website, immediately displaying warning information to a user through a client plug-in, and providing safe operation suggestions. According to the method, through the automatic detection and warning technology of phishing websites in a browser environment, in combination with deep learning and an artificial intelligence algorithm, increasingly severe phishing threats in a nuclear power plant are dealt with, and the safety of an information system of the nuclear power plant is ensured.
Need to check novelty before this filing date? Find Prior Art

Description

Technical Field

[0001] The present invention belongs to the technical field of network security protection for nuclear power plants, and in particular relates to an intelligent phishing website identification and early warning system integrated into a browser of a nuclear power plant. Background Art

[0002] With the acceleration of digital transformation, nuclear power plants have entered a new era of intelligent management. As critical infrastructure, the importance of cybersecurity in nuclear power plants is self-evident. Nuclear facility information systems and industrial control systems face multiple cyber threats, including phishing. Recent cybersecurity oversight experience has revealed that nuclear power plant employees have been successfully attacked due to the highly disguised nature of phishing websites. These threats could not only lead to the leakage of sensitive data but also affect the safe operation of nuclear facilities and even endanger public safety. Phishing, a form of social engineering attack, disguises legitimate websites or sends fraudulent emails to trick employees into disclosing login credentials or performing malicious operations, posing a significant challenge to nuclear power plant cybersecurity.

[0003] While traditional network security defenses, such as firewalls, intrusion detection systems, and antivirus software, can protect against known threats to a certain extent, they are limited in their effectiveness against phishing attacks, a new type of threat that relies on user behavior and psychological manipulation. This is especially true in nuclear power plant environments, where workers frequently access various specialized websites and internal systems. Traditional defenses struggle to accurately identify and promptly warn of phishing websites, making them prone to security incidents.

[0004] Given this, integrating advanced artificial intelligence technologies, particularly deep learning algorithms, into nuclear power plant cybersecurity systems is crucial. Deep learning models can automatically extract characteristics of phishing websites by learning patterns from massive amounts of data, including but not limited to URL structure, webpage content, domain name characteristics, and dynamic changes in phishing behavior. This allows for immediate identification of potential phishing threats before or during user visits. Considering the unique business scenarios and security requirements of nuclear power plants, developing a system that not only meets the cybersecurity needs of nuclear power plants but also integrates into everyday browser environments, enabling intelligent and efficient identification of phishing websites and immediate warnings, has become a key technological breakthrough in safeguarding nuclear energy industry cybersecurity.

[0005] In summary, the design and implementation of an intelligent phishing website identification and early warning system integrated into the browser of a nuclear power plant aims to utilize cutting-edge AI technology to enhance the active defense capability of the nuclear power plant's cyberspace and ensure the safe and stable operation of the nuclear power plant's information system. This has important practical significance for maintaining the security of the country's critical information infrastructure. Summary of the Invention

[0006] The purpose of the present invention is to provide a highly intelligent and targeted intelligent phishing website identification and early warning system integrated into the browser of a nuclear power plant. Through the automatic detection of phishing websites and user warning technology in the browser environment, combined with deep learning and artificial intelligence algorithms, it can cope with the increasingly severe phishing threats in nuclear power plants, ensure the security and stability of nuclear power plant information systems, provide users with a safer and more efficient web browsing experience, and effectively improve their network security protection capabilities.

[0007] In order to achieve the above object, the technical solution adopted by the present invention is: An intelligent phishing website identification and early warning system integrated into the browser of a nuclear power plant includes: a client plug-in: monitors the web pages visited by users in real time and transmits the data back to the server for analysis; a server: processes the data collected by the client plug-in, runs a deep learning model, and stores a phishing website feature library; an intelligent recognition engine: trains based on the deep learning model to identify the characteristics of phishing websites; an early warning and response module: sets an early warning threshold based on the probability value output by the deep learning model. If the value is above the threshold, an early warning is triggered, that is, the phishing website is identified, and a warning message is immediately displayed to the user through the client plug-in, providing safety operation suggestions.

[0008] Training data collection and preprocessing for deep learning models: Phishing website samples are collected from public phishing website databases and honeypot systems. At the same time, they are integrated with the nuclear power plant network security system to collect unique phishing cases to form a targeted training data set; the collected data is labeled to distinguish between normal websites and phishing websites; the data is cleaned to remove irrelevant information, the format is unified, and the text data is segmented and vectorized.

[0009] Deep learning model construction and training: Use deep learning models to automatically extract website URL structural features, web page content semantic features, and page layout features. Select convolutional neural network, recurrent neural network, or Transformer deep learning models based on the feature characteristics. Optimize deep learning model performance through cross-validation and hyperparameter tuning. Use random forest and gradient boosting ensemble learning methods to fuse multiple models.

[0010] Characteristics of phishing websites include URL structure, page layout, domain name similarity, and malicious scripts.

[0011] Warning information is notified to users in the form of pop-up windows and sounds through client plug-ins, and provides one-click exit and safe browsing recommended operation options; safe operation suggestions include leaving the page immediately and reporting suspicious websites.

[0012] The client plug-in is a lightweight browser plug-in that supports Chrome, Firefox, and Edge browsers.

[0013] Collect user-marked false alarms or missed reports, retrain the deep learning model, and continuously optimize recognition accuracy; use the SM4 encryption algorithm for data transmission encryption.

[0014] An intelligent phishing website identification and early warning method integrated into a browser of a nuclear power plant: Step 1: Data collection and preliminary analysis: System initialization: Design a custom startup script to ensure that the client plug-in is automatically activated when the user opens the browser; User browsing requests: JavaScript event listeners are embedded in the client plug-in to capture user clicks on links and page jumps in real time, obtain URLs and web page content in a timely manner, and transmit key parts of URL metadata and web page DOM trees to the server; Data preprocessing: Use regular expressions or URL parsing libraries to extract domain name and path information, perform denormalization, and use natural language processing (NLP) technology to extract key features of web page text. Simultaneously, simplify the HTML structure and extract layout features. Intelligent identification: The extracted features are converted into vector form that can be processed by the deep learning model. The deep learning model deployed on the server is used to classify and predict the feature vectors to determine whether it is a phishing website. Step 2: Risk Assessment and Response: Comparison of scores and thresholds: Based on the predicted probability of the deep learning model and the feature weights, a comprehensive risk score is calculated and a reasonable threshold is set. Risks above the threshold are considered high risk. Normal access / phishing warning: If the score is below the threshold, the user is allowed to browse normally and the access log is recorded; if the score is above the threshold, a warning message is displayed to the user through the client plug-in, providing safe operation guidance; Step 3: Feedback loop and system optimization: User feedback processing: Allow users to report false positives or missed positives, collect user satisfaction ratings on warning behaviors, and organize and annotate user feedback data as new data for deep learning model training; Model self-update: Use online learning or incremental learning strategies to adjust deep learning model parameters regularly or dynamically based on new data. Introduce A / B testing mechanisms to compare the performance of new and old models to ensure that the new model's performance improves before full deployment. System monitoring and logging: Record system operating status, warning events, and user feedback logs, monitor system performance through anomaly detection algorithms, and automatically issue alarms to handle system anomalies; System standby: Frees up resources when there is no user activity, keeping the system lightweight.

[0015] Deep learning models include CNN or LSTM based models.

[0016] The TLS / SSL protocol is configured during data transmission, and a secure encryption channel is established based on the SM4 encryption algorithm.

[0017] The beneficial effects achieved by the present invention are: This invention builds a solid network security defense for nuclear power plants, effectively preventing and mitigating the risks posed by phishing attacks, protecting the safe operation of nuclear power plants, and safeguarding national energy security and social stability. It not only addresses the limitations of existing technologies in the nuclear energy industry but also sets a new benchmark for network security protection. Specific advantages include: (1) Highly targeted and specialized: This invention is designed specifically for the nuclear energy industry, taking into full account the special security needs and business environment of nuclear power plants, including in-depth analysis and understanding of nuclear power plant business-related websites, and adaptation to the industry's internal network environment. It can more accurately identify and defend against phishing attacks targeting the nuclear energy field than general solutions.

[0018] (2) Intelligent recognition driven by deep learning: Utilizing advanced deep learning algorithms, it can automatically learn and adapt to the complex changes of phishing websites, effectively identify emerging phishing techniques, improve recognition accuracy and response speed, and reduce false positives and missed reports.

[0019] (3) Combination of real-time warning and user education: Through the real-time warning mechanism integrated into the browser, users can be quickly reminded before they encounter risks. At the same time, users are educated to enhance their safety awareness, forming a double layer of protection.

[0020] (4) Continuous self-optimization and updating: The system has the ability to self-learn and update, and can continuously optimize the model based on new data and user feedback, maintaining the effectiveness of defense against the latest threats and reducing dependence on human intervention.

[0021] (5) Integration of domestic commercial cryptographic technology: Domestic commercial cryptographic technology is used to strengthen data encryption and transmission security, ensuring the confidentiality and integrity of information, and complying with the country's requirements for independent and controllable information security.

[0022] (6) Industry compliance and standardization: Strictly adhering to nuclear energy industry safety regulations and national information security standards in the design will help improve the safety management level and compliance of the entire industry.

[0023] (7) Enhanced network security protection: The defense capability of nuclear power plants against phishing attacks has been significantly enhanced, the risks of sensitive information leakage and operational safety have been reduced, and the stable operation of nuclear facilities has been protected.

[0024] (8) Improve emergency response efficiency: Through real-time monitoring and early warning, the time from threat discovery to action is shortened, and the efficiency of responding to network incidents is improved.

[0025] (9) Optimize resource allocation: Automated and intelligent systems reduce the demand for human resources, allowing security teams to focus on higher-level security policy formulation and threat analysis.

[0026] (10) Promote the improvement of industry safety standards: As an industry-specific solution, the promotion and application of this invention is expected to drive the overall improvement of network security standards in the nuclear energy industry and form a good demonstration effect.

[0027] (11) Enhance public and employee confidence: The system has improved the transparency and credibility of the nuclear energy industry, enhanced the public and employees’ confidence in nuclear energy safety, and is conducive to the sustainable development of the industry. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 This is a data collection and preliminary analysis flow chart for an intelligent phishing website identification and early warning system integrated into a browser for a nuclear power plant; Figure 2 A risk assessment and response flow chart for an intelligent phishing website identification and early warning system integrated into a browser for a nuclear power plant; Figure 3 This is a feedback loop and system optimization flow chart of an intelligent phishing website identification and early warning system integrated into a browser of a nuclear power plant. DETAILED DESCRIPTION

[0029] The present invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0030] An intelligent phishing website identification and early warning system integrated into the browser of a nuclear power plant includes: a client plug-in: a lightweight browser plug-in that supports mainstream browsers such as Chrome, Firefox, Edge, etc., responsible for real-time monitoring of web pages visited by users and transmitting the data back to the server for analysis; a server: processing data collected by the client plug-in, running deep learning models, and storing a phishing website feature library; an intelligent recognition engine: based on deep learning models such as convolutional neural networks, recurrent neural networks or Transformer, trained to identify the characteristics of phishing websites, including URL structure, page layout, domain name similarity, malicious scripts, etc.; an early warning and response module: upon identifying phishing websites, a striking warning message is immediately displayed to the user through the client plug-in, and safe operation suggestions are provided, such as leaving the page immediately and reporting suspicious websites.

[0031] Data collection and preprocessing for deep learning model training: Phishing website samples are collected from public phishing website databases and honeypot systems. This data is integrated with nuclear power plant network security systems, such as the situational awareness system, to capture unique phishing cases, creating a rich and targeted training dataset. The collected data is meticulously labeled to distinguish legitimate from phishing websites, preparing high-quality labeled data for model training. Data is cleaned to remove irrelevant information, standardized in format, and text data is processed through word segmentation and vectorization to prepare for model input.

[0032] Deep learning model construction and training: Utilize deep learning models to automatically extract website features, including URL structure, semantic features of webpage content, and page layout. Based on these features, we select an appropriate deep learning model architecture and optimize model performance through cross-validation and hyperparameter tuning to ensure high accuracy and low false positive rates. We also employ ensemble learning methods, such as random forests and gradient boosting, to fuse multiple models to improve recognition robustness and accuracy.

[0033] Real-time monitoring and early warning mechanism: The client plug-in captures web page information in real time as users browse and transmits it to the server for immediate analysis. Warning thresholds are set based on the probability values ​​output by the deep learning model; if the value exceeds the threshold, an alert is triggered. Warning information is notified to users through the client plug-in via pop-up windows, sound, and other means, and options such as one-click exit and safe browsing recommendations are provided.

[0034] Self-learning and update mechanism: A user feedback mechanism is established to collect user-flagged false alarms and missed detections for subsequent training of the deep learning model. Newly collected data and user feedback are regularly used to retrain the deep learning model and continuously optimize recognition accuracy. The client plug-in and deep learning model support automatic updates, ensuring users always use the latest version to combat the latest phishing techniques.

[0035] Security and Compliance: We use the domestically produced commercial encryption algorithm SM4 for data transmission encryption, protecting the confidentiality and integrity of data during transmission. This ensures that all data transmissions are encrypted and cannot be stolen or tampered with by unauthorized third parties, protecting user privacy and data security. We comply with domestic and international cybersecurity and data protection laws and regulations, ensuring that the system design and implementation process meets cybersecurity standards.

[0036] like Figure 1-Figure 3As shown, the intelligent phishing website identification and early warning method integrated into the browser of a nuclear power plant based on the above system: In the figure, 01 represents system initialization, starts the browser plug-in, loads the latest phishing website feature model, and establishes an encrypted and secure transmission channel; 02 represents user browsing request, when the user opens the browser to visit the website, the plug-in captures the URL and web page content; 03 represents data preprocessing, cleaning and formatting data, completing URL parsing and feature extraction, and analyzing the web page content; 04 represents intelligent identification, using deep learning model analysis to match phishing features and calculate the risk score of the currently visited URL; 05 represents comparison between the score and the threshold, if the score is lower than the threshold, go to 06 for normal access, if the score is higher than the threshold, go to 07 for phishing warning; 06 07 indicates normal access, allowing users to continue browsing and record access logs; 08 indicates phishing warnings, which pop up a warning to notify users and provide security operation suggestions, such as closing the website immediately, reporting the website, and recording the warning event; 09 indicates user feedback processing, collecting user confirmation of false alarms or correct warnings, and feeding back to the server to update the model; 09 indicates model self-update, updating the feature library regularly or based on feedback, and optimizing model parameters; 10 indicates data encryption and transmission, encrypting the data collected in 08 and transmitting it to the server, waiting for the server to return the processing results; 11 indicates system monitoring and logging, recording the system operation status and abnormal events, and conducting security audits and compliance checks; 12 indicates system standby, preparing for the next round of user interaction and maintaining an efficient and stable operation state. The specific steps are as follows: Step 1: Data collection and preliminary analysis: Ensure efficient and secure collection of user browsing data and conduct preliminary analysis to lay the foundation for phishing website identification.

[0037] 01 System Initialization: Design a custom startup script to ensure that the client plug-in is automatically activated when the user opens the browser. Configure the TLS / SSL protocol and establish a secure encryption channel based on the domestically produced commercial encryption algorithm SM4 to ensure the security of data transmission. A lightweight model loading mechanism is used to load only the necessary model components into memory, reducing startup time and resource consumption and ensuring fast response.

[0038] 02 User browsing requests: JavaScript event listeners are embedded in the client plug-in to capture user browsing behaviors such as link clicks and page jumps in real time, and obtain URLs and web page content in a timely manner. Only necessary data is transmitted to the server, such as URL metadata and key parts of the web page DOM tree, reducing the risk of user privacy leakage.

[0039] 03 Data Preprocessing: Utilize regular expressions or specialized URL parsing libraries to extract key information such as domain names and paths, and denormalize them for subsequent analysis. Leverage Natural Language Processing (NLP) techniques, such as TF-IDF and word embedding, to extract key features of webpage text. Simultaneously, simplify the HTML structure and extract layout features.

[0040] 04 Intelligent Identification: Convert the extracted features into vectors that can be processed by deep learning models. Using a deep learning model deployed on the server, such as a CNN or LSTM-based model, the feature vectors are classified and predicted to determine whether they are phishing websites.

[0041] Step 2: Risk Assessment and Response: Quickly and accurately assess website security risks and take timely measures to protect users.

[0042] 05 Comparison of scores and thresholds: Based on the predicted probability of the deep learning model and combined with the feature weights, a comprehensive risk score is calculated and a reasonable threshold is set. For example, a score above 80% indicates high risk.

[0043] 06 Normal access / 07 Phishing warning: If the score is lower than the threshold, the user is allowed to browse normally and the background records the access log; if the score is higher than the threshold, a prominent warning message is immediately displayed to the user through the client plug-in, providing safe operation guidelines, such as closing the page immediately and not entering personal information.

[0044] Step 3: Feedback loop and system optimization: Continuously optimize model performance, improve accuracy, and adapt to changes in fishing techniques.

[0045] 08 User Feedback Processing: Design a simple user feedback interface that allows users to report false positives or missed positives, while also collecting user satisfaction ratings on warning behaviors. This user feedback data is collated and manually or semi-automatically annotated to serve as new data for deep learning model training.

[0046] 9. Model Self-Update: Use online or incremental learning strategies to dynamically adjust model parameters periodically or based on new data, eliminating the need for full retraining and reducing downtime. Introduce A / B testing to compare the performance of new and old models, ensuring that the new model's performance improves before full deployment.

[0047] 10. Data encryption and transmission: Use domestic commercial encryption algorithms SM2 / SM3 / SM4 to encrypt the transmitted data to ensure that the data cannot be cracked during transmission.

[0048] 11. System Monitoring and Logging: Establish a detailed logging system to record system operating status, warning events, and user feedback, etc., to facilitate security audits and troubleshooting. Integrate anomaly detection algorithms to monitor system performance and automatically alert and handle system anomalies.

[0049] 12. System standby: When there is no user activity, resources are released reasonably to keep the system lightweight and prepare for the next response.

[0050] Finally, the innovative features of the present invention are summarized as follows: (1) Improve security protection level: By integrating advanced deep learning algorithms, the system can automatically learn and identify the complex features of phishing websites. Even in the face of evolving phishing techniques and strategies, it can provide efficient and accurate protection, significantly improving the network security protection level of nuclear power plants.

[0051] (2) Adapting to the security protection of nuclear power plants: In view of the characteristics of the work of nuclear power plants, the system is specially designed to meet the network security protection standards of nuclear power plants, ensuring that it can effectively resist phishing attacks when processing sensitive information and operating instructions, and protect nuclear power plants from external phishing network threats.

[0052] (3) Enhance user alertness and response capabilities: The system can not only automatically identify phishing websites, but also promptly remind nuclear power plant staff of potential risks through an intuitive early warning interface, educate and guide users to take correct safety operations, and enhance individual and team network security awareness.

[0053] (4) Promoting compliance and standardization: Combined with the cybersecurity compliance requirements of nuclear power plants, this invention helps promote the standardization and regularization of cybersecurity management in nuclear power plants, and provides strong support for safety audits and risk assessments within and outside the nuclear power industry.

[0054] (5) Optimize resource allocation and management efficiency: Through automated and intelligent phishing website identification and early warning, the workload of manual monitoring is reduced, allowing the nuclear power plant network security team to focus more on the analysis and response of advanced threats, thereby improving the efficiency and effectiveness of overall security operations.

[0055] (6) Support for continuous learning and evolution: The system’s built-in feedback and self-optimization mechanism can continuously learn and adjust the recognition model based on new phishing cases, ensuring long-term effectiveness and adaptability, and providing lasting network security protection for nuclear power plants.

Claims

1. An intelligent phishing website identification and early warning system integrated into a browser for a nuclear power plant, characterized by: include: Client plug-in: monitors the web pages visited by users in real time and transmits the data back to the server for analysis; Server: processes data collected by the client plug-in, runs deep learning models, and stores phishing website feature libraries; Intelligent recognition engine: Based on deep learning model training to identify the characteristics of phishing websites; Early warning and response module: The early warning threshold is set according to the probability value output by the deep learning model. If the value is higher than the threshold, an early warning is triggered, that is, the phishing website is identified, and a warning message is immediately displayed to the user through the client plug-in, providing security operation suggestions.

2. The intelligent phishing website identification and early warning system integrated into a browser for a nuclear power plant according to claim 1 is characterized by: Training data collection and preprocessing for deep learning models: Phishing website samples are collected from public phishing website databases and honeypot systems. At the same time, they are integrated with the nuclear power plant network security system to collect unique phishing cases to form a targeted training data set; the collected data is labeled to distinguish between normal websites and phishing websites; the data is cleaned to remove irrelevant information, the format is unified, and the text data is segmented and vectorized.

3. The intelligent phishing website identification and early warning system integrated into a browser for a nuclear power plant according to claim 1 is characterized by: Deep learning model construction and training: Use deep learning models to automatically extract website URL structural features, web page content semantic features, and page layout features. Select convolutional neural network, recurrent neural network, or Transformer deep learning models based on the feature characteristics. Optimize deep learning model performance through cross-validation and hyperparameter tuning. Use random forest and gradient boosting ensemble learning methods to fuse multiple models.

4. The intelligent phishing website identification and early warning system integrated into a browser for a nuclear power plant according to claim 1 is characterized by: Characteristics of phishing websites include URL structure, page layout, domain name similarity, and malicious scripts.

5. The intelligent phishing website identification and early warning system integrated into a browser for a nuclear power plant according to claim 1 is characterized by: Warning information is notified to users in the form of pop-up windows and sounds through client plug-ins, and provides one-click exit and safe browsing recommended operation options; safe operation suggestions include leaving the page immediately and reporting suspicious websites.

6. The intelligent phishing website identification and early warning system integrated into a browser for a nuclear power plant according to claim 1 is characterized by: The client plug-in is a lightweight browser plug-in that supports Chrome, Firefox, and Edge browsers.

7. The intelligent phishing website identification and early warning system integrated into a browser for a nuclear power plant according to claim 1 is characterized by: Collect user-marked false alarms or missed reports, retrain the deep learning model, and continuously optimize recognition accuracy; use the SM4 encryption algorithm for data transmission encryption.

8. A method for identifying and warning intelligent phishing websites integrated into a browser at a nuclear power plant, characterized by: Step 1: Data collection and preliminary analysis: System initialization: Design a custom startup script to ensure that the client plug-in is automatically activated when the user opens the browser; User browsing requests: JavaScript event listeners are embedded in the client plug-in to capture user clicks on links and page jumps in real time, obtain URLs and web page content in a timely manner, and transmit key parts of URL metadata and web page DOM trees to the server; Data preprocessing: Use regular expressions or URL parsing libraries to extract domain name and path information, perform denormalization, and use natural language processing (NLP) technology to extract key features of web page text. Simultaneously, simplify the HTML structure and extract layout features. Intelligent identification: The extracted features are converted into vector form that can be processed by the deep learning model. The deep learning model deployed on the server is used to classify and predict the feature vectors to determine whether it is a phishing website. Step 2: Risk Assessment and Response: Comparison of scores and thresholds: Based on the predicted probability of the deep learning model and the feature weights, a comprehensive risk score is calculated and a reasonable threshold is set. Risks above the threshold are considered high risk. Normal access / phishing warning: If the score is below the threshold, the user is allowed to browse normally and the access log is recorded; if the score is above the threshold, a warning message is displayed to the user through the client plug-in, providing safe operation guidance; Step 3: Feedback loop and system optimization: User feedback processing: Allow users to report false positives or missed positives, collect user satisfaction ratings on warning behaviors, and organize and annotate user feedback data as new data for deep learning model training; Model self-update: Use online learning or incremental learning strategies to adjust deep learning model parameters regularly or dynamically based on new data. Introduce A / B testing mechanisms to compare the performance of new and old models to ensure that the new model's performance improves before full deployment. System monitoring and logging: Record system operating status, warning events, and user feedback logs, monitor system performance through anomaly detection algorithms, and automatically issue alarms to handle system anomalies; System standby: Frees up resources when there is no user activity, keeping the system lightweight.

9. The intelligent phishing website identification and early warning method integrated into a browser for a nuclear power plant according to claim 8 is characterized by: Deep learning models include CNN or LSTM based models.

10. The intelligent phishing website identification and early warning method integrated into a browser of a nuclear power plant according to claim 8, characterized in that: The TLS / SSL protocol is configured during data transmission, and a secure encryption channel is established based on the SM4 encryption algorithm.

Citation Information

Patent Citations

  • URL(Uniform Resource Locator) classification-based phishing website detection method

    CN102739679A

  • Real-time detection method and system of phishing website

    CN102932348A

  • Phishing website distinguishing method and device based on deep learning

    CN110365691A

  • Hierarchical phishing website detection method based on deep learning

    CN110602113A

  • Phishing website detection method and device, equipment and storage medium

    CN119865355A