A phishing website detection method based on multi-model cascade and genetic algorithm optimization

Abstract

This invention relates to a phishing website detection method based on multi-model cascading and genetic algorithm optimization, comprising the following steps: S100: Constructing an offline optimization module: Based on historical datasets, optimization objectives, and constraints, a genetic algorithm optimizer solves for the optimal threshold combination. The historical dataset includes the prediction confidence scores, true labels, and average prediction time of different models; S200: Constructing an online detection module: Loading the optimal threshold combination, and using multi-model cascading inference to perform real-time detection on the input URL of the website to be detected. Multi-model cascading inference follows the principles of rapid decision-making and in-depth analysis as needed, achieving a balance between detection efficiency and accuracy through hierarchical screening. The purpose of this invention is to utilize the global search capability of genetic algorithms to automatically solve for an optimal set of model decision thresholds, enabling the online cascading system to maximize detection efficiency while meeting strict performance constraints.

Description

Technical Field

[0001] This invention relates to a phishing website detection method, specifically a phishing website detection method based on multi-model cascade and genetic algorithm optimization. Background Technology

[0002] Phishing is a typical form of online fraud that uses the internet to deceive users by impersonating legitimate websites, thereby obtaining their sensitive information. Victims face varying degrees of personal information leakage, leading to financial losses. How to quickly and accurately identify phishing websites has become a hot research topic in Web (Global Wide Area Network) information security.

[0003] Currently, there are four main methods for detecting phishing websites:

[0004] (1) Based on a blacklist / whitelist mechanism: This method relies on collecting information such as known phishing URLs and adding them to a blacklist database. When a user visits a site, the system matches URLs from the blacklist / whitelist to identify potential phishing risks.

[0005] (2) Heuristic detection method: By using manual rules and feature extraction (including features such as URL and text content), feature vectors are constructed and classification models are trained by combining common phishing behaviors.

[0006] (3) Visual similarity-based detection model: Compare the suspicious webpage with the screenshot of the regular webpage. If the similarity exceeds the set threshold, it is determined to be a phishing webpage.

[0007] (4) Detection based on large models: Using multimodal large models, text and visual analysis large models are integrated, and cross-validation is used to identify phishing attacks. In actual systems, in order to improve the overall detection performance and efficiency, the above multiple models are often used in a cascade manner to form a multi-model detection pipeline.

[0008] While each of the aforementioned methods has its advantages, they also have significant limitations. First, it's difficult to balance detection performance with system efficiency: high-precision models are often computationally complex and slow to respond. Performing comprehensive detection on all access requests would significantly increase system latency and resource consumption, making efficient response difficult. Conversely, using only lightweight methods may result in insufficient detection accuracy and increased risk of missed detections. Second, in multi-model collaborative decision-making, setting reasonable confidence thresholds for each model is a complex challenge. These threshold parameters interact with each other, constituting a high-dimensional optimization problem. Traditional manual parameter tuning is not only inefficient but also prone to getting trapped in local optima, limiting the overall improvement in detection efficiency. Third, practical deployment requires balancing multiple mutually constraining objectives, including maximizing detection capability, strictly controlling false positives, shortening detection time, and reducing business risks caused by missed or false positives. Existing methods often lack a unified optimization framework that can systematically coordinate these objectives. Summary of the Invention

[0009] The main objective of this invention is to provide a phishing website detection method and system based on multi-model cascading and genetic algorithm optimization. It constructs an "offline optimization, online application" framework and utilizes the global search capability of the genetic algorithm to automatically solve for an optimal set of model decision thresholds. This enables the online cascading system to maximize detection efficiency, i.e., minimize detection time, while meeting strict performance constraints.

[0010] To achieve the above objectives, this invention provides a phishing website detection method based on multi-model cascade and genetic algorithm optimization, comprising the following steps:

[0011] S100: Building an offline optimization module:

[0012] Based on historical datasets, optimization objectives, and constraints, a genetic algorithm optimizer is used to solve for the optimal threshold combination. Historical datasets include real samples;

[0013] Specifically, the offline optimization module in step S100 includes:

[0014] S110: Data Preparation Unit

[0015] Collect historical website access data and label samples to obtain real samples;

[0016] S120: Parameter Configuration Unit

[0017] Define the relevant parameters, performance constraint parameters, and search range of decision variables for the optimization objective;

[0018] S130: Genetic Algorithm Solving Unit:

[0019] Using the sample labels from step S110, the relevant parameters set in step S120, the performance constraint parameters, and the search range of the decision variables as rule inputs, the algorithm sequentially goes through four steps: encoding and initialization, fitness evaluation, genetic operations, and iteration termination, to output the optimal threshold combination. ;

[0020] S200: Constructing an online detection module:

[0021] Load the optimal threshold combination It employs a multi-model cascaded inference approach to perform real-time detection on the input website URLs to be detected. The multi-model cascaded inference follows the principles of rapid decision-making and in-depth analysis as needed, achieving a balance between detection efficiency and accuracy through hierarchical filtering.

[0022] Preferably, the multi-model cascaded inference in step S200 uses three models: a URL discrimination model, an HTML discrimination model, and a domain discrimination model, and the average time consumption of the three models satisfies the following order: URL discrimination model < HTML discrimination model < domain discrimination model.

[0023] More preferably, the detection process of the online detection module in step S200 is as follows:

[0024] S210: URL model filtering:

[0025] Extract the HTML features of the webpage corresponding to the URL to be detected and input them into the URL discrimination model to obtain the confidence score. ,

[0026] like If the website is deemed normal, the process will terminate.

[0027] like If the website is identified as a phishing website, the process will be terminated.

[0028] like If so, step S220 is triggered;

[0029] in, The lowest value selected by the URL discrimination model;

[0030] The highest value selected by the URL discrimination model;

[0031] S220: HTML Model Analysis:

[0032] Extract the HTML features of the webpage corresponding to the URL to be detected and input them into the HTML discrimination model to obtain the confidence score. ,

[0033] like If the website is identified as a phishing website, the process will be terminated.

[0034] like If the website is deemed normal, the process will terminate.

[0035] like If so, step S230 is triggered;

[0036] in, The lowest value selected by the HTML discrimination model;

[0037] The highest value selected by the HTML discrimination model;

[0038] S230: Domain Model Decision:

[0039] Extract the domain characteristics of the URL to be detected and input them into the domain discrimination model to obtain the confidence score. ,

[0040] like If so, it is determined to be a phishing website;

[0041] like If so, it is considered a normal website;

[0042] In the above formula, x represents the input sample.

[0043] Preferably, the search range of the decision variables in step S120 is a combination of thresholds. The range of values ​​for the four decision variables, where:

[0044] The lowest value selected by the URL discrimination model;

[0045] The highest value selected by the URL discrimination model;

[0046] The lowest value selected by the HTML discrimination model;

[0047] The highest value selected by the HTML discrimination model.

[0048] Preferably, the relevant parameters in step S120 include the balance factor. Underreporting cost coefficient and false alarm cost coefficient ,and .

[0049] More preferably, the performance constraint parameters in step S120 include the minimum detection rate. Highest false alarm rate Detection rate constraint and false alarm rate constraints ;

[0050] in,

[0051]

[0052]

[0053] Detection rate: ,

[0054] This indicates that among all phishing websites, in individual Under the corresponding threshold combination The proportion correctly identified by the detection system, among which, The number of phishing websites identified by the detection system. This is to detect the number of phishing websites that the system has missed.

[0055] False alarm rate: ,

[0056] This means that among all normal websites, in individual Under the corresponding threshold combination, the proportion of the detected system incorrectly identifies a website as a phishing site, where, The number of phishing websites misidentified by the detection system. This represents the number of websites that the detection system classifies as legitimate.

[0057] More preferably, the genetic algorithm solution unit in step S130 specifically includes:

[0058] S131: Encoding and Initialization:

[0059] Using floating-point encoding to encode decision variables Encoded as chromosomes, an initial population is randomly generated within a defined search range. ;

[0060] S132: Fitness Assessment:

[0061] For each individual in the population Calculate the adaptability :

[0062]

[0063] in, The method for determining the objective function value is as follows:

[0064] ;

[0065] For individuals The average detection time obtained by evaluating on historical datasets under the corresponding threshold combinations; For individuals Under the corresponding threshold combination The average business risk cost is evaluated on historical datasets;

[0066] For individuals Under the corresponding threshold combination The penalty for constraint violation is determined by a static penalty function expression:

[0067] ;

[0068] S133: Genetic manipulation:

[0069] The selection operation is performed sequentially using the tournament selection method, the crossover operation using simulated binary crossover, and the mutation operation using polynomial mutation.

[0070] S134: Iteration Termination:

[0071] When the maximum number of generations of evolution is reached;

[0072] Alternatively, the improvement amount of the optimal solution over K consecutive generations When the iteration terminates, the optimal threshold combination is output. .

[0073] Further optimized, the optimal threshold combination The method for determining it is as follows:

[0074] .

[0075] Further optimized The method for determining it is as follows:

[0076] ;

[0077] In the above formula, It is a sample In individuals The total time taken to flow through the entire cascade process under the corresponding threshold combination; The value of is determined by the inherent time consumption of the model and the path it is invoked on, where N is the number of samples;

[0078] The method for determining it is as follows:

[0079] ;

[0080] To detect the number of phishing websites that the system missed. This represents the number of phishing websites that were misidentified by the detection system.

[0081] Preferably, the online detection module in step S200 further includes a recording and feedback unit for recording detection results, decision paths, and time consumption, providing data support for updating historical datasets and subsequent optimization.

[0082] The beneficial effects of this invention are as follows:

[0083] Global automated optimization, freeing up manpower: By leveraging the powerful global search capabilities of genetic algorithms, the threshold configuration that is close to the global optimum is found automatically and efficiently, completely solving the problem of manual tuning of complex parameters in multi-model systems and greatly improving the efficiency of system deployment and iteration.

[0084] Precise trade-offs across multiple objectives for superior performance: Through rigorous mathematical modeling, the system optimizes detection performance, system efficiency (average time), and business costs (risk) within a unified framework. This ensures that the final system not only meets technical specifications but also achieves optimal performance in terms of operational costs and user experience.

[0085] The system efficiency is significantly improved and resources are saved: Through optimized cascaded decision-making, more than 80% of the samples are processed quickly in the first layer (url model) with the lowest computational cost. The average detection time is reduced by more than 50%, which effectively reduces server load and computing resource consumption, enabling the high-precision model to be applied in real-time systems.

[0086] The architecture is clear and highly scalable: the "offline optimization, online application" design decouples the complex optimization process from the efficient online service. The framework is easily extensible, allowing for the convenient introduction of more models (such as visual models), the definition of new optimization objectives (such as energy consumption), or constraints, demonstrating high flexibility and adaptability. Detailed Implementation

[0087] The technical solutions of the present invention will be clearly and completely described below with reference to the embodiments of the present invention. Many specific details are set forth in the following description to provide a thorough understanding of the present invention; however, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art can make similar extensions without departing from the spirit of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0088] This embodiment specifically provides a phishing website detection method and system based on multi-model cascading and genetic algorithm optimization. Its core is the construction of a collaborative framework between an offline optimization module and an online detection module: the offline optimization module solves for the optimal threshold combination using a genetic algorithm, and the online detection module implements multi-model cascading inference based on this threshold combination. Specific steps are shown below:

[0089] S100: Building an offline optimization module:

[0090] Based on historical datasets, optimization objectives, and constraints, a genetic algorithm optimizer is used to find the optimal combination of thresholds that balances detection efficiency and risk cost. The historical dataset includes real samples, which consist of prediction confidence scores of different models, real labels, and the average prediction time of each model.

[0091] The offline optimization module consists of three units: a data preparation unit, a parameter configuration unit, and a genetic algorithm solution unit.

[0092] The offline optimization module in step S100 specifically includes:

[0093] S110: Data Preparation Unit

[0094] The data preparation unit is used to collect historical website access data and label samples. It uses multiple trained models to predict each sample, obtains the prediction confidence score of each sample under each model, and measures the average time each model takes to process a single sample. The sample labels, the confidence scores of each model, and the average time of each model are integrated into a structured historical dataset.

[0095] Specifically, in this embodiment, historical website access data is collected to form a representative historical dataset (such as a dataset of 5,000 samples). This dataset should contain a large number of labeled samples (i.e., each URL is known to be either a phishing website or a legitimate website).

[0096] For each sample in the historical dataset The system pre-prepared predictions using three trained models (URL model, HTML model, and Domain model) to obtain three corresponding confidence scores: , , .

[0097] Simultaneously, through performance profiling, the average time taken by each model to process a single sample was measured and denoted as... , , These time values ​​are constants and are used in subsequent calculations. .

[0098] The above data (sample labels, three confidence scores, and three average times) is stored as a structured historical dataset (such as a CSV file or database table) and used as input to the genetic algorithm optimizer.

[0099] As mentioned above, the average time here refers to the average time predicted by a certain model. For example, with 5000 samples, the total time predicted using the URL model divided by 5000 gives the average time. Let's assume the calculated average time is 1 second, for instance, in the URL time record column of all samples in the CSV file, it would all be 1 second.

[0100] In the CSV file, the confidence score and processing time for a given sample remain constant. During the genetic algorithm's solution process, the basic information of the sample does not change; what changes are the confidence intervals for different models. The final output is the optimal confidence interval for each model.

[0101] S120: Parameter Configuration Unit

[0102] Define the relevant parameters of the optimization objective, performance constraint parameters, and the search range of decision variables.

[0103] 1. Set performance constraint parameters:

[0104] Set minimum detection rate and highest false alarm rate And set performance constraints, namely detection rate constraints and false alarm rate constraints:

[0105] The detection rate constraint is:

[0106]

[0107] The false alarm rate constraint is:

[0108]

[0109] In the formula,

[0110]

[0111]

[0112] Detection rate: ,

[0113] This indicates that among all phishing websites, in individual Under the corresponding threshold combination The proportion correctly identified by the detection system, among which, The number of phishing websites identified by the detection system. This is to detect the number of phishing websites that the system has missed.

[0114] False alarm rate: ,

[0115] This means that among all normal websites, in individual Under the corresponding threshold combination, the proportion of websites incorrectly identified as phishing websites by the detection system, where, The number of phishing websites misidentified by the detection system. This represents the number of websites that the detection system classifies as legitimate.

[0116] 2. Relevant parameters

[0117] 2-1. Cost coefficients in relevant parameters: setting unequal risk costs, for example... (Underreporting cost coefficient) (False alarm cost coefficient). In this scheme, the risk of false alarms is considered to be greater, so the cost of false alarms is set higher by the system.

[0118] 2-2. Weighting parameters in relevant parameters: setting the balance factor For example, it can be set to 1.0, and the preference for "speed" and "risk" can be adjusted according to the actual business needs.

[0119] 3. Search Space (i.e., the search range of decision variables): Defines the range of values ​​for the four decision variables in the threshold combination. For example: , , , .

[0120] S130: Genetic Algorithm Solving Unit:

[0121] Using the structured historical dataset from step S110 as input, and the relevant parameters, performance constraint parameters, and search range of decision variables set in step S120 as rule input, the algorithm sequentially goes through four steps: encoding and initialization, fitness evaluation, genetic operations, and iteration termination, to output the optimal threshold combination. .

[0122] The genetic algorithm solution unit in step S130 specifically includes:

[0123] S131: Encoding and Initialization:

[0124] decision variables Direct encoding is performed as chromosomes (individuals). Floating-point encoding is used, with each chromosome being a vector containing 4 genes (i.e., 4 thresholds). During initialization, within the defined search range... A random number of elements of size 1 are generated inside. population ,in, and Let represent the minimum and maximum values ​​of the four decision variables within the search space, for a given combination of thresholds. Depend on and Composition, that is Depend on and Composition, M represents population The corresponding decision variables .

[0125] S132: Fitness Assessment:

[0126] For each individual in the population Calculate the adaptability :

[0127]

[0128] in, The method for determining the objective function value is as follows:

[0129] ;

[0130] For population-based individuals The average detection time obtained was evaluated on historical datasets:

[0131] ;

[0132] In the above formula, It is a sample At a given threshold The total time spent flowing through the entire cascade process; The value of is determined by the inherent time consumption of the model and the path it is invoked on, where N is the number of samples;

[0133] The average business risk cost is evaluated on historical datasets, and the formula is:

[0134] ;

[0135] and They are at the threshold The number of missed reports and false alarms generated.

[0136] To constrain the violation penalty term, it is determined through a static penalty function expression:

[0137] ;

[0138] In the formula, It is a very large positive penalty coefficient (e.g.) This means that any solution that violates the constraints will be eliminated due to its extremely low fitness (extremely high penalty value), thus guiding the search towards the feasible region. and Please refer to step S120 for the calculation method; this step will not be described in detail here.

[0139] S133: Genetic manipulation:

[0140] The selection operation is performed sequentially using tournament selection, the crossover operation using simulated binary crossover, and the mutation operation using polynomial mutation.

[0141] Specifically, as shown below:

[0142] Selection: A tournament selection method is used to select individuals with high fitness from the current population as parents to reproduce the next generation.

[0143] Crossover: Employs simulated binary crossover (SBX), mimicking the single-point crossover behavior of binary encoding. This produces offspring similar to their parents and possesses good global search capabilities. For the selected parent... and One crossover operation will generate two offspring. and They are the first The formula for calculating the number of genes is as follows:

[0144]

[0145] in It is a distribution index Related random numbers.

[0146] Mutation: Using polynomial mutation (PM) to perturb individual genes with a low probability, maintaining population diversity and preventing premature convergence.

[0147] S134: Iteration Termination:

[0148] The iterative process terminates when the maximum number of generations (max_gen) is reached or when an early stopping mechanism is triggered. The early stopping mechanism monitors the optimal solution as it progresses through successive iterations. Improvement within a generation ,like If a very small positive number (such as 0.01) is selected, the process will terminate early to improve optimization efficiency.

[0149] S135: Output the optimal threshold combination

[0150] Optimal threshold combination Below , Marked sequentially as , .in, The lowest value selected by the URL discrimination model; The highest value selected by the URL discrimination model; The lowest value selected by the HTML discrimination model; The highest value selected by the HTML discrimination model.

[0151] S200: Constructing an online detection module:

[0152] Load the optimal threshold combination It employs a multi-model cascaded inference approach to perform real-time detection on the input website URLs to be detected. The multi-model cascaded inference follows the principles of rapid decision-making and in-depth analysis as needed, achieving a balance between detection efficiency and accuracy through hierarchical filtering.

[0153] Specifically, the multi-model cascaded inference in step S200 uses three models: a URL discrimination model, an HTML discrimination model, and a domain discrimination model. The average time consumption of the three models satisfies the following order: URL discrimination model < HTML discrimination model < domain discrimination model.

[0154] In this embodiment, the online detection process in step S200 is specifically as follows:

[0155] S210: URL model filtering:

[0156] Extract the HTML features of the webpage corresponding to the URL to be detected and input them into the URL discrimination model to obtain the confidence score. ,

[0157] like If the website is deemed normal, the process will terminate.

[0158] like If the website is identified as a phishing website, the process will be terminated.

[0159] like If so, step S220 is triggered;

[0160] S220: HTML Model Analysis:

[0161] Extract the HTML features of the webpage corresponding to the URL to be detected and input them into the HTML discrimination model to obtain the confidence score. ,

[0162] like If the website is identified as a phishing website, the process will be terminated.

[0163] like If the website is deemed normal, the process will terminate.

[0164] like If so, step S230 is triggered;

[0165] S230: Domain Model Decision:

[0166] Extract the domain characteristics of the URL to be detected and input them into the domain discrimination model to obtain the confidence score. ,

[0167] like If so, it is determined to be a phishing website;

[0168] like If so, it is considered a normal website;

[0169] In the above formula, x represents the input sample.

[0170] Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

Claims

1. A phishing website detection method based on multi-model cascade and genetic algorithm optimization, characterized in that, Includes the following steps: S100: Building an offline optimization module: Solving the optimal threshold combination by a genetic algorithm optimizer based on a historical dataset, optimization objectives and constraint conditions , the historical dataset includes real samples; Specifically, the offline optimization module in step S100 includes: S110: Data Preparation Unit Collect historical website access data and label samples to obtain real samples; S120: Parameter Configuration Unit Set the related parameters of optimization target, performance constraint parameters and search range of decision variables; the related parameters in step S120 include balance factor , false negative cost coefficient and false positive cost coefficient , and ; The performance constraint parameters in step S120 include a minimum detection rate a maximum false positive rate a detection rate constraint and a false positive rate constraint ; in, ， ， Detection rate: , This indicates that among all phishing websites, in individual The proportion correctly identified by the detection system under the corresponding threshold combination, where, The number of phishing websites identified by the detection system. To detect the number of phishing websites that the system missed. False alarm rate: , This means that among all normal websites, in individual Under the corresponding threshold combination, the proportion of websites incorrectly identified as phishing websites by the detection system, where, The number of phishing websites misidentified by the detection system. The number of websites that the detection system determines to be normal; S130: Genetic Algorithm Solving Unit: Using the sample labels from step S110, the relevant parameters set in step S120, the performance constraint parameters, and the search range of the decision variables as rule inputs, the algorithm sequentially goes through four steps: encoding and initialization, fitness evaluation, genetic operations, and iteration termination, to output the optimal threshold combination. ; The genetic algorithm solution unit in step S130 specifically includes: S131: Encoding and Initialization: Using floating-point encoding to encode decision variables Encoded as chromosomes, an initial population is randomly generated within a defined search range. ; S132: Fitness Assessment: For each individual in the population Calculate the adaptability : ， in, The method for determining the objective function value is as follows: ； For individuals The average detection time obtained by evaluating on historical datasets under the corresponding threshold combinations; For individuals The average business risk cost evaluated on historical datasets under the corresponding threshold combinations; For individuals The penalty term for constraint violation under the corresponding threshold combination is determined by the static penalty function expression: ； In the above formula, It is a positive penalty coefficient; S133: Genetic manipulation: The selection operation is performed sequentially using the tournament selection method, the crossover operation using simulated binary crossover, and the mutation operation using polynomial mutation. S134: Iteration Termination: When the maximum number of generations of evolution is reached; Alternatively, monitor the optimal solution in continuous Improvement within a generation ,like If so, it will be terminated early; S200: Constructing an online detection module: Load the optimal threshold combination The system employs a multi-model cascaded inference approach to perform real-time detection of the input website URLs. This multi-model cascaded inference follows the principles of rapid decision-making and in-depth analysis as needed, achieving a balance between detection efficiency and accuracy through hierarchical filtering; optimal threshold combinations are used. The method for determining it is as follows: ； The multi-model cascaded inference in step S200 uses three models: a URL discrimination model, an HTML discrimination model, and a domain discrimination model. The average time consumption of the three models satisfies the following order: URL discrimination model < HTML discrimination model < domain discrimination model.

2. The phishing website detection method based on multi-model cascade and genetic algorithm optimization according to claim 1, characterized in that, The detection process of the online detection module in step S200 is as follows: S210: URL model filtering: Extract the HTML features of the webpage corresponding to the URL to be detected and input them into the URL discrimination model to obtain the confidence score. , like If the website is deemed normal, the process will terminate. like If the website is identified as a phishing website, the process will be terminated. like If so, step S220 is triggered; in, The lowest value selected by the URL discrimination model; The highest value selected by the URL discrimination model; S220: HTML Model Analysis: Extract the HTML features of the webpage corresponding to the URL to be detected and input them into the HTML discrimination model to obtain the confidence score. , like If the website is identified as a phishing website, the process will be terminated. like If the website is deemed normal, the process will terminate. like If so, step S230 is triggered; in, The lowest value selected by the HTML discrimination model; The highest value selected by the HTML discrimination model; S230: Domain Model Decision: Extract the domain characteristics of the URL to be detected and input them into the domain discrimination model to obtain the confidence score. , like If so, it is determined to be a phishing website; like If so, it is considered a normal website; In the above formula, x represents the input sample.

3. The phishing website detection method based on multi-model cascade and genetic algorithm optimization according to claim 2, characterized in that, The search range for the decision variables in step S120 is a combination of thresholds. The range of values ​​for the four decision variables, where: The lowest value selected by the URL discrimination model; The highest value selected by the URL discrimination model; The lowest value selected by the HTML discrimination model; The highest value selected by the HTML discrimination model.

4. A phishing website detection method based on multi-model cascade and genetic algorithm optimization according to claim 1, characterized in that, The method for determining it is as follows: ； In the above formula, It is a sample In individuals The total time taken to flow through the entire cascade process under the corresponding threshold combination; The value of is determined by the inherent time consumption of the model and the path it is invoked on, where N is the number of samples; The method for determining it is as follows: ； To detect the number of phishing websites that the system missed. The number of phishing websites misidentified by the detection system; The underreporting cost coefficient, This is the false alarm cost coefficient.

5. The phishing website detection method based on multi-model cascade and genetic algorithm optimization according to claim 1, characterized in that, The online detection module in step S200 also includes a recording and feedback unit, which records the detection results, decision path and time consumption, providing data support for updating historical datasets and subsequent optimization.

Images