Method and system for detecting customized phishing websites for mobile terminals

Abstract

The application provides a detection method and system for mobile terminal customized fraudulent phishing websites, and relates to the technical field of network security and mobile artificial intelligence. The method comprises the following steps: adopting a word segmentation and structure combination embedding representation method to split real-time acquired URL data to be detected and perform structure marking to obtain a URL embedding matrix; performing real-time detection on the URL embedding matrix by using a customized fraudulent phishing detection model trained through a multi-branch semi-supervised integrated distillation strategy to obtain a phishing detection result of the URL data to be detected; and based on a concept drift detection mechanism, if the phishing detection result is suspicious, feeding back to a cloud data pool, updating the detection model according to the drift degree and redeploying to the local, so as to maintain the reliability and stability of the detection result. The application aims to overcome the problems of poor adaptability, insufficient detection accuracy, difficulty in mobile terminal deployment and unstable model of the existing phishing website detection technology.

Description

Technical Field

[0001] This invention relates to the fields of network security and mobile artificial intelligence technology, and in particular to a method and system for detecting deceptive phishing websites customized for mobile terminals. Background Technology

[0002] With the large-scale commercialization of 5G, the fifth-generation mobile communication technology, mobile terminals have replaced traditional desktop devices as the mainstream network access terminals. In scenarios such as mobile payment and mobile authentication, mobile terminals, due to limitations in computing power, memory, and security protection capabilities, have become key targets for phishing attacks. Phishing attacks often steal account credentials, payment keys, and sensitive information through methods such as highly realistic imitations of target websites, forged redirect links, and inducement to grant authorizations. Their attack characteristics are showing a trend towards concealment, targeting, and automation.

[0003] Existing phishing website detection technologies are mainly divided into two categories: those based on webpage content and those based on Uniform Resource Locators (URLs). The former constructs a detection model through multimodal analysis of webpage source code, text semantics, and visual elements. The latter primarily utilizes the semantic, structural, and statistical features of URLs for analysis.

[0004] Specifically, while content-based detection methods offer excellent accuracy, they often rely on multimodal features and complex deep models, resulting in high memory consumption and inference latency, making them unsuitable for real-time detection and lightweight deployment on mobile devices. For example, Chinese patent application number 201410482121.4, "A Method and System for Detecting Chinese Phishing Websites," extracts webpage URLs, HTML, and text features for comprehensive analysis and improves detection accuracy through various machine learning algorithms. However, its feature extraction and content parsing processes consume significant computing power, making it unsuitable for real-time operation on mobile devices. Similarly, Chinese patent application number 202010046787.0, "A Method and Electronic Device for Phishing Website Identification Based on Visual and Host Features," introduces matching of visual features from webpage snapshots with host information, but this significantly increases model complexity and inference latency, making on-device deployment difficult. Therefore, such solutions are more suitable for centralized cloud-based detection than for resource-constrained mobile environments.

[0005] In contrast, URL-based detection methods do not require loading webpage content. They rely solely on the semantic, structural, and statistical features of the URL to achieve effective detection through lightweight models, significantly reducing computational overhead and memory usage. However, existing methods generally extract only single semantic or statistical features, ignoring the pattern information inherent in the URL's unique syntactic structure (i.e., protocol: / / domain / path / query / fragment). For example, Chinese patent application number 201210223505.5, "A Phishing Website Detection Method Based on URL Classification," extracts statistical features such as whether it contains an IP address, path depth, and the presence of special characters for analysis. Chinese patent application number 202410651081.5, "A Phishing Website Detection Method, System, and Device Based on URL Semantic Features," treats the URL as an ordinary string and extracts its semantic features for phishing website detection, lacking the ability to jointly model semantics and structure, making it difficult to cope with complex and ever-changing phishing strategies. Furthermore, in real-world network environments, the distribution of phishing attack samples often exhibits significant class imbalance, and attack features evolve over time (concept drift), leading to a rapid decline in the performance of detection models or even their failure after deployment. Current optimization research is still in the exploratory stage, and the accuracy and stability in real-world scenarios need to be improved. For example, Chinese patent application number 201110369729.2: A method and system for preventing phishing attacks based on mobile terminals. Although this method focuses on mobile terminal security, it mainly relies on a two-way authentication mechanism to defend against phishing attacks, and it has not effectively addressed the adaptability of the URL detection model to changes in data distribution.

[0006] In summary, considering the significant limitations of mobile devices in terms of computing power, memory, and energy consumption, existing technologies are clearly insufficient in terms of feature representation completeness, lightweight deployment on the device side, and adaptability to dynamic environments. There is an urgent need to propose a phishing website detection method that can balance high accuracy, lightweight design, and adaptability in mobile environments.

[0007] Against this backdrop, researching and implementing a detection scheme that can run on resource-constrained mobile terminals, resist customized phishing strategies, and be adaptively updated has significant application value and practical significance. Summary of the Invention

[0008] To address the shortcomings of the existing technologies, this invention proposes a method and system for detecting deceptive phishing websites customized for mobile terminals, based on deep learning. This is achieved through innovative designs in URL representation methods, detection model structures, training strategies, lightweight models, and concept drift adaptive mechanisms. The aim is to overcome the problems of poor adaptability, insufficient detection accuracy, difficulty in efficient deployment on mobile terminals, and model instability in existing phishing website detection technologies.

[0009] On the one hand, this invention proposes a method for detecting deceptive phishing websites customized for mobile terminals, which includes the following process:

[0010] The method of combining word segmentation and structure embedding is used to segment the real-time acquired URL data to be detected and perform structure tagging to generate a sequence of word segmentation structure pairs, thereby obtaining the URL embedding matrix;

[0011] Construct a URL data sample set and a customized deceptive phishing detection model, and train the customized deceptive phishing detection model;

[0012] A customized deceptive phishing detection model is used to perform real-time detection on the URL embedding matrix to obtain the phishing detection results of the URL data to be detected, and a confidence level is assigned to the phishing detection results using a preset confidence threshold.

[0013] Based on the confidence level, determine whether the phishing detection result is suspicious, and use the URL data to be detected corresponding to the suspicious phishing detection result as a return sample;

[0014] When the number of refluxed samples reaches At the same time, based on the concept drift detection mechanism, the customized deceptive phishing detection model is updated regularly.

[0015] Furthermore, the method of combining word segmentation and structural embedding is used to segment the real-time acquired URL data to be detected and perform structural tagging to generate a sequence of word segmentation structure pairs, thereby obtaining the specific content of the URL embedding matrix as follows:

[0016] The URL data to be detected is normalized to generate a URL string;

[0017] A sub-word-level segmenter is used to segment the URL string, generating several segmentation units. The sub-word-level segmenter adopts a strategy based on a combination of byte pair encoding and regular expression rules. The strategy is as follows: the input URL string is parsed into candidate character sequences using predefined regular expression rules; a byte pair encoding algorithm is used to build a vocabulary, and the candidate character sequences are segmented according to the vocabulary to obtain several segmentation units.

[0018] Based on predefined URL structure attributes, add structure attribute symbols to each word segmentation unit to generate a sequence of word segmentation structure pairs;

[0019] The FastText embedding model, based on word combination, is used to transform word segmentation pairs in the word segmentation structure pair sequence into embedding vectors and generate a URL embedding matrix.

[0020] Furthermore, the specific content of constructing the URL data sample set and the customized deceptive phishing detection model, and training the customized deceptive phishing detection model, is as follows:

[0021] Collect URL data from several different data sources, and divide all collected URL data into a tagged data pool and an untagged data pool based on whether the collected URL data has tags.

[0022] The URL data in the labeled data pool and the unlabeled data pool are preprocessed separately, and the preprocessed data is used to construct a URL data sample set. The data preprocessing includes: cleaning the URL data, segmenting the cleaned URL data using a word segmentation and structure combination embedding representation method and performing structure marking, generating a word segmentation structure pair sequence, and then obtaining the URL embedding matrix.

[0023] Build a customized deceptive phishing detection model;

[0024] Based on the URL data sample set, a customized deceptive phishing detection model is trained using a multi-branch semi-supervised ensemble distillation learning strategy, resulting in a well-trained customized deceptive phishing detection model.

[0025] Furthermore, the customized deceptive phishing detection model includes:

[0026] The multi-channel local feature extraction module uses several parallel one-dimensional convolutional channels to extract local features from the input URL embedding matrix. The local feature maps output from all one-dimensional convolutional channels are then concatenated into a stitching layer to output a multi-scale local feature representation. Each one-dimensional convolutional channel consists of a one-dimensional convolutional layer, an ELU activation function, and a soft pooling layer connected in series, and the kernel size of the one-dimensional convolutional layer in each one-dimensional convolutional channel is different.

[0027] The global dependency modeling module projects the URL embedding matrix using three independent linear projection layers, generating query matrix tensors, key matrix tensors, and value matrix tensors, and then partitions each matrix tensor into... Each attention head is assigned an attention head; rotational position encoding is applied to the query matrix tensor and key matrix tensor in each attention head to generate query matrix tensors and key matrix tensors with injected position information; the attention weights of the scaled dot product attention are calculated using the query matrix tensors and key matrix tensors with injected position information, and the output sequence is generated by multiplying the attention weights with the value matrix tensor; then a linear layer is used to project the output sequence to generate a global dependency information representation.

[0028] The feature fusion and classification module fuses multi-scale local feature representations and global dependency information representations, and performs a residual connection between the fused comprehensive feature representation and the URL embedding matrix. Then, by layer normalization of the output of the residual connection, the final feature output is obtained and input into the FastKAN classification layer. A nonlinear transformation is performed on the final feature output based on a learnable activation function and a Gaussian radial basis function. The output of the nonlinear transformation is normalized using a Sigmoid activation function. Based on the normalized probability values, phishing detection results are generated, and a preset confidence threshold is used to assign a confidence level to the phishing detection results. The phishing detection results include: benign and phishing; the confidence levels include: high confidence and low confidence.

[0029] Furthermore, the method for training a customized deceptive phishing detection model using a multi-branch semi-supervised ensemble distillation learning strategy is as follows:

[0030] Based on a customized deceptive phishing detection model, a three-branch teacher model is constructed, including: a domain branch, a path branch, and a parameter branch; wherein the domain branch is configured to perform feature analysis and prediction on the domain part of the URL data; the path branch is configured to perform feature analysis and prediction on the path part of the URL data; and the parameter branch is configured to perform feature analysis and prediction on the query parameter part of the URL data.

[0031] Based on the URL data sample set, a multi-branch semi-supervised training strategy was used to iteratively train the three-branch teacher model to obtain a well-trained three-branch teacher model.

[0032] Based on the trained three-branch teacher model and URL data sample set, a staged knowledge distillation strategy is used to train the customized deceptive phishing detection model, resulting in a trained customized deceptive phishing detection model.

[0033] Furthermore, the specific content of iteratively training the three-branch teacher model using a multi-branch semi-supervised training strategy is as follows:

[0034] Initialize an EMA teacher model with structural parameters completely identical to the three-branch teacher model;

[0035] We perform weak and strong enhancement on the URL data in the unlabeled data pool to obtain weakly enhanced data and strongly enhanced data.

[0036] During each round of iterative training, weakly augmented data is input into the EMA teacher model for pseudo-label prediction, resulting in the predicted probability distribution of the weakly augmented data.

[0037] Determine the category learning progress of the fishing detection results, and calculate an adaptive threshold for each category of the fishing detection results based on the category learning progress;

[0038] Weakly augmented data with predicted probability distributions higher than an adaptive threshold are filtered out, and the corresponding strongly augmented data is obtained.

[0039] The customized deceptive phishing detection model was trained unsupervised using the aforementioned strongly enhanced data, and the unsupervised loss was calculated.

[0040] A customized deceptive phishing detection model is trained in a supervised manner using URL data from a labeled data pool, and the supervised loss is calculated.

[0041] The semi-supervised total loss of the customized deceptive phishing detection model is calculated by weighted summation of unsupervised and supervised losses, and the model parameters of the customized deceptive phishing detection model are updated by backpropagation algorithm.

[0042] Based on the EMA mechanism, the model parameters of the EMA teacher model are updated using the updated model parameters of the customized deceptive phishing detection model.

[0043] Training is complete when the total semi-supervised loss is minimized, and the EMA teacher model obtained in the last round is used as the trained three-branch teacher model.

[0044] Furthermore, the methods for weakly and strongly enhancing the URL data in the unlabeled data pool are as follows:

[0045] In the domain branch, weak enhancement data is obtained by replacing the top-level domain with the URL data in the unlabeled data pool; strong enhancement data is obtained by using the main domain adversarial generation method to enhance the URL data in the unlabeled data pool.

[0046] Within the path branches, weakly enhanced data is obtained by performing path swapping or replacement on the URL data in the unlabeled data pool; strongly enhanced data is obtained by adding interfering path fragments to perform URL data in the unlabeled data pool.

[0047] In the parameter branch, weakly enhanced data is obtained by adding harmless parameters or fragments to the URL data in the unlabeled data pool; strongly enhanced data is obtained by adding malicious parameters or redirect fragments to the URL data in the unlabeled data pool.

[0048] Furthermore, the method for training the customized deceptive phishing detection model using a staged knowledge distillation strategy based on the trained three-branch teacher model and URL data sample set is as follows:

[0049] The customized deceptive phishing detection model is used as a lightweight student model;

[0050] Based on the trained three-branch teacher model, a staged distillation method is used to perform soft-label distillation on the lightweight student model, and the distillation loss is calculated; specifically including:

[0051] First, the domain branch in the trained three-branch teacher model is distilled, while the path and parameter branches in the trained three-branch teacher model are frozen. Weakly augmented data is then input into the domain branch and the lightweight student model respectively, and the loss between the soft label output by the domain branch and the predicted value output by the lightweight student model is calculated. Secondly, the path branches in the trained three-branch teacher model are distilled, while the domain branch and parameter branch in the trained three-branch teacher model are frozen. Weakly augmented data is then input into the path branches and the lightweight student model respectively, and the loss value between the soft labels output by the path branches and the predicted values ​​output by the lightweight student model is calculated. Next, the parameter branch in the trained three-branch teacher model is distilled, while the domain branch and path branch in the trained three-branch teacher model are frozen. Weakly augmented data is then input into the parameter branch and the lightweight student model respectively, and the loss value between the soft label output by the parameter branch and the predicted value output by the lightweight student model is calculated. Finally, by analyzing the loss value , and The distillation loss is obtained by performing a weighted summation.

[0052] We use URL data from a labeled data pool to perform hard-label supervised learning on a customized deceptive phishing detection model and calculate the hard-label supervised loss.

[0053] The total distillation loss of the customized deceptive phishing detection model is calculated using distillation loss and supervised loss. The customized deceptive phishing detection model is then updated using the backpropagation algorithm until the total distillation loss is minimized, thus obtaining the trained customized deceptive phishing detection model.

[0054] Furthermore, when the number of recirculated samples reaches The specific details of periodically updating the customized deceptive phishing detection model using the concept drift detection mechanism are as follows:

[0055] The URL data sample set is used as the historical training dataset, and the set of all return samples is defined as the concept drift dataset.

[0056] Dimensionality reduction is performed on both the historical training dataset and the concept drift dataset to obtain the dimensionality-reduced historical training dataset and the dimensionality-reduced concept drift dataset. The dimensionality reduction method is as follows: for any URL data's URL embedding matrix, extract the URL embedding matrix... <cls>The labeled vectors were extracted using incremental principal component analysis. <cls>The dimensionality of the tag vectors is reduced to obtain the URL feature representation;

[0057] Construct a fixed-length sliding window on the dimensionality-reduced concept drift dataset;

[0058] The method for determining whether concept drift has occurred in the current sliding window is achieved by performing a dual-path joint determination on the current sliding window and the dimensionality-reduced historical training dataset. The dual-path joint determination method includes: Path 1: Using the Kolmogorov-Smirnov test, a dimension-wise nonparametric test is performed on the current sliding window and the dimensionality-reduced historical training dataset to obtain a significance score. Path 2: Use the Kruskal-Wallis H test to perform an overall rank test on the current sliding window and the reduced-dimensional historical training dataset to obtain a significance score. Fisher's method was used to fuse significance scores. and The overall significance score is obtained. ,like If the value is less than the significance threshold, then conceptual drift is considered to have occurred; otherwise, conceptual drift is not considered to have occurred.

[0059] If no concept drift occurs, there is no need to update the customized deceptive phishing detection model; if concept drift occurs, updates should be based on the comprehensive significance score. A dynamic response strategy based on the degree of performance degradation is adopted to update the customized deceptive phishing detection model, specifically including:

[0060] when At the same time, the customized deceptive phishing detection model is locally fine-tuned, and the fastKAN classification layer in the feature fusion and classification module and the linear layer in the global dependency modeling module are updated;

[0061] when In this process, a customized deceptive phishing detection model is semi-supervised and trained using high-confidence unlabeled samples to achieve incremental updates. The high-confidence unlabeled samples are defined as follows: weakly augmented and strongly augmented data corresponding to any URL in the unlabeled data pool are input into the current customized deceptive phishing detection model. If the two prediction results satisfy a preset stability condition, the URL is considered a stable sample. If the stable sample is the most recent... If the variance of the predicted probability in a training round is lower than a preset threshold, the stable sample is considered a high-confidence unlabeled sample.

[0062] when At that time, the URL data sample set is updated using the reflux samples, and based on the updated URL data sample set, a multi-branch semi-supervised ensemble distillation learning strategy is used to train the current customized deceptive phishing detection model, thereby completing the update of the current customized deceptive phishing detection model.

[0063] On the other hand, this invention proposes a detection system for customized deceptive phishing websites for mobile terminals. The system includes a cloud training and update chain for bidirectional data interaction and a mobile terminal inference and feedback chain.

[0064] The cloud-based training and update chain includes:

[0065] The data preprocessing module is used to collect URL data and perform data preprocessing, thereby constructing a URL data sample set;

[0066] The detection model training module is used to build a customized deceptive phishing detection model, and trains the customized deceptive phishing detection model based on the URL data sample set using a multi-branch semi-supervised ensemble distillation learning strategy.

[0067] The detection model compression module is used to compress customized deceptive phishing detection models and then distribute them to the mobile terminal inference and backflow chain;

[0068] The detection model adaptive update module is used to update the model when the number of returned samples reaches a certain threshold. At the same time, based on the concept drift detection mechanism, the customized deceptive phishing detection model is updated regularly;

[0069] The mobile terminal inference and backflow chain includes:

[0070] The data processing module is used to segment the real-time acquired URL data to be detected using a combination of word segmentation and structural embedding representation method, perform structural tagging, generate a sequence of word segmentation structure pairs, and then obtain the URL embedding matrix.

[0071] The real-time detection module is used to perform real-time detection on the URL embedding matrix using the distributed customized deceptive phishing detection model, obtain the phishing detection results of the URL data to be detected, and assign a confidence level to the phishing detection results using a preset confidence threshold.

[0072] The sample feedback module determines whether the phishing detection result is suspicious based on the confidence level, and sends the URL data to be detected corresponding to the suspicious phishing detection result as a feedback sample to the detection model adaptive update module.

[0073] The beneficial effects of adopting the above technical solution are as follows:

[0074] This invention, through innovative designs in URL representation methods, detection model structure, training strategies, model lightweighting, and concept drift adaptive mechanisms, constructs a customized deceptive phishing website detection system and method for mobile terminal deployment, forming a complete technology chain from data collection and model training to inference deployment and closed-loop updates. The specific analysis is as follows:

[0075] This invention proposes a "segmentation-structure" combined embedding representation method, which achieves simultaneous capture of the semantic and structural features of URLs. The combined embedding representation method decomposes the URL into sub-word units and binds them to structural attributes such as their protocol, domain name, path, query, and fragment, forming unified "segmentation-structure" pairs, which are then mapped to unified embedding vectors. This method captures both semantic features and corresponding structural attributes at the URL level, significantly enhancing the URL's representation capabilities. Especially when dealing with complex phishing attacks constructed by attackers using domain name transformation, path spoofing, and parameter manipulation, it demonstrates superior discriminative ability compared to traditional methods.

[0076] This invention presents a method and system for constructing a customized deceptive phishing detection model. This model employs a multi-channel hybrid neural network. Its local branches utilize a multi-scale one-dimensional convolutional neural network combined with soft pooling to extract short-range dependencies and fine-grained local features from URLs. The global branches introduce rotational position encoding and self-attention mechanisms to model long-range dependencies and overall relationships between URL structural components such as protocols, domains, and paths. Residual connections fuse local and global features through skip structures, maintaining stable gradient propagation and ultimately achieving high-precision phishing detection. Against sophisticated attacker camouflage (such as domain obfuscation, path forgery, and parameter spoofing), this model balances accuracy and robustness in customized deceptive phishing URL detection tasks, exhibiting stronger recognition and generalization capabilities, and effectively resisting diverse camouflage techniques employed by attackers.

[0077] This invention proposes a multi-branch semi-supervised ensemble distillation learning strategy to address the dual challenges of extreme class imbalance and limited computing power on mobile devices in real-world detection scenarios, maintaining the adaptive capability and lightweight deployment of the detection model. The strategy constructs data augmentation and pseudo-label selection mechanisms across three branches: domain name, path, and parameters. By introducing a class-adaptive pseudo-label selection mechanism and a Focal Loss function, high-confidence samples are selected from a large number of unlabeled samples for training, effectively alleviating the problems of imbalanced positive and negative sample ratios and insufficient labeled data, and continuously absorbing unlabeled samples for training. Based on this, a staged multi-teacher ensemble distillation method is used to progressively transfer the knowledge of the three branch teacher models to the lightweight student model, ensuring accuracy while reducing model weight, achieving a balance between detection precision and model compression. This strategy significantly reduces the number of parameters and computational overhead while maintaining detection performance, enabling the student model to achieve low-latency, low-power real-time detection on mobile devices.

[0078] This invention proposes a concept drift detection algorithm based on dual-path fusion statistics and an adaptive incremental learning mechanism. The dual-path fusion statistical algorithm effectively identifies dynamic changes in data distribution. Once data drift is detected, the system triggers local fine-tuning, incremental updates, or proactive annotation strategies, ensuring the model continuously updates as attack patterns evolve, thus guaranteeing long-term detection stability. This mechanism achieves a collaborative learning closed loop between the cloud and mobile terminals, ensuring the detection system maintains high accuracy and robustness throughout long-term operation. Attached Figure Description

[0079] Figure 1 This is a flowchart of the detection method for customized deceptive phishing websites for mobile terminals in this embodiment;

[0080] Figure 2 This is a schematic diagram illustrating the working principle of the detection method for customized deceptive phishing websites for mobile terminals in this embodiment.

[0081] Figure 3 This is a structural diagram of the customized deceptive phishing detection model in this embodiment;

[0082] Figure 4 This is a schematic diagram illustrating the principle of the multi-branch semi-supervised ensemble distillation learning strategy in this embodiment;

[0083] Figure 5 This is a structural diagram of the detection system for customized deceptive phishing websites for mobile terminals in this embodiment. Detailed Implementation

[0084] To facilitate understanding of this application, specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and embodiments. The following embodiments are illustrative of the invention but are not intended to limit its scope. Rather, these embodiments are provided to provide a more thorough and complete understanding of the disclosure of this application.

[0085] Example 1:

[0086] This embodiment provides a method for detecting customized deceptive phishing websites for mobile terminals, such as... Figure 1 and Figure 2 As shown, the method includes the following steps:

[0087] The method of combining word segmentation and structure embedding is used to segment the real-time acquired URL data to be detected and perform structure marking to generate a sequence of word segmentation structure pairs, thereby obtaining the URL embedding matrix.

[0088] In this embodiment, the obtained URL embedding matrix captures local semantic information while explicitly preserving the structural attributes of the URL, significantly improving the URL feature representation capability.

[0089] The method employs a combination of word segmentation and structural embedding representation to segment the real-time acquired URL data to be detected and performs structural tagging to generate a sequence of word segmentation structure pairs, thereby obtaining the specific content of the URL embedding matrix:

[0090] The URL data to be detected is normalized to generate a URL string.

[0091] In this embodiment, character normalization includes: case unification, Unicode homograph mapping, and removal of control characters.

[0092] The URL string is segmented using a sub-word segmenter to generate several word units.

[0093] The sub-word segmenter adopts a strategy based on a combination of byte pair encoding and regular expression rules. The strategy is as follows: the input URL string is parsed into a candidate character sequence using predefined regular expression rules; a byte pair encoding algorithm is used to build a vocabulary, and the candidate character sequence is segmented according to the vocabulary to obtain several segmentation units.

[0094] In this embodiment, the word segmenter adopts a strategy based on a combination of Byte Pair Encoding (BPE) and regular expression rules. This strategy can maintain the integrity of common substrings such as "https: / / ", ".com", and "login" while segmenting rare or confusing substrings such as "g00gle" and "paypa1" into finer-grained word units. Taking "https: / / comtigosas.com / wp-includes / Text / ?#aaaa@example.jp" as an example, after word segmentation, it becomes "https: / / ", "com", ..., ".com", " / wp-", ..., " / Text", " / ?", "#aaaa", ..., ".jp".

[0095] Based on predefined URL structure attributes, add structure attribute symbols to each word segmentation unit to generate a sequence of word segmentation structure pairs.

[0096] In this embodiment, the predefined URL structure attributes include: protocol S, top-level domain TD, main domain MD, subdomain SD, first-level path FP, second-level and above paths SP, query parameter name QN, query value QV, and fragment F. Furthermore, the word segments at the boundaries of each structure may have two structure attribute symbols, such as domain name and path DP, path and query PQ, etc. Finally, each word segment is appended with its corresponding structure attribute symbol to form a word segmentation structure pair. For example: (https: / / ,S), (com,MD), ..., (.com,TD), ( / wp-,FP), ..., ( / Text,SP), ( / ?,PQ), (#aaaa,F) ..., (.jp,F).

[0097] The FastText embedding model, based on word combination, is used to transform word segmentation pairs in the word segmentation structure pair sequence into embedding vectors and generate a URL embedding matrix.

[0098] In this embodiment, the existing word combination-based embedding model FastText is used to convert these "word segmentation-structure" pairs into embedding vectors, forming a URL embedding matrix. , ,in For the number of word segments, As an embedded dimension, in this embodiment The value is 256. This embedding model significantly improves the vector representation ability of out-of-vocabulary words such as spelling errors and random character sequences in URLs by learning and sharing sub-word information, thereby enhancing the model's generalization and robustness.

[0099] Construct a URL data sample set and a customized deceptive phishing detection model, and train the customized deceptive phishing detection model.

[0100] The specific content of constructing a URL data sample set and a customized deceptive phishing detection model, and training the customized deceptive phishing detection model is as follows:

[0101] Collect URL data from several different data sources, and divide all collected URL data into a labeled data pool and an unlabeled data pool based on whether the collected URL data has tags.

[0102] In this embodiment, different data sources include publicly available phishing website blacklist databases such as PhishTank, browser blocking logs, user reports from mobile security applications, and whitelists of legitimate websites. Data source integration is achieved by constructing labeled and unlabeled data pools, thereby ensuring the diversity of training data and covering different types of phishing patterns and characteristics of legitimate websites. The labels on the URL data are obtained through manual or semi-automatic annotation.

[0103] The URL data in the labeled data pool and the unlabeled data pool are preprocessed separately, and the preprocessed data is used to construct a URL data sample set. The data preprocessing includes: cleaning the URL data, segmenting the cleaned URL data using a word segmentation and structure combination embedding representation method and performing structure marking, generating a word segmentation structure pair sequence, and then obtaining the URL embedding matrix.

[0104] The data cleaning process includes: removing duplicate, invalid, or malformed URL data; storing URL data by time window and retaining the timestamps and data sources of the URL data; treating the marked URL data in the interception logs and user report records as key samples, and manually reviewing and labeling the key samples with confidence levels.

[0105] In this embodiment, the URL data in the labeled data pool and the unlabeled data pool are cleaned and normalized to ensure data quality and timeliness, providing a foundation for subsequent concept drift detection and incremental learning. Specifically, this includes: (1) removing duplicate, invalid, or incorrectly formatted URL data; (2) storing samples by time window (e.g., daily / weekly), retaining timestamps and sources; (3) manually reviewing and labeling the confidence level of key samples (e.g., high-risk URL data marked in interception logs or uncertain URL data marked in user report records), verifying whether the labels of labeled data are correct, or marking some unlabeled data.

[0106] Build a customized deceptive phishing detection model.

[0107] The customized deceptive phishing detection model includes: a multi-channel local feature extraction module, a global dependency modeling module, and a feature fusion and classification module.

[0108] In this embodiment, as Figure 3 As shown, the customized deceptive phishing detection model consists of three parts: local feature extraction, global dependency modeling, and classification result output.

[0109] The multi-channel local feature extraction module uses several parallel one-dimensional convolutional channels to extract local features from the input URL embedding matrix. The local feature maps output from all one-dimensional convolutional channels are then concatenated into a stitching layer to output a multi-scale local feature representation. Each one-dimensional convolutional channel consists of a one-dimensional convolutional layer, an ELU activation function, and a soft pooling layer connected in series, and the kernel size of the one-dimensional convolutional layer in each one-dimensional convolutional channel is different.

[0110] In this embodiment, the URL is embedded in a matrix. In the multi-channel local feature extraction module, the input features pass through three one-dimensional convolutional layers with kernel sizes of 1×1, 1×3, and 1×5, respectively, to extract local features at different scales. Multi-scale convolution captures obfuscation patterns of varying granularity, enhancing the model's ability to perceive camouflaged local features. An ELU activation function is applied after each one-dimensional convolutional layer to enhance non-linear expressiveness and alleviate the gradient vanishing problem. Subsequently, soft pooling layers replace traditional max pooling or average pooling, compressing the feature map while highlighting important information. The output three-channel local feature maps are then concatenated to form a multi-scale local feature representation. The process is formalized as follows: ;in This represents one-dimensional convolution processing; This represents the ELU activation function; Indicates a soft pooling layer; This indicates splicing / merging.

[0111] The global dependency modeling module projects the URL embedding matrix using three independent linear projection layers, generating a query matrix tensor, a key matrix tensor, and a value matrix tensor, and then partitions each matrix tensor into... One point of attention.

[0112] In this embodiment, the URL is embedded in a matrix. The input is fed into three independent linear projection layers to generate the query matrix. Key matrix Sum-value matrix tensors, and partition each matrix into There are 1 attention head, each with a dimension of 1. ,Require Can be Divisibility; formalize the above process as .in and For query matrix The corresponding weight parameters and bias parameters; and Key matrix The corresponding weight parameters and bias parameters.

[0113] Rotational position encoding is applied to the query matrix tensor and key matrix tensor in each attention head to generate query matrix tensors and key matrix tensors with injected position information.

[0114] To enable the model to perceive the absolute position and relative distance of each word in the URL, this embodiment... and Rotary Position Embedding (RoPE) is applied. RoPE is not directly mapped to words. Instead of adding position vectors, position information is encoded in complex space through rotation. and Value matrix The corresponding weight parameters and bias parameters.

[0115] The attention weights of the scaled dot product attention are calculated using the query matrix tensor and the key matrix tensor with the injected location information, and the output sequence is generated by multiplying the attention weights with the value matrix tensor.

[0116] Then, a linear layer is used to project the output sequence to generate a global dependency information representation.

[0117] In this embodiment, the injected location information and Calculate the scaled dot product attention to obtain the attention weights. And apply this weight to The output sequence is obtained. Finally, it is returned to the linear projection. Dimension, to obtain a global dependency information representation ;in and These are the weight and bias parameters corresponding to the linear projection layer. The global dependency modeling module implements long-range dependency modeling and precise location awareness, effectively capturing cross-domain and parameter association features and structural fraud patterns such as path traversal.

[0118] The feature fusion and classification module fuses multi-scale local feature representations and global dependency information representations, and performs a residual connection between the fused comprehensive feature representation and the URL embedding matrix. Then, by performing layer normalization on the output of the residual connection, the final feature output is obtained and input into the FastKAN classification layer. A nonlinear transformation is performed on the final feature output based on a learnable activation function and a Gaussian radial basis function. The output of the nonlinear transformation is normalized using a Sigmoid activation function. Based on the normalized probability values, phishing detection results are generated, and a preset confidence threshold is used to assign a confidence level to the phishing detection results. The phishing detection results include: benign and phishing; the confidence levels include: high confidence and low confidence.

[0119] In this embodiment, multi-scale local features are represented. Representation of global dependency information Merge and combine with the URL embedding matrix of the original input. Perform residual connections, and then obtain the final feature output through layer normalization. The data is then fed into the fastKAN classification layer. The fastKAN classification layer, an improved Kolmogorov-Arnold network (KAN), achieves efficient non-linear feature transformation through learnable activation functions and Gaussian radial basis functions, and utilizes CUDA for accelerated inference; finally, the classification result is output through a Sigmoid activation function. The process is formalized as follows: It should be noted that the classification results output here... It is itself a probability value, when When the confidence level exceeds 0.5, the corresponding phishing detection result is considered phishing; conversely, the corresponding phishing detection result is considered benign. Furthermore, a preset confidence threshold is used to assign a confidence level to the phishing detection result. If the phishing detection result is considered phishing, the low confidence range is... If the phishing detection result is benign, then the low confidence interval is... The feature fusion and classification module improves the nonlinear modeling capability and inference speed of classification, enabling fast and high-precision detection.

[0120] Based on the URL data sample set, a customized deceptive phishing detection model is trained using a multi-branch semi-supervised ensemble distillation learning strategy, resulting in a well-trained customized deceptive phishing detection model.

[0121] This embodiment designs a multi-branch semi-supervised learning strategy to address the problems of extreme class imbalance, insufficient labels, and mobile terminal deployment in real-world network environments. The strategy process is as follows: Figure 4 As shown, the process includes data augmentation, pseudo-label generation, and unlabeled data filtering. Multi-branch ensemble distillation aims to balance accuracy and lightweight design, addressing the constraints of mobile devices.

[0122] The method for training a customized deceptive phishing detection model using a multi-branch semi-supervised ensemble distillation learning strategy is as follows:

[0123] Based on a customized deceptive phishing detection model, a three-branch teacher model is constructed, including: a domain branch, a path branch, and a parameter branch; wherein the domain branch is configured to perform feature analysis and prediction on the domain part of the URL data; the path branch is configured to perform feature analysis and prediction on the path part of the URL data; and the parameter branch is configured to perform feature analysis and prediction on the query parameter part of the URL data.

[0124] In this embodiment, three training branches were constructed for the main structure of the URL: domain name, path, and parameters (including queries and fragments).

[0125] Based on the URL data sample set, a multi-branch semi-supervised training strategy is used to iteratively train the three-branch teacher model to obtain a well-trained three-branch teacher model.

[0126] The specific content of iteratively training the three-branch teacher model using a multi-branch semi-supervised training strategy is as follows:

[0127] Initialize an EMA teacher model with structural parameters identical to the three-branch teacher model.

[0128] Weak and strong enhancements are performed on the URL data in the unlabeled data pool to obtain weakly enhanced data and strongly enhanced data.

[0129] In this embodiment, weak and strong augmentations are applied to the unlabeled data in each branch. Weak augmentation keeps the URL body information unchanged, enhancing robustness while preserving the semantics of the labels; strong augmentation significantly perturbs the URL structure, simulating different levels of phishing attack patterns to improve the model's generalization ability to complex masquerades.

[0130] The methods for weak and strong enhancement of URL data in the untagged data pool are as follows:

[0131] In the domain branch, weak enhancement is performed on the URL data in the unlabeled data pool by replacing the top-level domain, resulting in weakly enhanced data; strong enhancement is performed on the URL data in the unlabeled data pool by using the main domain adversarial generation method, resulting in strongly enhanced data.

[0132] In this embodiment, the abuse rate of top-level domains is statistically analyzed based on a proprietary phishing website database and publicly available threat intelligence platforms. For example, ".gov" and ".edu" have extremely low abuse rates (<0.1%), classifying them as high-trust; ".com", ".org", and ".cn" have relatively low abuse rates (<1%), classifying them as low-risk; and ".xyz", ".top", and ".cc" have very high abuse rates (5%~20%), classifying them as high-risk. Top-level domains are then replaced within each group based on their abuse rate to obtain weakly enhanced data. Strongly enhanced data is obtained by replacing homonymous characters and adjacent keyboard characters in the real brand domain name with the main domain or subdomain, creating domains like "ta0ba0.com" and "taobao.com-login.com".

[0133] Within the path branches, weakly enhanced data is obtained by performing path swapping or replacement on the URL data in the unlabeled data pool; strongly enhanced data is obtained by adding interfering path fragments on the URL data in the unlabeled data pool.

[0134] In this embodiment, if the path depth is deep, the order of the deeper paths is swapped, such as exchanging third-level and fourth-level paths; if the path depth is shallow, path names of the same sensitivity are replaced, such as "login" and "account", "info" and "news", etc., to obtain weakly enhanced data. By adding commonly used phishing paths to each URL, such as the fake login page " / home / account / " and the management backend " / administrator / login / ", strongly enhanced data is obtained.

[0135] In the parameter branch, weakly enhanced data is obtained by adding harmless parameters or fragments to the URL data in the unlabeled data pool; strongly enhanced data is obtained by adding malicious parameters or redirect fragments to the URL data in the unlabeled data pool.

[0136] In this embodiment, weakly enhanced data is obtained by concatenating and adding some non-destructive parameters, such as price ascending order "?sort=price_asc" and displaying the second page of results "?page=2"; replacing or adding non-sensitive information fragments, such as "#chapter-2" and "#section-1". Various malicious behaviors, such as SQL injection "?name=admin;DROP TABLEusers; --", redirection "?redirect=https: / / phshing.com", etc., and malicious or sensitive information fragments, such as "#", are then introduced. <script>alert('DOM XSS')< / script> The data obtained includes characters such as "#login", "#security", etc.

[0137] During each round of iterative training, weakly augmented data is input into the EMA teacher model for pseudo-label prediction, resulting in the predicted probability distribution of the weakly augmented data.

[0138] Determine the category learning progress of the phishing detection results, and calculate an adaptive threshold for each category of the phishing detection results based on the category learning progress.

[0139] In this embodiment, high-quality pseudo-labels are filtered using category learning progress and an adaptive threshold. Specifically, an asymmetric adaptive threshold is set. The initial values ​​are 0.35 for the minority class and 0.95 for the majority class. Define the class learning progress. The number of samples whose confidence level is higher than a class threshold is used to represent the model's confidence level with respect to the class. The degree of mastery is expressed as:

[0140]

[0141] in Indicates category In the The progress of category learning in each round of iterative training; This represents the weakly augmented unlabeled dataset; This indicates weakly augmented data; This is an indicator function that returns 1 if the condition is met, and 0 otherwise. This indicates that the weakly augmented data u belongs to the category. The probability of the prediction, i.e., the prediction probability distribution of weakly augmented data; Indicates the first An adaptive threshold is applied during iterative training. The adaptive threshold for each category is updated based on the learning progress of each category. If the category learning progress is high (the model's predictions are accurate), the adaptive threshold is high; conversely, the adaptive threshold is low, allowing more low-confidence pseudo-labels to participate in training. The formula for calculating the adaptive threshold is as follows:

[0142]

[0143] in Indicates the first Adaptive threshold for round-by-round iterative training; Indicates all categories in the first The maximum class learning progress during each round of iterative training. After adaptive threshold adjustment, high-quality pseudo-labels are selected, i.e., data with predicted class probabilities greater than the threshold are considered reliable. The corresponding strongly augmented data is then used for model training, and the loss function between the model's predictions on the strongly augmented data and the pseudo-labels is calculated.

[0144] Weakly augmented data with predicted probability distributions higher than an adaptive threshold are filtered out, and the corresponding strongly augmented data is obtained.

[0145] The customized deceptive phishing detection model is trained unsupervised using the enhanced data, and the unsupervised loss is calculated.

[0146] In this embodiment, Focal Loss is used for unsupervised learning. By reducing the weight of easily classified samples, the learning effect on difficult-to-classify categories is enhanced. The calculation formula is as follows:

[0147]

[0148]

[0149] in For unsupervised loss functions; This indicates the predicted value obtained after inputting strongly enhanced data into a customized deceptive phishing detection model, and ; This represents the pseudo-label corresponding to the strongly augmented data, i.e., the predicted probability distribution of the EMA teacher model for the corresponding weakly augmented data, and... ; express and The closer the similarity, the more accurate the classification. The closer to 1; As a balance factor; It is a regulating factor.

[0150] We use URL data from a labeled data pool to conduct supervised training on a customized deceptive phishing detection model and calculate the supervised loss.

[0151] In this embodiment, the supervised loss is cross-entropy.

[0152] The semi-supervised total loss of the customized deceptive phishing detection model is calculated by weighted summation of the unsupervised and supervised losses, and the model parameters of the customized deceptive phishing detection model are updated by backpropagation algorithm.

[0153] In this embodiment, the loss function for the semi-supervised total loss is designed as follows:

[0154]

[0155] in Total loss under semi-supervision; Losses due to lack of oversight; This represents the weights of the unsupervised loss. Backpropagation is performed based on this loss function to update the model parameters.

[0156] Based on the EMA mechanism, the model parameters of the EMA teacher model are updated using the updated model parameters of the customized deceptive phishing detection model.

[0157] In this embodiment, the EMA teacher model is obtained by calculating the exponential moving average of the student model parameters, and its parameter update formula is as follows:

[0158]

[0159] in For the EMA teacher model in the Model parameters during rounds of iterative training; For smoothing coefficients; For the EMA teacher model in the Model parameters during rounds of iterative training; For the student model in the first The model parameters in the round of iterative training; in this embodiment, the student model refers to a customized deceptive phishing detection model.

[0160] Training is complete when the total semi-supervised loss is minimized, and the EMA teacher model obtained in the last round is used as the trained three-branch teacher model.

[0161] In this embodiment, the multi-branch semi-supervised training strategy alleviates the problem of extreme imbalance in URL categories and improves minority class detection capabilities. This strategy ultimately trains sub-models for three dimensions: domain name, path, and parameters, providing a foundation for subsequent knowledge distillation and model fusion.

[0162] Based on the trained three-branch teacher model and URL data sample set, a staged knowledge distillation strategy is used to train the customized deceptive phishing detection model, resulting in a trained customized deceptive phishing detection model.

[0163] In this embodiment, the staged knowledge distillation strategy maintains detection accuracy while significantly reducing model size and inference overhead, making it suitable for real-time deployment on mobile terminals.

[0164] The method for training the customized deceptive phishing detection model based on the pre-trained three-branch teacher model and URL data sample set, using a staged knowledge distillation strategy, is as follows:

[0165] The customized deceptive phishing detection model is used as a lightweight student model.

[0166] Based on the trained three-branch teacher model, a staged distillation method is used to perform soft-label distillation on the lightweight student model, and the distillation loss is calculated; specifically including:

[0167] First, the domain branch in the trained three-branch teacher model is distilled, while the path and parameter branches in the trained three-branch teacher model are frozen. Weakly augmented data is then input into the domain branch and the lightweight student model respectively, and the loss between the soft label output by the domain branch and the predicted value output by the lightweight student model is calculated. Secondly, the path branches in the trained three-branch teacher model are distilled, while the domain branch and parameter branch in the trained three-branch teacher model are frozen. Weakly augmented data is then input into the path branches and the lightweight student model respectively, and the loss value between the soft labels output by the path branches and the predicted values ​​output by the lightweight student model is calculated. Next, the parameter branch in the trained three-branch teacher model is distilled, while the domain branch and path branch in the trained three-branch teacher model are frozen. Weakly augmented data is then input into the parameter branch and the lightweight student model respectively, and the loss value between the soft label output by the parameter branch and the predicted value output by the lightweight student model is calculated. Finally, by analyzing the loss value , and We perform a weighted summation to obtain the distillation loss.

[0168] In this embodiment, the predicted probability distribution of the trained three-branch teacher model on different branches is passed to the customized deceptive phishing detection model. A staged distillation method is adopted, that is, first distill the domain branch, then the path branch, and finally the parameter branch. Then, by weighted fusion of the distillation results of the three branches, knowledge fusion from local to global is achieved.

[0169] We use URL data from a labeled data pool to perform hard-label supervised learning on a customized deceptive phishing detection model and calculate the hard-label supervised loss.

[0170] The total distillation loss of the customized deceptive phishing detection model is calculated using distillation loss and supervised loss. The customized deceptive phishing detection model is then updated using the backpropagation algorithm until the total distillation loss is minimized, thus obtaining the trained customized deceptive phishing detection model.

[0171] The total distillation loss is:

[0172]

[0173] in This represents the total loss during distillation. For hard label supervision loss; Branch indexes for domain branches, path branches, and parameter branches; Indicates the first The distillation weights associated with each branch, and ; Indicates the first Distillation loss in each branch is reduced. This ensures that the student model maintains high detection accuracy even under the compressed, lightweight structure.

[0174] A customized deceptive phishing detection model is used to perform real-time detection on the URL embedding matrix to obtain phishing detection results for the URL data to be detected.

[0175] Based on the confidence level, it is determined whether the phishing detection result is suspicious, and the URL data to be detected corresponding to the suspicious phishing detection result is used as a return sample.

[0176] In this embodiment, phishing detection results with a low confidence level are considered suspicious phishing detection results.

[0177] When the number of refluxed samples reaches At the same time, the concept drift detection mechanism is used to regularly update the customized deceptive phishing detection model.

[0178] This embodiment designs a concept drift detection mechanism, which employs a drift detection algorithm based on dual-path fusion statistics and integrates it with a customized deceptive phishing detection model. The concept drift detection and incremental learning mechanism enable continuous response to changes in the network environment, ultimately enhancing the long-term stability of the system while maintaining high accuracy. This concept drift detection mechanism does not rely on distribution assumptions and can detect dynamic changes in data distribution, ensuring the long-term stability of the detection results.

[0179] When the number of reflow samples reaches The specific details of periodically updating the customized deceptive phishing detection model using the concept drift detection mechanism are as follows:

[0180] The URL data sample set is used as the historical training dataset, and the set of all return samples is defined as the concept drift dataset.

[0181] Dimensionality reduction is performed on both the historical training dataset and the concept drift dataset to obtain the dimensionality-reduced historical training dataset and the dimensionality-reduced concept drift dataset. The dimensionality reduction method is as follows: for any URL data's URL embedding matrix, extract the URL embedding matrix... <cls>The labeled vectors were extracted using incremental principal component analysis. <cls>The dimensionality of the tag vector is reduced to obtain the URL feature representation.

[0182] In this embodiment, the entire URL embedding matrix is ​​extracted and encapsulated. <cls>Label the vectors and use incremental principal component analysis (IPCA) to... <cls>The dimensionality of the tag vector is reduced to obtain a low-dimensional but representative URL feature representation.

[0183] Construct a fixed-length sliding window on the dimensionality-reduced concept drift dataset.

[0184] In this embodiment, the length of the sliding window is 800, that is, each sliding window contains 800 URL feature representations, and sliding window detection is performed on the historical training dataset.

[0185] The method for determining whether concept drift has occurred in the current sliding window is achieved by performing a dual-path joint determination on the current sliding window and the dimensionality-reduced historical training dataset. The dual-path joint determination method includes: Path 1: Using the Kolmogorov-Smirnov test, a dimension-wise nonparametric test is performed on the current sliding window and the dimensionality-reduced historical training dataset to obtain a significance score. Path 2: Use the Kruskal-Wallis H test to perform an overall rank test on the current sliding window and the reduced-dimensional historical training dataset to obtain a significance score. Fisher's method was used to fuse significance scores. and The overall significance score is obtained. ,like If the value is less than the significance threshold, then conceptual drift is considered to have occurred; otherwise, conceptual drift is not considered to have occurred.

[0186] In this embodiment, path 1 is tested using the Kolmogorov-Smirnov (KS) test for a dimension-wise nonparametric test; path 2 is tested using the Kruskal-Wallis H (KW) test for an overall rank test; both paths can yield a significance score. and This is used to measure whether the two distributions are the same. Fisher's method is used to fuse the results of the two tests to obtain a composite significance score. If the value is less than the significance threshold of 0.05, then concept drift is considered to have occurred; otherwise, it is not. This dual-path joint determination method can avoid the limitations of a single test and more accurately determine whether concept drift has occurred.

[0187] If no concept drift occurs, there is no need to update the customized deceptive phishing detection model; if concept drift occurs, updates should be based on the comprehensive significance score. A dynamic response strategy based on the degree of performance degradation is adopted to update the customized deceptive phishing detection model, specifically including:

[0188] when At the same time, the customized deceptive phishing detection model is locally fine-tuned, and the fastKAN classification layer in the feature fusion and classification module and the linear layer in the global dependency modeling module are updated.

[0189] when In this process, a customized deceptive phishing detection model is semi-supervised and trained using high-confidence unlabeled samples to achieve incremental updates. The high-confidence unlabeled samples are defined as follows: weakly augmented and strongly augmented data corresponding to any URL in the unlabeled data pool are input into the current customized deceptive phishing detection model. If the two prediction results satisfy a preset stability condition, the URL is considered a stable sample. If the stable sample is the most recent... If the variance of the predicted probability in a training round is lower than a preset threshold, then the stable sample is considered a high-confidence unlabeled sample.

[0190] when At that time, the URL data sample set is updated using the reflux samples, and based on the updated URL data sample set, a multi-branch semi-supervised ensemble distillation learning strategy is used to train the current customized deceptive phishing detection model, thereby completing the update of the current customized deceptive phishing detection model.

[0191] This embodiment designs a dynamic response strategy based on the degree of performance degradation, and calculates the comprehensive significance score p. comb The corresponding update strategy will be triggered. The specific strategy is explained below:

[0192] (1) Local fine-tuning: In small-scale drift, i.e. The model rapidly updates some parameters; it only updates the high-level parameters of the model, specifically the classification layer and its adjacent feature fusion layer (linear layers in the global branch), while keeping the parameters of the low-level embedding and convolutional feature extraction layers frozen, so as to adapt to slight distribution changes under low-cost conditions.

[0193] (2) Incremental update: In medium-scale drift, i.e. The system incorporates high-confidence unlabeled samples from the semi-supervised training process. Specifically, it first generates two versions of unlabeled URL samples—one with weak enhancement and one with strong enhancement—and inputs them into the current detection model for prediction. If the two predictions are consistent and the difference in prediction probabilities is less than 0.1 (a stable condition), the sample is considered to have stable predictions. Subsequently, the system performs statistical analysis on the prediction probabilities of the sample in the most recent three training rounds. If the variance is less than 0.05, it is further considered to have high confidence.

[0194] (3) Active labeling: In large-scale drift, i.e. The manual annotation and data feedback are triggered in time, including: (1) continuously monitoring the detection log and user behavior feedback; (2) cleaning and annotating the URL data to be detected corresponding to the newly added samples, i.e., the suspicious phishing detection results (phishing detection results with a low confidence level), and feeding it back to the cloud training pool, thereby updating the URL data sample set through a series of data processing; (3) updating the mobile terminal model after retraining and model compression; thereby realizing the closed loop of online monitoring, feedback and operation and maintenance.

[0195] Through the hierarchical response strategy described above, this embodiment can select the optimal update method according to the distribution changes of different scales, thereby reducing computational and annotation costs while ensuring the long-term efficiency and stability of the detection model.

[0196] In this embodiment, the continuous evolution and optimization of the system are achieved by forming an operation and maintenance closed loop of "detection-feedback-update-redeployment".

[0197] In practical applications, this embodiment can significantly improve the accuracy, robustness, and real-time performance of phishing detection, reduce reliance on computing power and manual labeling, and ensure that the system maintains high efficiency and stability during long-term operation. Specifically:

[0198] (1) The detection accuracy on the publicly available benchmark phishing test dataset reaches over 91%, which is significantly better than existing similar methods;

[0199] (2) The size of the model after lightweight optimization can be controlled to about 25MB, which effectively meets the storage limitations of mobile terminals;

[0200] (3) The inference detection time on mainstream mobile devices is about 0.2 milliseconds / URL, achieving low-latency real-time detection;

[0201] (4) The integrated concept drift monitoring and model update mechanism can automatically trigger model adjustment as the phishing attack strategy evolves, achieving continuous, stable and efficient detection.

[0202] Compared with existing technologies, this embodiment achieves significant improvements in detection accuracy, computational efficiency, and long-term adaptability. For example, the accuracy of traditional character-level embedding-based detection methods is typically around 85%~88%, while this embodiment can improve it to over 91%. In terms of model size, existing deep neural network solutions often exceed 100 MB, making them unsuitable for direct operation on mobile devices, while this embodiment compresses the size to around 25 MB through staged multi-teacher distillation and structure optimization. Regarding inference speed, existing solutions require an average of 1~2 milliseconds per URL, while this embodiment can reduce the latency to 0.2 milliseconds per URL. Furthermore, traditional static models suffer severe performance degradation when attack patterns change, while this embodiment, relying on concept drift detection and incremental learning mechanisms, can achieve dynamic adaptive updates, ensuring long-term stability.

[0203] In summary, this embodiment not only outperforms existing technologies in terms of detection accuracy and robustness, but also achieves lightweight and real-time performance in resource-constrained mobile terminal environments, and ensures long-term stability through a closed-loop adaptive mechanism, demonstrating significant application value and promising prospects for widespread adoption.

[0204] Example 2:

[0205] This embodiment provides a detection system for customized deceptive phishing websites targeting mobile terminals, such as... Figure 5 As shown, the system includes a cloud-based training and update chain for bidirectional data interaction and a mobile terminal inference and feedback chain.

[0206] The cloud-based training and update chain includes:

[0207] The data preprocessing module is used to collect URL data and perform data preprocessing to build a URL data sample set.

[0208] The detection model training module is used to build a customized deceptive phishing detection model. Based on the URL data sample set, it uses a multi-branch semi-supervised ensemble distillation learning strategy to train the customized deceptive phishing detection model.

[0209] The detection model compression module is used to compress customized deceptive phishing detection models and then distribute them to the mobile terminal inference and backflow chain.

[0210] The detection model adaptive update module is used to update the model when the number of returned samples reaches a certain threshold. At the same time, based on the concept drift detection mechanism, the customized deceptive phishing detection model is updated regularly.

[0211] The mobile terminal inference and backflow chain includes:

[0212] The data processing module is used to segment the real-time acquired URL data to be detected using a combination of word segmentation and structural embedding representation method, perform structural tagging, generate a sequence of word segmentation structure pairs, and then obtain the URL embedding matrix.

[0213] The real-time detection module is used to perform real-time detection on the URL embedding matrix using the distributed customized deceptive phishing detection model, obtain the phishing detection results of the URL data to be detected, and assign a confidence level to the phishing detection results using a preset confidence threshold.

[0214] The sample feedback module determines whether the phishing detection result is suspicious based on the confidence level, and sends the URL data to be detected corresponding to the suspicious phishing detection result as a feedback sample to the detection model adaptive update module.

[0215] The overall architecture of this embodiment consists of two links: (1) Cloud training and update chain: including data acquisition, preprocessing, model training, incremental update and model compression; (2) Mobile terminal inference and backflow chain: including real-time detection, suspicious sample backflow and local model update.

[0216] Example 3:

[0217] This embodiment proposes an electronic device, including: one or more processors, and a memory for storing instructions, which, when executed by the one or more processors, cause the one or more processors to perform the detection method for customized deceptive phishing websites for mobile terminals.

[0218] The electronic device may be a mobile phone, computer, or tablet computer, etc., and includes a memory and a processor. The memory stores a computer program, which, when executed by the processor, implements the detection method for customized deceptive phishing websites for mobile terminals as described in the embodiments. It is understood that the electronic device may also include input / output (I / O) interfaces and communication components.

[0219] The processor is used to execute all or part of the steps in the detection method for customized deceptive phishing websites for mobile terminals as described in the above embodiments. The memory is used to store various types of data, which may include, for example, instructions for any application or method in the electronic device, as well as application-related data.

[0220] The processor can be implemented as an Application Specific Integrated Circuit (ASIC), Digital Signal Processor (DSP), Programmable Logic Device (PLD), Field Programmable Gate Array (FPGA), controller, microcontroller, microprocessor, or other electronic components, and is used to execute the detection method for customized deceptive phishing websites for mobile terminals described in the above embodiments.

[0221] Example 4:

[0222] This embodiment proposes a computer-readable storage medium that stores executable instructions. When these instructions are executed, if they are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium.

[0223] The computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the detection method for customized deceptive phishing websites for mobile terminals described in the various embodiments of this application.

[0224] The aforementioned storage media include: flash memory, hard disks, multimedia cards, card-type memory (e.g., SD (Secure Digital Memory Card) or DX (Memory Data Register, MDR) memory), random access memory (RAM), static random-access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic storage, disks, optical discs, servers, APP (Application) app stores, and other media capable of storing program verification codes. These media store computer programs, which, when executed by a processor, can implement the various steps of the aforementioned method for detecting customized deceptive phishing websites for mobile terminals.

[0225] Example 5:

[0226] This embodiment proposes a computer program product, including a computer program or instructions, which, when executed by a processor, implements the aforementioned method for detecting deceptive phishing websites customized for mobile terminals.

[0227] Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or part of the technical solution, can be embodied in the form of a computer program product.

[0228] The various embodiments in this application are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0229] The scope of protection of this application is not limited to the embodiments described above. Obviously, those skilled in the art can make various modifications and variations to this disclosure without departing from the scope and spirit of this disclosure. If such modifications and variations fall within the scope of this disclosure and its equivalents, then the intent of this disclosure also includes these modifications and variations.< / cls> < / cls> < / cls> < / cls> < / cls> < / cls>

Claims

1. A method for detecting customized deceptive phishing websites for mobile terminals, characterized in that, This method includes the following steps: The method of combining word segmentation and structure embedding is used to segment the real-time acquired URL data to be detected and perform structure tagging to generate a sequence of word segmentation structure pairs, thereby obtaining the URL embedding matrix; Construct a URL data sample set and a customized deceptive phishing detection model, and train the customized deceptive phishing detection model; The training of the customized deceptive phishing detection model includes: Based on a customized deceptive phishing detection model, a three-branch teacher model is constructed, including: a domain branch, a path branch, and a parameter branch; wherein the domain branch is configured to perform feature analysis and prediction on the domain part of the URL data; the path branch is configured to perform feature analysis and prediction on the path part of the URL data; and the parameter branch is configured to perform feature analysis and prediction on the query parameter part of the URL data. Based on the URL data sample set, a multi-branch semi-supervised training strategy was used to iteratively train the three-branch teacher model to obtain a well-trained three-branch teacher model. The multi-branch semi-supervised training strategy is as follows: Initialize an EMA teacher model with structural parameters completely identical to the three-branch teacher model; in each branch, perform weak and strong augmentation on the URL data in the unlabeled data pool to obtain weakly augmented data and strongly augmented data; during each round of iterative training, input the weakly augmented data into the EMA teacher model for pseudo-label prediction, and filter out the weakly augmented data whose prediction probability distribution is higher than the adaptive threshold; obtain the strongly augmented data corresponding to the weakly augmented data; use the strongly augmented data to perform unsupervised training on the customized deceptive phishing detection model, use the URL data in the labeled data pool to perform supervised training on the customized deceptive phishing detection model, and update the model parameters of the customized deceptive phishing detection model through the backpropagation algorithm; based on the EMA mechanism, use the updated model parameters of the customized deceptive phishing detection model to update the model parameters of the EMA teacher model, and use the EMA teacher model obtained in the last round of iterative training as the trained three-branch teacher model. The unlabeled data pool contains unlabeled URL data; the labeled data pool contains labeled URL data. Based on the trained three-branch teacher model and URL data sample set, a staged knowledge distillation strategy is used to train the customized deceptive phishing detection model to obtain the trained customized deceptive phishing detection model. The staged knowledge distillation strategy is as follows: A customized deceptive phishing detection model is used as a lightweight student model. The following distillation process is sequentially performed on the domain branch, path branch, and parameter branch of the trained three-branch teacher model: For the branch currently undergoing distillation, the other two branches of the trained three-branch teacher model are frozen. Weak augmentation data is input into this branch and the lightweight student model respectively, and the loss value between the soft label of this branch and the predicted value output by the lightweight student model is calculated. The distillation loss is obtained by weighted summation of the loss values ​​calculated for the domain branch, path branch, and parameter branch. Hard-label supervised learning is performed on the customized deceptive phishing detection model using URL data from the labeled data pool, and the hard-label supervised loss is calculated. The total distillation loss of the customized deceptive phishing detection model is calculated using the distillation loss and supervised loss, and the customized deceptive phishing detection model is updated through backpropagation until the total distillation loss is minimized, resulting in a trained customized deceptive phishing detection model. A customized deceptive phishing detection model is used to perform real-time detection on the URL embedding matrix to obtain the phishing detection results of the URL data to be detected, and a confidence level is assigned to the phishing detection results using a preset confidence threshold. Based on the confidence level, determine whether the phishing detection result is suspicious, and use the URL data to be detected corresponding to the suspicious phishing detection result as a return sample; When the number of refluxed samples reaches At the same time, based on the concept drift detection mechanism, the customized deceptive phishing detection model is updated regularly.

2. The detection method for customized deceptive phishing websites for mobile terminals according to claim 1, characterized in that, The method employs a combination of word segmentation and structural embedding representation to segment the real-time acquired URL data to be detected and performs structural tagging to generate a sequence of word segmentation structure pairs, thereby obtaining the specific content of the URL embedding matrix: The URL data to be detected is normalized to generate a URL string; A sub-word-level segmenter is used to segment the URL string, generating several segmentation units. The sub-word-level segmenter adopts a strategy based on a combination of byte pair encoding and regular expression rules. The strategy is as follows: the input URL string is parsed into candidate character sequences using predefined regular expression rules; a byte pair encoding algorithm is used to build a vocabulary, and the candidate character sequences are segmented according to the vocabulary to obtain several segmentation units. Based on predefined URL structure attributes, add structure attribute symbols to each word segmentation unit to generate a sequence of word segmentation structure pairs; The FastText embedding model, based on word combination, is used to transform word segmentation pairs in the word segmentation structure pair sequence into embedding vectors and generate a URL embedding matrix.

3. The detection method for customized deceptive phishing websites for mobile terminals according to claim 2, characterized in that, The specific content of constructing a URL data sample set and a customized deceptive phishing detection model, and training the customized deceptive phishing detection model is as follows: Collect URL data from several different data sources, and divide all collected URL data into a tagged data pool and an untagged data pool based on whether the collected URL data has tags. The URL data in the labeled data pool and the unlabeled data pool are preprocessed separately, and the preprocessed data is used to construct a URL data sample set. The data preprocessing includes: cleaning the URL data, segmenting the cleaned URL data using a word segmentation and structure combination embedding representation method and marking the structure, generating a word segmentation structure pair sequence, and then obtaining the URL embedding matrix; Build a customized deceptive phishing detection model; Based on the URL data sample set, a customized deceptive phishing detection model is trained using a multi-branch semi-supervised ensemble distillation learning strategy, resulting in a well-trained customized deceptive phishing detection model.

4. The detection method for customized deceptive phishing websites for mobile terminals according to claim 3, characterized in that, The customized deceptive phishing detection model includes: The multi-channel local feature extraction module uses several parallel one-dimensional convolutional channels to extract local features from the input URL embedding matrix. The local feature maps output from all one-dimensional convolutional channels are then concatenated into a stitching layer to output a multi-scale local feature representation. Each one-dimensional convolutional channel consists of a one-dimensional convolutional layer, an ELU activation function, and a soft pooling layer connected in series, and the kernel size of the one-dimensional convolutional layer in each one-dimensional convolutional channel is different. The global dependency modeling module projects the URL embedding matrix using three independent linear projection layers, generating query matrix tensors, key matrix tensors, and value matrix tensors, and then partitions each matrix tensor into... Each attention head is assigned an attention head; rotational position encoding is applied to the query matrix tensor and key matrix tensor in each attention head to generate query matrix tensors and key matrix tensors with injected position information; the attention weights of the scaled dot product attention are calculated using the query matrix tensors and key matrix tensors with injected position information, and the output sequence is generated by multiplying the attention weights with the value matrix tensor; then a linear layer is used to project the output sequence to generate a global dependency information representation. The feature fusion and classification module fuses multi-scale local feature representations and global dependency information representations, and performs a residual connection between the fused comprehensive feature representation and the URL embedding matrix. Then, by performing layer normalization on the output of the residual connection, the final feature output is obtained and input into the FastKAN classification layer. A nonlinear transformation is performed on the final feature output based on a learnable activation function and a Gaussian radial basis function. The output of the nonlinear transformation is normalized using a Sigmoid activation function. Based on the normalized probability values, phishing detection results are generated, and a preset confidence threshold is used to assign a confidence level to the phishing detection results. The phishing detection results include: benign and phishing; the confidence levels include: high confidence and low confidence.

5. The method for detecting customized deceptive phishing websites for mobile terminals according to claim 4, characterized in that, The specific content of iteratively training the three-branch teacher model using a multi-branch semi-supervised training strategy is as follows: Initialize an EMA teacher model with structural parameters completely identical to the three-branch teacher model; We perform weak and strong enhancement on the URL data in the unlabeled data pool to obtain weakly enhanced data and strongly enhanced data. During each round of iterative training, weakly augmented data is input into the EMA teacher model for pseudo-label prediction, resulting in the predicted probability distribution of the weakly augmented data. Determine the category learning progress of the fishing detection results, and calculate an adaptive threshold for each category of the fishing detection results based on the category learning progress; Weakly augmented data with predicted probability distributions higher than an adaptive threshold are filtered out, and the corresponding strongly augmented data is obtained. The customized deceptive phishing detection model was trained unsupervised using the aforementioned strongly enhanced data, and the unsupervised loss was calculated. A customized deceptive phishing detection model is trained in a supervised manner using URL data from a labeled data pool, and the supervised loss is calculated. The semi-supervised total loss of the customized deceptive phishing detection model is calculated by weighted summation of unsupervised and supervised losses, and the model parameters of the customized deceptive phishing detection model are updated by backpropagation algorithm. Based on the EMA mechanism, the model parameters of the EMA teacher model are updated using the updated model parameters of the customized deceptive phishing detection model. Training is complete when the total semi-supervised loss is minimized, and the EMA teacher model obtained in the last round is used as the trained three-branch teacher model.

6. The method for detecting customized deceptive phishing websites for mobile terminals according to claim 5, characterized in that, The methods for weak and strong enhancement of URL data in the unlabeled data pool are as follows: In the domain branch, weak enhancement is performed on the URL data in the unlabeled data pool by replacing the top-level domain to obtain weakly enhanced data. The URL data in the unlabeled data pool is strongly enhanced by using the main domain adversarial generation method to obtain strongly enhanced data. In the path branch, the URL data in the unlabeled data pool is weakly enhanced by the path swapping or replacement method to obtain weakly enhanced data. By adding interfering path fragments, the URL data in the unlabeled data pool is strongly enhanced to obtain strongly enhanced data. In the parameter branch, weakly enhanced data is obtained by adding harmless parameters or fragments to the URL data in the unlabeled data pool. By adding malicious parameters or redirect fragments, the URL data in the unlabeled data pool is strongly enhanced to obtain strongly enhanced data.

7. The method for detecting customized deceptive phishing websites for mobile terminals according to claim 6, characterized in that, The method for training the customized deceptive phishing detection model based on the pre-trained three-branch teacher model and URL data sample set, using a staged knowledge distillation strategy, is as follows: The customized deceptive phishing detection model is used as a lightweight student model; Based on the trained three-branch teacher model, a staged distillation method is used to perform soft-label distillation on the lightweight student model, and the distillation loss is calculated; specifically including: First, the domain branch in the trained three-branch teacher model is distilled, while the path and parameter branches in the trained three-branch teacher model are frozen. Weakly augmented data is then input into the domain branch and the lightweight student model respectively, and the loss between the soft label output by the domain branch and the predicted value output by the lightweight student model is calculated. Secondly, the path branches in the trained three-branch teacher model are distilled, while the domain branch and parameter branch in the trained three-branch teacher model are frozen. Weakly augmented data is then input into the path branches and the lightweight student model respectively, and the loss value between the soft labels output by the path branches and the predicted values ​​output by the lightweight student model is calculated. Next, the parameter branch in the trained three-branch teacher model is distilled, while the domain branch and path branch in the trained three-branch teacher model are frozen. Weakly augmented data is then input into the parameter branch and the lightweight student model respectively, and the loss value between the soft label output by the parameter branch and the predicted value output by the lightweight student model is calculated. Finally, by analyzing the loss value , and The distillation loss is obtained by performing a weighted summation. We use URL data from a labeled data pool to perform hard-label supervised learning on a customized deceptive phishing detection model and calculate the hard-label supervised loss. The total distillation loss of the customized deceptive phishing detection model is calculated using distillation loss and supervised loss. The customized deceptive phishing detection model is then updated using the backpropagation algorithm until the total distillation loss is minimized, thus obtaining the trained customized deceptive phishing detection model.

8. The method for detecting customized deceptive phishing websites for mobile terminals according to claim 7, characterized in that, When the number of reflow samples reaches The specific details of periodically updating the customized deceptive phishing detection model using the concept drift detection mechanism are as follows: The URL data sample set is used as the historical training dataset, and the set of all return samples is defined as the concept drift dataset. Dimensionality reduction is performed on both the historical training dataset and the concept drift dataset to obtain the dimensionality-reduced historical training dataset and the dimensionality-reduced concept drift dataset. The dimensionality reduction method is as follows: for any URL data's URL embedding matrix, extract the URL embedding matrix... <cls>The labeled vectors were extracted using incremental principal component analysis. <cls> The dimensionality of the tag vectors is reduced to obtain the URL feature representation;< / cls> < / cls> Construct a fixed-length sliding window on the dimensionality-reduced concept drift dataset; By performing a dual-path joint determination on the current sliding window and the historical training dataset after dimensionality reduction, it can be determined whether the current sliding window has experienced concept drift. The dual-path joint determination method includes: Path 1: Using the Kolmogorov-Smirnov test, the current sliding window and the dimensionality-reduced historical training dataset are subjected to a dimension-wise nonparametric test to obtain a significance score. Path 2: Use the Kruskal-Wallis H test to perform an overall rank test on the current sliding window and the reduced-dimensional historical training dataset to obtain a significance score. Fisher's method was used to fuse significance scores. and The overall significance score is obtained. ,like If the value is less than the significance threshold, then conceptual drift is considered to have occurred; otherwise, conceptual drift is not considered to have occurred. If no concept drift occurs, there is no need to update the customized deceptive phishing detection model; if concept drift occurs, updates should be based on the comprehensive significance score. A dynamic response strategy based on the degree of performance degradation is adopted to update the customized deceptive phishing detection model, specifically including: when At the same time, the customized deceptive phishing detection model is locally fine-tuned, and the fastKAN classification layer in the feature fusion and classification module and the linear layer in the global dependency modeling module are updated; when In this process, a customized deceptive phishing detection model is semi-supervised and trained using high-confidence unlabeled samples to achieve incremental updates. The high-confidence unlabeled samples are defined as follows: weakly augmented and strongly augmented data corresponding to any URL in the unlabeled data pool are input into the current customized deceptive phishing detection model. If the two prediction results satisfy a preset stability condition, the URL is considered a stable sample. If the stable sample is the most recent... If the variance of the predicted probability in a training round is lower than a preset threshold, the stable sample is considered a high-confidence unlabeled sample. when At that time, the URL data sample set is updated using the returned samples, and based on the updated URL data sample set, a multi-branch semi-supervised ensemble distillation learning strategy is used to train the current customized deceptive phishing detection model, thereby completing the update of the current customized deceptive phishing detection model.

9. A detection system for customized deceptive phishing websites for mobile terminals, used to implement the detection method for customized deceptive phishing websites for mobile terminals as described in any one of claims 1-8, characterized in that, The system includes a cloud-based training and update chain for bidirectional data interaction and a mobile terminal inference and feedback chain; The cloud-based training and update chain includes: The data preprocessing module is used to collect URL data and perform data preprocessing, thereby constructing a URL data sample set; The detection model training module is used to build a customized deceptive phishing detection model, and trains the customized deceptive phishing detection model based on the URL data sample set using a multi-branch semi-supervised ensemble distillation learning strategy. The detection model compression module is used to compress customized deceptive phishing detection models and then distribute them to the mobile terminal inference and backflow chain; The detection model adaptive update module is used to update the model when the number of returned samples reaches a certain threshold. At the same time, based on the concept drift detection mechanism, the customized deceptive phishing detection model is updated regularly; The mobile terminal inference and backflow chain includes: The data processing module is used to segment the real-time acquired URL data to be detected using a combination of word segmentation and structural embedding representation method, perform structural tagging, generate a sequence of word segmentation structure pairs, and then obtain the URL embedding matrix. The real-time detection module is used to perform real-time detection on the URL embedding matrix using the distributed customized deceptive phishing detection model, obtain the phishing detection results of the URL data to be detected, and assign a confidence level to the phishing detection results using a preset confidence threshold. The sample feedback module determines whether the phishing detection result is suspicious based on the confidence level, and sends the URL data to be detected corresponding to the suspicious phishing detection result as a feedback sample to the detection model adaptive update module.

Images