A website identification method, apparatus, device, medium, and product

Abstract

This invention provides a website identification method, apparatus, device, medium, and product. The method includes: acquiring an HTML document of a target website; inputting the HTML document of the target website into a website identification model, the website identification model including a DOM channel and a text channel; using the DOM channel to generate a DOM tree structure based on the HTML document, extracting features from the HTML document based on the DOM tree structure, and encoding the extracted features to obtain a path feature encoding vector; using the text channel to extract the webpage text semantic features of the HTML document and encoding the webpage text semantic features to obtain a text semantic feature vector; and weightedly fusing the path feature encoding vector and the text semantic feature vector to output the probability of identifying a fraudulent website. In this invention, by combining page structure and content semantics, cross-modal dynamic fusion is used to achieve collaborative analysis of text and structure, thereby improving the accuracy of fraudulent website identification.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of network security technology, and in particular to a website identification method, apparatus, device, medium and product. Background Technology

[0002] The internet is the infrastructure of the information society, carrying massive amounts of user interaction and economic activity. As a major form of fraud, online scam websites pose a serious threat to users' property and information security by disguising themselves as legitimate websites or providing false information. Therefore, accurately and efficiently identifying scam websites is crucial for building a secure online environment and protecting users' rights.

[0003] Currently, the mainstream methods for identifying fraudulent websites include the following three: Static matching based on rule bases and blacklists, which relies on predefined Uniform Resource Locator (URL) blacklists, regular expression rules, or keyword libraries. This method is not only costly to maintain but also struggles to cover new variants. Single-feature model-based shallow machine learning, which extracts static features from the Document Object Model (DOM) of Hyper Text Markup Language (HTML) and trains classifiers using shallow models such as Support Vector Machines (SVM) and decision trees. This method has weak generalization ability and limited feature representation capabilities. Single-modal deep learning-based methods, which use a single feature dimension for detection and rely on static structural features such as page tag hierarchy and script behavior. This method cannot identify semantic spoofing and has a high false negative rate in semantic analysis. Summary of the Invention

[0004] This invention provides a website identification method, apparatus, device, medium, and product to solve the problem of low accuracy in existing website identification methods.

[0005] To address the aforementioned technical problems, the present invention is implemented as follows: In a first aspect, embodiments of the present invention provide a website identification method, comprising: acquiring an HTML document of a target website; inputting the HTML document of the target website into a website identification model, wherein the website identification model includes a DOM channel and a text channel; the website identification model uses the DOM channel to generate a DOM tree structure based on the HTML document of the target website, and extracts features from the HTML document of the target website based on the DOM tree structure, and encodes the extracted features to obtain a path feature encoding vector; using the text channel to extract the webpage text semantic features of the HTML document of the target website and encodes the webpage text semantic features to obtain a text semantic feature vector; and weightedly fusing the path feature encoding vector and the text semantic feature vector to output the probability of identifying a fraudulent website address of the target website.

[0006] Optionally, the DOM channel generates a DOM tree structure based on the HTML document of the target website, extracts features from the HTML document of the target website based on the DOM tree structure, and encodes the extracted features to obtain a path feature encoding vector. This includes: the DOM channel generating a DOM tree structure based on the HTML document of the target website, where the DOM tree structure uses the root element in the HTML document as the root node, pre-set high-risk interactive elements in the fraudulent website as target nodes, and each HTML element in the complete path from the root node to the target node as a path node; converting the path nodes into a feature vector sequence, encoding the feature vector sequence using a bidirectional long short-term memory encoder to obtain a path node feature vector, and processing the path node feature vector using a self-attention weighted mechanism to obtain a path feature encoding vector.

[0007] Optionally, converting the path node into a feature vector sequence includes: converting the path node into a feature vector sequence of embedded features including label type, label depth, label sibling number, and attribute feature encoding; wherein, the label type is obtained from a predefined label dictionary; the label depth is obtained based on the depth value of the path node, the depth value being the nesting level of the path node relative to the root node; the label sibling number is the position of the path node in the parent container; and the attribute feature encoding is obtained based on password field identifier, hidden field identifier, external resource identifier, event handler identifier, number of class names, name sensitivity, style hiding detection, and auto-submit identifier.

[0008] Optionally, the text channel extracts the semantic features of the HTML document of the target website and encodes the semantic features of the HTML document to obtain a text semantic feature vector, including: obtaining the HTML document of the target website, assigning tag weights to tags in the HTML document of the target website according to the importance of tag semantics, removing non-text tag content, extracting visible text information, and recording the tag weights of the corresponding text information; using a cosine similarity algorithm to match high-frequency fraud words from a sensitive word library and adding semantic tags, and segmenting and weighting the corresponding text according to the tag weights to generate a weighted clean text character stream; inputting the weighted clean text character stream into an encoder to generate semantic fingerprint text, and performing weighted summation on the semantic fingerprint text to obtain the semantic feature vector.

[0009] Optionally, the step of weightedly fusing the path feature encoding vector and the text semantic feature vector to output the probability of identifying a fraudulent website address of the target website includes: concatenating the path feature encoding vector and the text semantic feature vector to obtain a fusion vector; inputting the fusion vector into a sigmoid activation function after a dot product of the fusion vector and a pre-set randomly initialized weight matrix to obtain a first weight; adding the product of the first weight and the text semantic feature vector to the product of the second weight and the path feature encoding vector to obtain a fusion feature, wherein the sum of the first weight and the second weight is 1; and inputting the fusion feature into a fully connected layer to output the probability of identifying a fraudulent website address of the target website.

[0010] Optionally, before inputting the HTML document of the target website into the website recognition model, the method further includes: training the website recognition model, specifically including: obtaining a sample set, the sample set including HTML documents of sample websites with labeled fraudulent website identification probabilities; inputting the sample set into the website recognition model to be trained, the website recognition model to be trained using the DOM channel to generate a DOM tree structure based on the HTML documents of the sample set, and extracting features from the HTML documents of the sample set based on the DOM tree structure, and encoding the extracted features to obtain a sample path feature encoding vector; extracting the web page text semantic features of the HTML documents of the sample set using the text channel and encoding the web page text semantic features to obtain a sample text semantic feature vector; weighting and fusing the sample path feature encoding vector and the sample text semantic feature vector to output the predicted fraudulent website identification probability of the sample website; optimizing the parameters of the website recognition model based on the predicted fraudulent website identification probability of the sample website, the real fraudulent website identification probability of the sample website, and the loss function to obtain the trained website recognition model.

[0011] Secondly, embodiments of the present invention provide a website identification device, comprising: an acquisition module for acquiring an HTML document of a target website; and a processing module for inputting the HTML document of the target website into a website identification model, wherein the website identification model includes a DOM channel and a text channel; the website identification model uses the DOM channel to generate a DOM tree structure based on the HTML document of the target website, and extracts features from the HTML document of the target website based on the DOM tree structure, and encodes the extracted features to obtain a path feature encoding vector; it uses the text channel to extract the webpage text semantic features of the HTML document of the target website and encodes the webpage text semantic features to obtain a text semantic feature vector; and it weights and fuses the path feature encoding vector and the text semantic feature vector to output the probability of identifying a fraudulent website address of the target website.

[0012] Thirdly, embodiments of the present invention provide an electronic device, including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the website identification method as described in any one of the first aspects.

[0013] Fourthly, embodiments of the present invention provide a readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the website identification method as described in any one of the first aspects.

[0014] Fifthly, embodiments of the present invention provide a computer program product including computer instructions that, when executed by a processor, implement the steps of the website identification method as described in any one of the first aspects.

[0015] In this invention, the HTML document of a target website is obtained; the HTML document of the target website is input into a website identification model, wherein the website identification model includes a DOM channel and a text channel; the website identification model uses the DOM channel to generate a DOM tree structure based on the HTML document of the target website, and performs feature extraction on the HTML document of the target website based on the DOM tree structure, and encodes the extracted features to obtain a path feature encoding vector; the text channel is used to extract the webpage text semantic features of the HTML document of the target website and encodes the webpage text semantic features to obtain a text semantic feature vector; the path feature encoding vector and the text semantic feature vector are weighted and fused to output the probability of identifying the target website as a fraudulent URL. By combining feature extraction from the DOM channel and the text channel, feature information of the website is captured from different levels, thereby combining page structure and content semantics, and achieving collaborative analysis of text and structure through cross-modal dynamic fusion, improving the accuracy of fraudulent website identification and solving the problem of low accuracy in existing website identification methods. Attached Figure Description

[0016] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings.

[0017] In the attached diagram: Figure 1 This is a flowchart of a website identification method provided in an embodiment of the present invention.

[0018] Figure 2 This is a general flowchart of a website identification method provided in an embodiment of the present invention.

[0019] Figure 3 This is a flowchart of the DOM channel of a website identification method provided in an embodiment of the present invention.

[0020] Figure 4 This is a schematic diagram of the attribute rules of a website identification method provided in an embodiment of the present invention.

[0021] Figure 5 This is a flowchart of a bidirectional long short-term memory encoder for a website identification method provided in an embodiment of the present invention.

[0022] Figure 6 This is a schematic diagram of the structure of a website identification device provided in an embodiment of the present invention.

[0023] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0024] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0025] Please refer to Figure 1 This invention provides a website identification method, including: Step 11: Obtaining the HTML document of the target website.

[0026] In this embodiment of the invention, obtaining the HTML document of the target website can comprehensively capture the structure and content of the website. The HTML document includes webpage information, script and style information. Obtaining the HTML document provides rich raw data for subsequent feature extraction, thereby improving the accuracy of fraudulent website identification.

[0027] Step 12: Input the HTML document of the target website into the website identification model, wherein the website identification model includes a DOM channel and a text channel; the website identification model uses the DOM channel to generate a DOM tree structure based on the HTML document of the target website, and extracts features from the HTML document of the target website based on the DOM tree structure, and encodes the extracted features to obtain a path feature encoding vector; the text channel is used to extract the webpage text semantic features of the HTML document of the target website and encodes the webpage text semantic features to obtain a text semantic feature vector; the path feature encoding vector and the text semantic feature vector are weighted and fused to output the probability of identifying the fraudulent URL of the target website.

[0028] In the embodiments of this invention, please refer to Figure 2The website identification model includes a DOM channel and a text channel. The DOM channel generates a DOM tree structure, and features are extracted from the HTML document of the target website based on this DOM tree structure. A bidirectional long short-term memory encoder is used for feature encoding, and a self-attention weighted mechanism is incorporated to generate the final 128-dimensional path feature encoding for each target node on the page, i.e., the path feature encoding vector. By generating the DOM tree structure, the information in the HTML document is organized hierarchically. This structured information representation makes subsequent feature extraction more efficient and can more clearly identify the relationships and levels between web page elements. The DOM tree structure can capture various static features of the web page, including tag types, attributes, hierarchical relationships, etc., which is of great significance for identifying the true intent of the website and potential fraudulent behavior. Furthermore, by encoding the extracted features to generate the path feature encoding vector, the complex structural information is transformed into a numerical form that can be used for machine learning, simplifying data processing and improving the efficiency of subsequent model training.

[0029] The text channel analyzes the text content in HTML documents to extract the semantic features of web pages, enabling the model to understand the theme, intent, and content relevance of the web pages, thereby identifying potential fraudulent behavior. By encoding the extracted text semantic features, a text semantic feature vector is generated, which allows the text information to be converted into numerical form, facilitating subsequent processing and analysis by machine learning models.

[0030] By weighted fusion of path feature encoding vectors and text semantic feature vectors, the model comprehensively considers the structural information and text content of web pages. This multi-dimensional feature fusion enables the model to more comprehensively understand the target website, thereby enhancing the model's sensitivity to fraudulent websites and improving the accuracy of identification.

[0031] In this embodiment of the invention, an HTML document of a target website is obtained; the HTML document of the target website is input into a website identification model, wherein the website identification model includes a DOM channel and a text channel; the website identification model uses the DOM channel to generate a DOM tree structure based on the HTML document of the target website, and performs feature extraction on the HTML document of the target website based on the DOM tree structure, and encodes the extracted features to obtain a path feature encoding vector; the text channel is used to extract the webpage text semantic features of the HTML document of the target website and encodes the webpage text semantic features to obtain a text semantic feature vector; the path feature encoding vector and the text semantic feature vector are weighted and fused to output the probability of identifying the target website as a fraudulent URL. By combining feature extraction from the DOM channel and the text channel, feature information of the website is captured from different levels, thereby combining page structure and content semantics, and achieving collaborative analysis of text and structure through cross-modal dynamic fusion, improving the accuracy of fraudulent website identification and solving the problem of low accuracy in existing website identification methods.

[0032] In this embodiment of the invention, optionally, the DOM channel generates a DOM tree structure based on the HTML document of the target website, extracts features from the HTML document of the target website based on the DOM tree structure, and encodes the extracted features to obtain a path feature encoding vector. This includes: the DOM channel generating a DOM tree structure based on the HTML document of the target website, wherein the DOM tree structure uses the root element in the HTML document as the root node, pre-set high-risk interactive elements in the fraudulent website as target nodes, and each HTML element in the complete path from the root node to the target node as a path node; converting the path nodes into a feature vector sequence, encoding the feature vector sequence using a bidirectional long short-term memory encoder to obtain a path node feature vector, and processing the path node feature vector using a self-attention weighted mechanism to obtain a path feature encoding vector.

[0033] Please refer to Figure 3 In this embodiment of the invention, the specific implementation steps of the DOM channel include: parsing the HTML document of the target website and generating a DOM tree with depth tags. The depth tag is the nesting level value of each node relative to the root node (usually a tag) in the DOM tree structure. Specifically: the depth of the root node (e.g., 0); the depth of the direct child nodes of the root node (e.g., 1); and the depth value increases by 1 for each lower nesting level. In fraudulent website identification, the depth tag is used to quantify the nesting level of nodes. Deep nesting (e.g., depth ≥ 3) is often associated with fraudulent structures such as hidden forms and malicious iframes. The depth information is encoded as part of the feature vector, thereby helping the model identify structural anomalies.

[0034] Extract the complete path from the target node to the root node. Specifically, in fraudulent webpage detection, the target node is a high-risk interactive element on a fraudulent website, such as a password input box, buttons containing sensitive text (e.g., button names like "Pay Now," "Confirm Payment," "Confirm Transfer," "Submit Verification," "Claim Bonus," etc.), identity information forms, file upload controls, SMS verification code input areas, and other HTML components. The complete path refers to the continuous sequence of nodes from the root node () to the target node (e.g., password input box, sensitive button, etc.). For example, if the target node is... <input type="password"> The complete path may be: html → body → div → form → input. The complete path reflects the positional context of the target node in the document structure, which is the basis for extracting structural fraud features.

[0035] A bidirectional Long Short-Term Memory (LSTM) encoder is used to encode the node feature vectors, maximizing the learning of the complete contextual information of the target node, such as... Figure 5 As shown, specifically: the 16-dimensional encoding of each target node from the root node to that target node is concatenated row-wise to generate a 16-dimensional node vector sequence with a shape of [sequence length, 16]. This sequence is then input into both a forward LSTM and a backward LSTM. The forward LSTM processes data from the root node to the target node, and the processing expression is: The backward LSTM processing direction is from the target node to the root node, and the processing expression is: Forward LSTM and backward LSTM generate 64-dimensional hidden layer vectors from the 16-dimensional input vector, respectively. , Finally, the two vectors are concatenated into a 128-dimensional feature vector, which is the path node feature vector: Where ht is the hidden state at time step t; This is the input vector for time step t; The hidden state of the forward LSTM; This represents the hidden state of the backward LSTM.

[0036] After processing each target node on the current page sequentially, a self-attention weighting mechanism is introduced to allow the model to autonomously determine which nodes are more important. The features of these nodes are then weighted and summed according to their importance, so that the model can focus more on the nodes most relevant to identifying fraudulent websites and ignore less important nodes. Specifically, assuming that the bidirectional LSTM processing yields a T×128 matrix H (T being the number of path nodes), after processing through the self-attention mechanism, it is transformed into a 1×128 path feature encoding vector. The specific process is as follows: Let the attention energy of each target node be... This refers to the unnormalized attention score for each node, which is calculated as follows: ;in, The attention function is implemented with a single hidden layer in a neural network and includes linear transformation, tanh nonlinear activation, and dot product operation. is the 128-dimensional feature vector output by the bidirectional LSTM encoder for this node; W is the weight matrix, which is randomly initialized and learned and updated during training; c is the bias vector, which is randomly initialized and learned and updated during training.

[0037] After processing all path nodes separately, we obtain the attention energy matrices for T path nodes. The values ​​are then normalized to obtain the attention weights of the path nodes. Where ek is the attention energy score of the k-th path node, calculated as follows: ;in, The 128-dimensional feature vector of the k-th node; d represents the attention weights; d represents the bias vector. For attention projection vectors, It is randomly initialized at the beginning of model training and then automatically learned through backpropagation and gradient descent algorithms during model training.

[0038] Finally, the attention weights of the path nodes are used. The feature vector of all target nodes is obtained by weighted summation of coefficients, i.e. The final 128-dimensional path feature vector is obtained. That is, the path feature encoding vector.

[0039] In this embodiment of the invention, optionally, converting the path node into a feature vector sequence includes: converting the path node into a feature vector sequence of embedded features including tag type, tag depth, tag sibling number, and attribute feature encoding; wherein, the tag type is obtained from a predefined tag dictionary; the tag depth is obtained based on the depth value of the path node, the depth value being the nesting level of the path node relative to the root node; the tag sibling number is the position of the path node in the parent container; and the attribute feature encoding is obtained based on password field identifier, hidden field identifier, external resource identifier, event handler identifier, number of class names, name sensitivity, style hiding detection, and auto-submit identifier.

[0040] In this embodiment of the invention, to meet the needs of model processing, the path nodes need to be vectorized, that is, each node is converted into a 16-dimensional fixed-length numerical vector for representation. The path node refers to each HTML element node in the complete path from the root node to the target node. For example, in the path html → body → div → form → input, html, body, div, form, and input are all path nodes. Each path node is converted into a 16-dimensional vector, including: tag type (such as input, form); tag depth: the level of the node in the DOM tree; tag sibling index: the position index of the node in its parent container (starting from 0), thereby numerating the structural information for the bidirectional LSTM sequence model to learn the path context.

[0041] Specifically, to achieve node vectorization, four dimensions of embedding features are defined: tag type embedding (4-dimensional), tag depth embedding (2-dimensional), tag sibling number embedding (2-dimensional), and attribute feature encoding (8-dimensional), i.e., 16-dimensional vector = [tag embedding (4-dimensional)] + [depth embedding (2-dimensional)] + [sibling number embedding (2-dimensional)] + [attribute encoding (8-dimensional)]. For tag type embedding: the tag type is obtained from a predefined tag dictionary, which defines 100 HTML tags, for example: tag_dict ={'html': 0, 'body': 1, 'div': 2, 'form': 3, 'input': 4, 'button': 5, 'iframe': 6, 'script': 7, 'a': 8, 'img': 9, # ... a total of 100 tags. 'unknown': 99 # Unknown tag.}.

[0042] The embedding matrix is ​​generated by training Word2Vec based on the label name. The semantic features of the label are captured by a 4-dimensional vector. The matrix size is (100*4) and the values ​​are all in the range of (-1,1).

[0043] For tag depth embedding: the depth value is discretized into 20 levels, and deep nodes are represented by higher negative values ​​to reflect the high risk of nodes being abnormally nested. The size of the embedding matrix is ​​(20*2), and the value range is between (-1,1).

[0044] For tag sibling sequence embedding: capture the position of the node in the parent container, the position range is limited to within 50, the embedding matrix size is (50*2), and the value range is between (-1,1).

[0045] For node attribute feature encoding, an 8-dimensional vector is used, focusing on 8 major categories of attribute features. The feature extraction rules are as follows: Figure 4 As shown.

[0046] All four feature vectors are concatenated horizontally to generate a 16-dimensional feature vector, which is then named "combined". The vector is normalized using the minimum-maximum method.

[0047] Assuming the minimum value of the vector is min_vals and the maximum value is max_vals, then: min_vals = [-1, -1, -1, -1, -1, -1, -1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]; max_vals = [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1].

[0048] The normalized feature vector = (combined - min_vals) / (max_vals - min_vals).

[0049] Suppose there is a path node with the following characteristics: label "input"; node depth 3; sibling number 2 (i.e., it is the 3rd child node of its parent node, indexed from 0); attributes "type="password" and "name="bank_pwd"". The vectorization process is as follows: Tag embedding: The encoding of "input" in the tag dictionary is 4, so the 4th row is taken from the tag embedding matrix, assumed to be [0.1, 0.2, 0.3, 0.4]; Depth embedding: Depth 3, so the 3rd row is taken from the depth embedding matrix, assumed to be [0.5, 0.6]; Sibling number embedding: Sibling number 2, so the 2nd row is taken from the sibling number embedding matrix, assumed to be [0.7, 0.8]; Attribute encoding: Password input box: 1.0, Not a hidden input box: 0.0, No src attribute: 0.0, No onclick attribute: 0.0, No class attribute: 0 (number of class names is 0). The following conditions are met: 1. Name contains sensitive words ('pwd' in "bank_pwd"): 1.0; 2. No style hiding: 0.0; 3. No autosubmit attribute: 0.0. Therefore, the attribute encoding vector is: [1.0, 0.0, 0.0, 0.0, 0.0, 1.0, 0.0, 0.0]; Vector concatenation: The final feature vector sequence is [0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 1.0, 0.0, 0.0, 0.0, 0.0, 1.0, 0.0, [0.0]; where the embedding matrix (label, depth, sibling number) is randomly initialized at the start of training and optimized through backpropagation during model training, while the eight features of the attribute encoding are manually designed and their values ​​are fixed (not learned). They directly reflect the node attributes related to fraud. By vectorization, each node can be represented as a 16-dimensional vector, which includes the semantic information (label), structural information (depth, sibling position), and fraud-sensitive attributes of the node. As input to the subsequent LSTM, it is used to learn the context information of the entire path. By combining the embedding matrix with the fixed attribute encoding and representing each node as a 16-dimensional vector, the semantic information, structural information, and fraud-sensitive attributes of the node can be effectively fused. This multi-dimensional feature representation provides a rich information foundation for the subsequent LSTM learning, thereby improving the ability to identify fraudulent websites and the overall performance.

[0050] In this embodiment of the invention, optionally, the text channel extracts the semantic features of the webpage text of the target website's HTML document and encodes the semantic features of the webpage text to obtain a text semantic feature vector, including: obtaining the HTML document of the target website, assigning tag weights to tags in the HTML document of the target website according to the importance of tag semantics, removing non-text tag content, extracting visible text information, and recording the tag weights of the corresponding text information; using a cosine similarity algorithm to match high-frequency fraud words from a sensitive word library and adding semantic tags, and segmenting and weighting the corresponding text according to the tag weights to generate a weighted clean text character stream; inputting the weighted clean text character stream into an encoder to generate semantic fingerprint text, and performing weighted summation on the semantic fingerprint text to obtain the semantic feature vector.

[0051] In this embodiment of the invention, assigning tag weights to tags in the HTML document of the target website according to the importance of tag semantics includes: parsing the HTML document of the target website using BeautifulSoup or lxml to obtain the tag hierarchy of the HTML document of the target website, and assigning weight coefficients according to the importance of tag semantics, such as: Title: 1.0; meta: 0.8; h1: 0.7; body: 0.5; div: 0.4; span: 0.3; script: 0.1; then removing non-text tag content, extracting visible text information, and recording the tag weight of the text.

[0052] Hex-encoded and Base64 obfuscated strings (such as \x51\x2f) are removed using regular expressions. High-frequency fraud words (such as "winning", "verification code", "account abnormal", "transfer", etc.) are matched from the sensitive word library using the cosine similarity algorithm and semantic tags [FRAUD_KW] are added. Finally, the text is segmented and weighted according to the tag weights to generate a weighted clean text character stream. The output format is as follows: [weight: 0.8] Account abnormal [weight: 1.0] You have won a prize, click to claim [FRAUD_KW].

[0053] By setting the dynamic sliding window length L=128 tokens and the sliding step size to 64 tokens, a certain degree of context overlap is ensured.

[0054] Load the pre-trained BERT (Bidirectional Encoder Representations from Transformers) model, input the window token into the BERT model, extract the 768-dimensional vector h_cls at the position of the last hidden state [cls], and generate the encoding vector for each window, that is, encode the variable-length text window into fixed-dimensional (768-dimensional) semantic fingerprint text.

[0055] The semantic fingerprint text encoded in each window is then further weighted and summed using the following formula: Among them, weight This represents the sum of the weights of the text labels within the window.

[0056] Again After normalization, the final 768-dimensional global semantic feature vector of the webpage output by the text channel can be generated. That is, the semantic feature vector.

[0057] In this embodiment of the invention, optionally, the step of weightedly fusing the path feature encoding vector and the text semantic feature vector to output the fraudulent URL identification probability of the target website includes: concatenating the path feature encoding vector and the text semantic feature vector to obtain a fusion vector; inputting the fusion vector into a sigmoid activation function after a dot product of the fusion vector and a pre-set randomly initialized weight matrix to obtain a first weight; adding the product of the first weight and the text semantic feature vector to the product of the second weight and the path feature encoding vector to obtain a fusion feature, wherein the sum of the first weight and the second weight is 1; and inputting the fusion feature into a fully connected layer to output the fraudulent URL identification probability of the target website.

[0058] In this embodiment of the invention, the ;in, ; ; Where [TextFeature, DomFeature] is a long vector concatenated from the semantic feature vector (TextFeature) and the path feature encoding vector (DomFeature). Assuming the dimension of TextFeature is d_text and the dimension of DomFeature is d_dom, then the dimension of the concatenated vector is d_text + d_dom. W_text is a randomly initialized learnable weight matrix (model parameters), which is optimized during training through backpropagation and gradient descent to minimize the task loss. Once the model is trained, these parameters will be written to the model file for permanent implementation.

[0059] In this embodiment of the invention, and These are the dynamic weights of the text channel and the DOM channel, respectively, satisfying... The webpage recognition model dynamically determines the contribution ratio of the two features based on the input, thereby fusing the text feature and the DOM structure feature into a new feature. and It acts as a gating signal, determining the importance and weight of each of the two features. It's not fixed; rather, it's dynamically calculated during the prediction phase based on the two current features. This allows the weights of the two features to differ for different samples, enabling the model to adaptively adjust. Specifically, during calculation, the dot product of W_text and [TextFeature, DomFeature] is input into the sigmoid function, which limits the weights to between 0 and 1. This makes the fusion process interpretable: α closer to 1 indicates that text features are more important, and closer to 0 indicates that DOM features are more important; that is, if the TextFeature feature is more important for the current task, then... Closer to 1 (text-dominant); if the DomFeature is more important to the current task, then It is closer to 0 (DOM structure dominant); under this mechanism, the model can more flexibly adapt to different types and features of fraudulent websites, ensuring a higher overall accuracy in the final identification.

[0060] In this embodiment of the invention, DOM structure deep encoding and text semantic encoding are used to simultaneously capture structural fraud features (such as nested input boxes) and semantic spoofing features (such as synonym replacement), solving the problem of missed detection in a single modality; and cross-modal attention fusion (dynamic weight α / β) is used to adaptively allocate dual-channel weights (e.g., text-dominant fraud α→1, structural spoofing fraud β→1), improving the generalization of complex scenarios.

[0061] In this embodiment of the invention, optionally, before inputting the HTML document of the target website into the website recognition model, the method further includes: training the website recognition model, specifically including: obtaining a sample set, the sample set including HTML documents of sample websites with labeled fraudulent website identification probabilities; inputting the sample set into the website recognition model to be trained, the website recognition model to be trained using the DOM channel to generate a DOM tree structure based on the HTML documents of the sample set, and extracting features from the HTML documents of the sample set based on the DOM tree structure, and encoding the extracted features to obtain a sample path feature encoding vector; extracting the webpage text semantic features of the HTML documents of the sample set using the text channel and encoding the webpage text semantic features to obtain a sample text semantic feature vector; weighting and fusing the sample path feature encoding vector and the sample text semantic feature vector to output the predicted fraudulent website identification probability of the sample website; optimizing the parameters of the website recognition model based on the predicted fraudulent website identification probability of the sample website, the real fraudulent website identification probability of the sample website, and the loss function to obtain the trained website recognition model.

[0062] In this embodiment of the invention, a sample set is constructed by collecting a large number of annotated webpage HTML source codes. Where xi represents the HTML source code of the i-th webpage, and yi is its corresponding tag (0 represents a normal website, 1 represents a fraudulent website); to improve the robustness of the model, the sample set can be transformed without loss, such as randomly inserting or deleting harmless comments, fine-tuning the attribute order that does not affect the function, replacing text content with synonyms, etc., to simulate the disguise methods of fraudulent websites; input the HTML source code Xi into the DOM channel and the text channel respectively to obtain the feature vectors V_dom and V_text; obtain the fused feature vector V_fused through the cross-modal attention fusion mechanism; input V_fused into the fully connected layer and output the probability pi through the Sigmoid activation function; calculate the loss H, and update all parameters of the model through the backpropagation algorithm, including: the embedding matrix, BiLSTM weights, and attention parameters in the DOM channel; the BERT fine-tuning parameters (optional) in the text channel; the weight matrix W_text in the fusion layer, etc., monitor the performance on the validation set, and if the loss no longer decreases for several consecutive cycles, terminate the training early to prevent overfitting.

[0063] The loss function used is the binary cross-entropy loss function, and the calculation formula is as follows: Where pi is the probability that the model predicts sample Xi as a fraudulent website.

[0064] Specifically, the Adam optimizer is used to dynamically adjust the learning rate to minimize the aforementioned loss function.

[0065] Please refer to Figure 6 This invention provides a website identification device, comprising: an acquisition module 61 for acquiring an HTML document of a target website; and a processing module 62 for inputting the HTML document of the target website into a website identification model, wherein the website identification model includes a DOM channel and a text channel; the website identification model uses the DOM channel to generate a DOM tree structure based on the HTML document of the target website, and extracts features from the HTML document of the target website based on the DOM tree structure, and encodes the extracted features to obtain a path feature encoding vector; it uses the text channel to extract the webpage text semantic features of the HTML document of the target website and encodes the webpage text semantic features to obtain a text semantic feature vector; and it weights and fuses the path feature encoding vector and the text semantic feature vector to output the probability of identifying a fraudulent website address of the target website.

[0066] The website identification device provided in this embodiment of the invention can achieve Figure 1 The various processes implemented in the method embodiments achieve the same technical effect, and will not be described again here to avoid repetition.

[0067] This invention provides an electronic device 70, see [link to relevant documentation]. Figure 7 As shown, Figure 7 This is a schematic block diagram of an electronic device 70 according to an embodiment of the present invention, including a processor 71, a memory 72, and a program or instructions stored in the memory 72 and executable on the processor 71. When the program or instructions are executed by the processor, they implement the steps in any of the website identification methods of the present invention.

[0068] This invention provides a readable storage medium on which a program or instruction is stored. When the program or instruction is executed by a processor, it implements the various processes of the website identification method embodiment as described above and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0069] This application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the above-described... Figure 1 The various processes of the method embodiments shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0070] Computer-readable media include both permanent and non-permanent, removable and non-removable media, which can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0071] It should be noted that the collection, gathering, updating, analysis, processing, use, transmission, and storage of user personal information involved in this disclosed technical solution all comply with relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. Necessary measures are taken to prevent unauthorized access to user personal information data and to safeguard user personal information security and network security.

[0072] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0073] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0074] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a service classification device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0075] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A website identification method characterized by, include: Obtain the HTML document of the target website; The HTML document of the target website is input into a website identification model, which includes a DOM channel and a text channel. The website identification model uses the DOM channel to generate a DOM tree structure based on the HTML document of the target website, and extracts features from the HTML document of the target website based on the DOM tree structure. The extracted features are then encoded to obtain a path feature encoding vector. The text channel is used to extract the webpage text semantic features of the HTML document of the target website and encodes the webpage text semantic features to obtain a text semantic feature vector. The path feature encoding vector and the text semantic feature vector are then weighted and fused to output the probability of identifying the target website as a fraudulent URL. The DOM channel generates a DOM tree structure based on the HTML documents of the target website, extracts features from the HTML documents of the target website based on the DOM tree structure, and encodes the extracted features to obtain a path feature encoding vector, including: The DOM channel generates a DOM tree structure based on the HTML document of the target website. The DOM tree structure takes the root element in the HTML document as the root node, the high-risk interactive elements in the pre-set fraudulent website as the target nodes, and each HTML element in the complete path from the root node to the target node as a path node. The path nodes are converted into a 16-dimensional encoded feature vector sequence, and a bidirectional long short-term memory (LSTM) encoder is used to encode the feature vector sequence to obtain path node feature vectors. A self-attention weighting mechanism is then used to process the path node feature vectors to obtain a path feature encoding vector. The bidirectional LSM encoder includes a forward LSM encoder and a backward LSM encoder. The forward LSM encoder processes from the root node to the target node; the backward LSM encoder processes from the target node to the root node. The forward and backward LSM encoders each generate a 64-dimensional hidden layer vector from the 16-dimensional input vector, and then concatenate the two vectors to form a 128-dimensional feature vector. The self-attention weighting mechanism determines the attention weights of the path nodes based on their feature vectors, and uses these attention weights as coefficients to sum all path node feature vectors to obtain the path feature encoding vector. The text channel extracts the semantic features of the HTML document of the target website and encodes the semantic features to obtain a text semantic feature vector, including: Obtain the HTML document of the target website, assign tag weights to the tags in the HTML document of the target website according to the importance of tag semantics, remove non-text tag content, extract visible text information, and record the tag weights of the corresponding text information. The cosine similarity algorithm is used to match high-frequency fraud words from the sensitive word library and add semantic tags. The corresponding text is then segmented and weighted according to the tag weights to generate a clean text character stream with weights. The weighted pure text character stream is input into the encoder to generate semantic fingerprint text, and the semantic fingerprint text is weighted and summed to obtain the semantic feature vector.

2. The website identification method of claim 1, wherein, The step of converting the path nodes into a sequence of feature vectors includes: The path nodes are converted into a sequence of feature vectors containing embedded features including label type, label depth, label sibling number, and attribute feature encoding; The tag type is obtained from a predefined tag dictionary; the tag depth is obtained based on the depth value of the path node, where the depth value is the nesting level of the path node relative to the root node; the tag sibling number is the position of the path node in the parent container; and the attribute feature encoding is obtained based on the password field identifier, hidden field identifier, external resource identifier, event handler identifier, class name quantity, name sensitivity, style hiding detection, and auto-commit identifier.

3. The website identification method of claim 1, wherein, The step of weightedly fusing the path feature encoding vector and the text semantic feature vector to output the probability of identifying a fraudulent website address for the target website includes: The path feature encoding vector and the text semantic feature vector are concatenated to obtain a fusion vector; The first weight is obtained by multiplying the fusion vector with a pre-set randomly initialized weight matrix and then inputting the product into the sigmoid activation function. The product of the first weight and the text semantic feature vector is added to the product of the second weight and the path feature encoding vector to obtain the fused feature, wherein the sum of the first weight and the second weight is 1; The fused features are input into a fully connected layer, which outputs the probability of identifying a fraudulent URL for the target website.

4. The website identification method of claim 1, wherein, Before inputting the HTML document of the target website into the website recognition model, the method further includes: Training the website recognition model specifically includes: Obtain a sample set, which includes HTML documents of sample websites labeled with the probability of identifying fraudulent URLs; The sample set is input into the website recognition model to be trained. The website recognition model uses the DOM channel to generate a DOM tree structure based on the HTML documents of the sample set, and extracts features from the HTML documents of the sample set based on the DOM tree structure. The extracted features are then encoded to obtain a sample path feature encoding vector. The text channel is used to extract the web page text semantic features of the HTML documents of the sample set and encodes the web page text semantic features to obtain a sample text semantic feature vector. The sample path feature encoding vector and the sample text semantic feature vector are then weighted and fused to output the predicted probability of identifying the fraudulent website of the sample website. Based on the predicted probability of identifying fraudulent URLs on sample websites, the probability of identifying fraudulent URLs on real sample websites, and the loss function, the parameters of the website identification model are optimized to obtain the trained website identification model.

5. A website identifying apparatus characterized by comprising: include: The acquisition module is used to acquire HTML documents from the target website; The processing module is used to input the HTML document of the target website into a website identification model, wherein the website identification model includes a DOM channel and a text channel; the website identification model uses the DOM channel to generate a DOM tree structure based on the HTML document of the target website, and extracts features from the HTML document of the target website based on the DOM tree structure, and encodes the extracted features to obtain a path feature encoding vector; it uses the text channel to extract the webpage text semantic features of the HTML document of the target website and encodes the webpage text semantic features to obtain a text semantic feature vector; and it weights and fuses the path feature encoding vector and the text semantic feature vector to output the probability of identifying the target website as a fraudulent URL; The processing module includes a processing submodule, used to generate a DOM tree structure based on the HTML document of the target website, wherein the DOM tree structure takes the root element in the HTML document as the root node, high-risk interactive elements in the pre-set fraudulent website as target nodes, and each HTML element in the complete path from the root node to the target node as a path node; converts the path nodes into a 16-dimensional encoded feature vector sequence, encodes the feature vector sequence using a bidirectional long short-term memory encoder to obtain a path node feature vector, and processes the path node feature vector using a self-attention weighted mechanism to obtain a path feature encoding vector, wherein... The bidirectional long short-term memory encoder includes a forward long short-term memory encoder and a backward long short-term memory encoder. The forward long short-term memory encoder processes data from the root node to the target node; the backward long short-term memory encoder processes data from the target node to the root node. The forward long short-term memory encoder and the backward long short-term memory encoder each generate a 64-dimensional hidden layer vector from the 16-dimensional input vector and concatenate the two vectors into a 128-dimensional feature vector. The self-attention weighting mechanism determines the attention weight of the path node based on the path node feature vector and sums all path node feature vectors using the attention weight of the path node as coefficients to obtain the path feature encoding vector. The text channel extracts the semantic features of the HTML document of the target website and encodes the semantic features to obtain a text semantic feature vector, including: Obtain the HTML document of the target website, assign tag weights to the tags in the HTML document of the target website according to the importance of tag semantics, remove non-text tag content, extract visible text information, and record the tag weights of the corresponding text information. The cosine similarity algorithm is used to match high-frequency fraud words from the sensitive word library and add semantic tags. The corresponding text is then segmented and weighted according to the tag weights to generate a clean text character stream with weights. The weighted pure text character stream is input into the encoder to generate semantic fingerprint text, and the semantic fingerprint text is weighted and summed to obtain the semantic feature vector.

6. An electronic device, comprising: It includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the website identification method as described in any one of claims 1 to 4.

7. A readable storage medium characterized by, The readable storage medium stores a program or instructions that, when executed by a processor, implement the steps of the website identification method as described in any one of claims 1 to 4.

8. A computer program product, characterised in that, It includes computer instructions that, when executed by a processor, implement the steps in the website identification method as described in any one of claims 1 to 4.

Images