Fraud-related website detection and identification method and system based on network attribute characteristics and electronic equipment

Abstract

The invention relates to a fraud-related website detection and identification method and system based on network attribute characteristics and electronic equipment, and the method comprises the steps: collecting sample website DNS domain name analysis data, analyzing the collected sample website DNS domain name, obtaining sample website domain name sample data, extracting sample website characteristics, and obtaining sample website characteristic data; according to sample website domain name sample data and sample website feature data, network internal relation network data is constructed, and based on sample fraud-related websites, a large model is subjected to association analysis by combining fraud-related website samples and a feature input relation graph, so that more fraud-related websites with the same features are identified. According to the method, the fraud-related website detection efficiency can be improved, website network attribute features are extracted to construct a relational graph, the incidence relation is accurately described, and similar websites can be quickly retrieved by inputting known fraud-related website features. By means of a feature association and reasoning mechanism, the relationship between the encrypted fraud-related website and the known fraud-related entity can be found.

Description

Technical Field

[0001] This application relates to the field of cybersecurity supervision, and in particular to a method, system, and electronic device for detecting and identifying fraudulent websites based on network attribute characteristics. Background Technology

[0002] Currently, the mainstream technologies in the field of fraudulent website detection are web crawling and content recognition-based methods. The core process involves using web crawlers to extract text, images, and other web page content from the target website, then parsing and analyzing the crawled content and comparing it with fraudulent features to determine whether the website is fraudulent.

[0003] However, this technology has obvious drawbacks: First, the process involves multiple steps such as crawling, parsing, analyzing, and comparing, which is cumbersome and time-consuming, resulting in low detection efficiency; Second, with the widespread application of encrypted communication technology in websites and apps, crawlers cannot obtain the content of encrypted websites, making it impossible to carry out content recognition and severely lacking the ability to detect encrypted fraudulent websites. Summary of the Invention

[0004] In view of this, this application proposes a method for detecting and identifying fraudulent websites based on network attribute features, including the following steps: Collect sample URL DNS domain name resolution data, resolve the collected sample URL DNS domain names, and obtain sample URL domain name sample data; Extract features from sample websites and obtain sample website feature data; Based on sample URL domain data and sample website feature data, construct network data on the inherent relationships within the network. Based on the sample of fraudulent websites, the large model performs correlation analysis by combining the sample of fraudulent websites with the feature input relationship graph, thereby identifying more fraudulent websites with the same characteristics.

[0005] In one possible implementation, collecting sample URL DNS domain name resolution data, resolving the collected sample URL DNS domain names, and obtaining sample URL domain name sample data includes the following steps: Based on distributed DNS lookup, a DNS resolution request is initiated for the sample URL, and the DNS resolution result data is collected. By calling third-party domain information query APIs and web crawling technology, basic information data and URL structure data of sample website domains were collected; The collected DNS resolution data is deduplicated and standardized to generate cleaned DNS resolution data; The cleaned DNS resolution data, domain name basic information data, and URL structure data are integrated into a unified sample database and a data association index is established to form sample website domain name sample data.

[0006] In one possible implementation, the characteristics of the sample website include website content characteristics, domain name resolution characteristics, IP association characteristics, and domain name certificate characteristics, wherein the website content characteristics include text characteristics, image characteristics, protocol characteristics, and redirection characteristics.

[0007] In one possible implementation, constructing network data on inherent relationships within a network based on sample URL domain name sample data and sample website feature data includes the following steps: Organize the core relationships in the network, including IP-domain relationships, domain-alias relationships, and domain-certificate relationships; Based on the core relationships of the network, a graph database is used to construct the network of inherent relationships. The isolated nodes in the relationship graph are investigated. If a node has no valid data to support it, it is deleted from the relationship network, and the internal relationship network data is generated.

[0008] In one possible implementation, based on sample fraudulent URLs, a large model is used to perform correlation analysis by combining the sample fraudulent websites with a feature input relationship graph to identify more fraudulent websites with the same characteristics. This includes the following steps: The sample data of the labeled fraudulent websites are integrated with the sample data of normal websites to build a large model training dataset; Known fraudulent domain names are selected as input features, and single-feature association analysis and multi-feature association analysis are performed through a large model. The detection system generates a report identifying suspected fraudulent websites; The reports identifying fraudulent websites will be used to implement measures such as domain name blocking, IP blocking, and certificate revocation; at the same time, the fraudulent characteristics will be updated to the feature database of the detection system.

[0009] In one possible implementation, the process of deduplicating and standardizing the collected DNS resolution data to generate cleaned DNS resolution data includes the following steps: Based on the collected DNS resolution data, duplicate resolution records for the same URL under the same timestamp are deleted; Remove records from the collected DNS resolution data that have failed to resolve or have incomplete data; For DNS resolution data that has temporarily failed due to network fluctuations, re-initiate the resolution request to collect the data again. Verify the consistency between the collected DNS resolution data registration information and the filing information, and mark any contradictory or abnormal data.

[0010] In one possible implementation, single-feature association analysis includes alias association analysis, IP association analysis, and certificate association analysis.

[0011] In one possible implementation, multi-feature association analysis includes the steps of: Multiple features of known fraudulent websites are selected as combined input features; Based on the combined input features, the large model constructs multi-feature association paths in the relational network; The overall risk score of the large model calculation path; If the path risk score is greater than or equal to 2.0, and the domain name at the end of the path has no historical detection record, it will be marked as a domain name suspected of being involved in fraud.

[0012] The present invention also includes a fraudulent website detection and identification system based on network attribute features, used to implement the above method. The system includes a data acquisition module, a data processing module, a feature extraction module, a relationship network construction module, and a large model analysis module. The data acquisition module is used to initiate distributed DNS resolution requests to collect resolution data, and to call third-party APIs and crawlers to collect basic domain name information and URL structure data; The data processing module is used to deduplicate the collected data, supplement incomplete data, verify the consistency of information, generate cleaned data, and integrate and build a database. The feature extraction module is used to extract four types of features: website content, domain name resolution, IP association, and domain name certificate. The relational network building module is used to organize core relations, build networks using graph databases, and identify and delete isolated nodes; The large model analysis module is used to build training datasets, perform single / multi-feature association analysis, and calculate risk scores to label suspected domain names.

[0013] The present invention also includes an electronic device, characterized in that, for implementing the above method, the device includes a processor and a memory; The processor is used to perform all computational tasks to implement a method for detecting and identifying fraudulent websites based on network attribute features; Memory is used to store processor-executable instructions and statically stored data.

[0014] The beneficial effects of this invention are: This invention improves the efficiency of detecting fraudulent websites: by extracting the network attribute features of websites and constructing a network attribute feature relationship graph, it more comprehensively and accurately depicts the relationships between fraudulent websites. By inputting the features of a fraudulent website into the network attribute feature relationship graph, other fraudulent websites with the same features can be quickly retrieved, greatly improving query efficiency.

[0015] Regarding the detection capabilities for encrypted fraudulent websites: For fraudulent websites that use encryption technology, the system can discover their connections with known fraudulent entities through the correlation and reasoning mechanisms of network attribute characteristics, thereby achieving effective detection of new types of fraudulent websites.

[0016] Other features and aspects of this application will become clear from the following detailed description of exemplary embodiments with reference to the accompanying drawings. Attached Figure Description

[0017] The accompanying drawings, which are included in and form part of this specification, illustrate exemplary embodiments, features, and aspects of this application together with the specification and serve to explain the principles of this application.

[0018] Figure 1 A flowchart of a method for detecting and identifying fraudulent websites based on network attribute features, according to an embodiment of this application, is shown. Figure 2 This document illustrates a detailed flowchart of the process for obtaining sample URL domain name data in an embodiment of this application. Figure 3 A detailed flowchart illustrating the construction of network data based on the inherent relationships within the network, as shown in an embodiment of this application, is presented. Figure 4 This application illustrates a detailed flowchart of large-scale model correlation analysis and fraudulent website handling in its embodiments. Figure 5 A detailed flowchart of the DNS resolution data cleaning process according to an embodiment of this application is shown; Figure 6 A detailed flowchart of multi-feature association analysis according to an embodiment of this application is shown; Figure 7 The diagram illustrates the structure of a fraudulent website detection and identification system based on network attribute features, according to an embodiment of this application. Detailed Implementation

[0019] Various exemplary embodiments, features, and aspects of this application will now be described in detail with reference to the accompanying drawings. The same reference numerals in the drawings denote elements that have the same or similar functions. Although various aspects of the embodiments are shown in the drawings, they are not necessarily drawn to scale unless specifically indicated otherwise.

[0020] It should be understood that the terms "center," "longitudinal," "lateral," "length," "width," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," "counterclockwise," "axial," "radial," and "circumferential" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing the present invention or simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the present invention.

[0021] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0022] The term “exemplary” as used herein means “serving as an example, embodiment, or illustration.” Any embodiment illustrated herein as “exemplary” is not necessarily to be construed as superior to or better than other embodiments.

[0023] Furthermore, to better illustrate this application, numerous specific details are provided in the following detailed embodiments. Those skilled in the art should understand that this application can be implemented without certain specific details. In some instances, methods, means, components, and circuits well-known to those skilled in the art have not been described in detail in order to highlight the main points of this application.

[0024] The invention disclosed in this application is a method, system, and electronic device for detecting and identifying fraudulent websites based on network attribute characteristics. It can be applied in equipment in fields such as network security supervision, internet platform risk prevention and control, anti-fraud in the financial industry, and intranet security protection for government and enterprise units. It plays a role in accurately identifying fraudulent websites, improving the efficiency of detecting fraudulent URLs, blocking the spread of fraudulent information, reducing the risk of users being defrauded, and assisting in the source governance of fraud.

[0025] method specifically refer to Figure 1 , Figure 1 A flowchart of a method for detecting and identifying fraudulent websites based on network attribute features, according to an embodiment of this application, is shown.

[0026] A method for detecting and identifying fraudulent websites based on network attribute features includes the following steps: S100, collecting DNS domain name resolution data of sample websites, resolving the collected DNS domain names of sample websites to obtain sample website domain name sample data; S200, extracting features of sample websites to obtain sample website feature data; S300, constructing network data of internal network relationships based on the sample website domain name sample data and sample website feature data; and S400, based on the sample fraudulent websites, performing correlation analysis using a large model by combining the fraudulent website samples and feature input relationship graphs to identify more fraudulent websites with the same characteristics. This method can quickly collect and resolve data, extract multi-dimensional features, and construct relationship networks. Through large-scale model correlation analysis, it significantly improves the efficiency of fraudulent website detection and can also overcome encryption technology limitations to accurately identify more fraudulent websites.

[0027] This method first collects DNS domain name resolution data of sample websites, obtaining sample domain name data through resolution operations. Then, it proceeds to the feature extraction stage, extracting features from sample websites across dimensions such as website content, domain name resolution, IP association, and domain certificates to form feature data. Based on the sample domain name data and feature data, an internal relationship network is constructed, showcasing associations between websites such as IP greater than or equal to domain name, domain name greater than or equal to alias, and domain name greater than or equal to certificate. Fraudulent website samples and their features are input into this relationship network, and a large-scale model is used for association analysis, thereby efficiently identifying more fraudulent websites with the same characteristics. This improves detection efficiency and overcomes the challenge of detecting encrypted websites.

[0028] specifically refer to Figure 2 , Figure 2 A flowchart illustrating the sample URL domain name data acquisition process of an embodiment of this application is shown.

[0029] In one possible implementation, collecting sample website DNS domain name resolution data and resolving the collected sample website DNS domain names to obtain sample website domain name sample data includes step S101, initiating a DNS resolution request for the sample website based on distributed DNS query and collecting DNS resolution result data. Step S102, collecting basic information data and URL structure data of the sample website domain names by calling a third-party domain information query API and web crawling technology. Step S103, performing deduplication and standardization processing on the collected DNS resolution data to generate cleaned DNS resolution data. And step S104, integrating the cleaned DNS resolution data, domain name basic information data, and URL structure data into a unified sample database and establishing a data association index to form sample website domain name sample data. By combining distributed DNS query, API call, and web crawling, comprehensive resolution data and domain name and URL information are collected, and after deduplication, standardization, and cleaning, they are integrated and indexed. This can efficiently obtain high-quality sample data, laying the foundation for subsequent feature extraction and relationship network construction, improving the data support capability for detecting fraudulent websites, and helping to solve the problems of low efficiency and difficulty in detecting encrypted websites in existing technologies.

[0030] In one specific embodiment, data cleaning and integration refers to deduplicating the collected DNS resolution data, deleting duplicate resolution records for the same URL under the same timestamp; removing records with failed resolution or incomplete data; and re-initiating resolution requests to re-collect data for temporary resolution failures caused by network fluctuations. This includes standardizing inconsistent data in domain registration and filing information; verifying the consistency between registration and filing information; and marking contradictory abnormal data. The cleaned DNS resolution data, domain basic information data, and URL structure data are integrated into a unified sample database, and a data association index is established to form a complete sample URL and domain name sample dataset.

[0031] In one possible implementation, the characteristics of the sample website include website content characteristics, domain name resolution characteristics, IP association characteristics, and domain name certificate characteristics, wherein the website content characteristics include text characteristics, image characteristics, protocol characteristics, and redirection characteristics.

[0032] In one specific embodiment, obtaining website content features refers to acquiring website request methods and response status through traffic analysis, combining this with web crawling of text and images to extract protocol types, redirect links, etc., covering both visible and invisible attributes to comprehensively characterize website content features; obtaining domain name resolution features refers to collecting registration information such as domain name registration time and organization, as well as resolution information such as IP and aliases, extracting key attributes to provide data support for subsequent correlation analysis at the domain name resolution dimension; obtaining IP association features refers to acquiring the IP corresponding to the website address, querying the IP address range, location, and organization, extracting these feature information, constructing the basis for the association between IP and website, and assisting in fraud identification; obtaining domain name certificate features refers to collecting information such as the validity period of the domain name certificate, the issuing authority, and the domain name used, extracting features such as serial numbers and fingerprints to provide certificate dimension basis for detecting encrypted fraudulent websites.

[0033] In one specific embodiment, obtaining text features refers to crawling website text, extracting fraudulent keywords such as "transfer verification" and "secure account" and their frequency, and marking abnormal text tendencies; obtaining image features refers to identifying website images and marking images containing fake official seals or imitation official interfaces as having fraud risks; obtaining protocol features refers to monitoring website communication protocols and recording risks if non-standard encryption protocols are frequently used or protocol redirections are abnormal; obtaining redirection features refers to tracing website redirection paths and marking cases where multiple redirections to unfamiliar domains within a short period of time are suspected of fraud.

[0034] specifically refer to Figure 3 , Figure 3 A flowchart illustrating the network data construction process of the network intrinsic relationship in an embodiment of this application is shown.

[0035] In one possible implementation, constructing the network's internal relationship data based on sample URL domain name sample data and sample website feature data includes step S301, organizing the core network relationships, which include IP-domain name relationships, domain name-alias relationships, and domain name-certificate relationships. Step S302, based on the core network relationships, constructing the network's internal relationship network using a graph database. Step S303, checking isolated nodes in the relationship graph; if a node lacks any valid data support, it is deleted from the relationship network, generating the network's internal relationship network data. Using a graph database to construct the relationship network and checking and deleting isolated nodes allows for accurate construction of the network's internal relationship network data, laying a solid foundation for subsequent analysis of fraudulent website associations, improving detection accuracy, and simultaneously solving the problem of difficult detection of encrypted fraudulent websites, thus improving detection efficiency.

[0036] In one specific embodiment, the relational graph model is constructed using a graph database to build the internal relational network of the network, defining the node types and attributes in the graph. IP node attributes include IP address, IP range, location, issuing authority, IP type, open port, and risk level; domain name node attributes include domain name, registration time, expiration time, registration authority, filing number, website type, and risk level; certificate node attributes include certificate serial number, SHA-256 fingerprint, issuing authority, validity period, number of bound domains, and risk level; registrant node attributes include registrant name / email / phone number, number of registered domains, and risk level.

[0037] specifically refer to Figure 4 , Figure 4 The flowchart illustrating the large-scale model association analysis and fraudulent website handling process of this application embodiment is shown.

[0038] In one possible implementation, based on sample fraudulent website URLs, a large model is used to perform correlation analysis by combining fraudulent website samples and feature input relationship graphs to identify more fraudulent websites with the same characteristics. This includes step S401, integrating the labeled fraudulent website sample data with normal website sample data to construct a large model training dataset. Step S402, selecting known fraudulent domain names as input features, and performing single-feature correlation analysis and multi-feature correlation analysis through the large model. Step S403, the detection system generates a suspected fraudulent website identification report. And step S404, the fraudulent website identification report is used to implement measures such as domain name blocking, IP blocking, and certificate revocation; simultaneously, the fraudulent features are updated to the detection system's feature library. By integrating fraudulent and normal website samples to construct a training set, performing single / multi-feature correlation analysis through the large model, generating identification reports for interception and handling, and updating the feature library, this approach can efficiently identify more fraudulent websites, improve detection accuracy, solve the problem of detecting encrypted fraudulent websites, and simultaneously form a closed-loop prevention and control system to continuously strengthen detection capabilities.

[0039] In one specific embodiment, single-feature association analysis includes alias association analysis, IP association analysis, and certificate association analysis. Alias ​​association analysis uses aliases of known fraudulent domains as input features. In the relationship network, it queries all domains associated with the alias using the "alias is" edge. The model calculates the risk score of these domains; if the risk score is greater than a preset threshold, it is marked as a suspected fraudulent domain. Simultaneously, it traces the authoritative DNS server corresponding to the alias, queries other domains resolved by that server, and analyzes whether there is a cluster of domains using the same alias. If the proportion of fraudulent domains in the cluster is greater than a preset threshold, all domains in the cluster are marked as high-risk and suspected of being fraudulent. IP association analysis uses the IP address corresponding to a known fraudulent website as input features and queries all domains associated with that IP in the relationship network. The model assesses the risk of associated domains based on the risk attributes of the IP nodes. If a domain meets preset conditions simultaneously, it is marked as a suspected fraudulent domain. Certificate association analysis extracts the SHA-256 fingerprint of SSL certificates from known fraudulent websites as input features and queries all domains using these certificates in the relationship network. It analyzes the common features of these domains, and if the common features match the fraudulent pattern, these domains are marked as suspected fraud in batches. At the same time, it queries other certificates issued by the same certificate authority. If other certificates also have multiple domain bindings and some domains are involved in fraud, the domains associated with these certificates are also included in the suspected fraud range.

[0040] specifically refer to Figure 5 , Figure 5 A flowchart illustrating the DNS resolution data cleaning process according to an embodiment of this application is shown.

[0041] In one possible implementation, the collected DNS resolution data undergoes deduplication and standardization to generate cleaned DNS resolution data. This includes step S1031, deleting duplicate resolution records for the same URL at the same timestamp based on the collected DNS resolution data; step S1032, removing records with failed or incomplete resolution data from the collected DNS resolution data; step S1033, re-initiating resolution requests to re-collect DNS resolution data for temporary resolution failures caused by network fluctuations; and step S1034, verifying the consistency between the registration information and filing information in the collected DNS resolution data, and marking contradictory abnormal data. By deleting duplicate records, removing invalid data, re-collecting temporarily failed data, and verifying information consistency, DNS resolution data cleaning is completed, outputting high-quality, highly accurate resolution data. This provides reliable support for subsequent feature extraction and relationship network construction, helping to improve the accuracy of detecting fraudulent websites.

[0042] Specifically, when cleaning the collected DNS resolution data, firstly, duplicate records under the same timestamp for the same URL are deleted; then, records with failed resolution or incomplete data are removed, and data that temporarily failed to resolve due to network fluctuations is re-requested for supplementary collection; finally, the registration information and filing information in the data are verified to be consistent, and abnormal data with inconsistencies are marked.

[0043] In one possible implementation, single-feature association analysis includes alias association analysis, IP association analysis, and certificate association analysis. Alias ​​association analysis can quickly locate other fraudulent domains that share aliases with the fraudulent domain, efficiently uncovering domains registered in bulk by fraud gangs and improving detection coverage. IP association analysis, combined with an IP knowledge base, identifies high-risk IPs, reverse-screens related domains, and accurately identifies clusters of fraudulent websites pointing to the same IP. Certificate association analysis targets encrypted fraudulent websites, discovering domains using the same SSL certificate in batches, overcoming detection difficulties caused by encrypted communication. All three types of analysis improve detection efficiency and accuracy.

[0044] specifically refer to Figure 6 , Figure 6 A flowchart of multi-feature association analysis according to an embodiment of this application is shown.

[0045] In one possible implementation, multi-feature association analysis includes step S4021, selecting multiple features of known fraudulent websites as combined input features; step S4022, constructing multi-feature association paths in the relationship network based on the combined input features; step S4023, calculating the overall risk score of the path using the large model; and step S4024, marking a path as a suspected fraudulent domain if the path risk score is greater than or equal to a preset threshold and the domain at the end of the path has no historical detection records. This method selects multiple feature combinations of fraudulent websites as input, constructs association paths in the relationship network using a large model, calculates risk scores, and marks a domain as suspected when it reaches a threshold and the end domain has no historical records. It can accurately discover potential fraudulent domains with multi-feature associations, improve the comprehensiveness of detection, and effectively solve the problem of difficulty in identifying encrypted fraudulent websites.

[0046] In one specific embodiment, multi-feature fusion association analysis selects multiple features of known fraudulent websites as combined input features. The model constructs multi-feature association paths in the relationship network and calculates the overall risk score of the path. If the path risk score meets the preset standard, it is marked as a suspected fraudulent domain name. At the same time, the associated nodes of all nodes in the path are analyzed to form a fraud association graph, which intuitively displays the structure of the fraud network.

[0047] system specifically refer to Figure 7 , Figure 7 The diagram illustrates the structure of a fraudulent website detection and identification system based on network attribute features, according to an embodiment of this application.

[0048] The present invention also includes a fraudulent website detection and identification system 700 based on network attribute features, used to implement the above method. The system 700 includes a data acquisition module 701, a data processing module 702, a feature extraction module 703, a relationship network construction module 704, and a large model analysis module 705. The data acquisition module 701 is used to initiate distributed DNS resolution requests to collect resolution data, and to call third-party APIs and crawlers to collect basic domain name information and URL structure data; The data processing module 702 is used to deduplicate the collected data, supplement incomplete data, verify the consistency of information, generate cleaned data, and integrate and build a database. The feature extraction module 703 is used to extract four types of features: website content, domain name resolution, IP association, and domain name certificate. The relational network building module 704 is used to organize core relations, build networks using graph databases, and identify and delete isolated nodes. The large model analysis module 705 is used to build training datasets, perform single / multi-feature association analysis, and calculate risk scores to label suspected domain names.

[0049] Obviously, those skilled in the art should understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the control methods described above. The modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device, or fabricating them separately as individual integrated circuit modules, or fabricating multiple modules or steps into a single integrated circuit module. Thus, the present invention is not limited to any specific hardware and software combination.

[0050] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the control methods described above. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; the storage medium can also include combinations of the above types of memory.

[0051] equipment The present invention also includes an electronic device, characterized in that, for implementing the above method, the device includes a processor and a memory; The processor is used to perform all computational tasks to implement a method for detecting and identifying fraudulent websites based on network attribute features; Memory is used to store processor-executable instructions and statically stored data.

[0052] The electronic device of this disclosure includes a processor and a memory for storing processor-executable instructions. The processor is configured to implement any of the aforementioned methods for detecting and identifying fraudulent websites based on network attribute features when executing the executable instructions.

[0053] It should be noted that the number of processors can be one or more. Furthermore, the electronic device in this embodiment may also include input devices and output devices. The processor, memory, input devices, and output devices can be connected via a bus or other means, without specific limitations herein.

[0054] The memory, serving as a computer-readable storage medium for the method of detecting and identifying fraudulent websites based on network attribute characteristics, can be used to store software programs, computer-executable programs, and various modules, such as the program or module corresponding to the method of detecting and identifying fraudulent websites based on network attribute characteristics in this disclosure. The processor executes various functional applications and data processing of the electronic device by running the software program or module stored in the memory.

[0055] Input devices can be used to receive input digital numbers or signals. These signals can be key signals related to user settings and function control of the device / terminal / server. Output devices can include display devices such as screens.

[0056] The various embodiments of this application have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for detecting and identifying fraudulent websites based on network attribute features, characterized in that, Including the following steps: Collect sample URL DNS domain name resolution data, resolve the collected sample URL DNS domain names, and obtain sample URL domain name sample data; Extract features from sample websites and obtain sample website feature data; Based on the sample URL domain name sample data and sample website feature data, construct network data of the inherent network relationships; Based on the sample of fraudulent websites, the large model performs correlation analysis by combining the sample of fraudulent websites with the feature input relationship graph, thereby identifying more fraudulent websites with the same characteristics.

2. The method according to claim 1, characterized in that, The process of collecting sample website DNS domain name resolution data, resolving the collected sample website DNS domain names, and obtaining sample website domain name sample data includes the following steps: Based on distributed DNS lookup, a DNS resolution request is initiated for the sample URL, and the DNS resolution result data is collected. By calling third-party domain information query APIs and web crawling technology, basic information data and URL structure data of sample website domains were collected; The collected DNS resolution data is deduplicated and standardized to generate cleaned DNS resolution data; The cleaned DNS resolution data, domain name basic information data, and URL structure data are integrated into a unified sample database and a data association index is established to form sample website domain name sample data.

3. The method according to claim 1, characterized in that, The characteristics of the sample website include website content characteristics, domain name resolution characteristics, IP association characteristics, and domain name certificate characteristics, wherein the website content characteristics include text characteristics, image characteristics, protocol characteristics, and redirection characteristics.

4. The method according to claim 1, characterized in that, The step of constructing network data on inherent relationships based on the sample URL domain name sample data and sample website feature data includes the following steps: Organize the core relationships in the network, including IP-domain relationships, domain-alias relationships, and domain-certificate relationships; Based on the core relationships of the network, a graph database is used to construct the network of inherent relationships. The isolated nodes in the relationship graph are investigated. If a node has no valid data to support it, it is deleted from the relationship network, and the internal relationship network data is generated.

5. The method according to claim 1, characterized in that, The process of identifying more fraudulent websites with the same characteristics by combining samples of fraudulent websites with a feature input relationship graph to perform correlation analysis on a large model includes the following steps: The sample data of the labeled fraudulent websites are integrated with the sample data of normal websites to build a large model training dataset; Known fraudulent domain names are selected as input features, and single-feature association analysis and multi-feature association analysis are performed through a large model. The detection system generates a report identifying suspected fraudulent websites; The reports identifying fraudulent websites will be used to implement measures such as domain name blocking, IP blocking, and certificate revocation; at the same time, the fraudulent characteristics will be updated to the feature database of the detection system.

6. The method according to claim 2, characterized in that, The process of deduplicating and standardizing the collected DNS resolution data to generate cleaned DNS resolution data includes the following steps: Based on the collected DNS resolution data, duplicate resolution records for the same URL under the same timestamp are deleted; Remove records from the collected DNS resolution data that have failed to resolve or have incomplete data; For DNS resolution data that has temporarily failed due to network fluctuations, re-initiate the resolution request to collect the data again. Verify the consistency between the collected DNS resolution data registration information and the filing information, and mark any contradictory or abnormal data.

7. The method according to claim 5, characterized in that, The single-feature association analysis includes alias association analysis, IP association analysis, and certificate association analysis.

8. The method according to claim 5, characterized in that, The multi-feature association analysis includes the following steps: Multiple features of known fraudulent websites are selected as combined input features; Based on the combined input features, the large model constructs multi-feature association paths in the relational network; The overall risk score of the large model calculation path; If the path risk score is greater than or equal to 2.0, and the domain name at the end of the path has no historical detection record, it will be marked as a domain name suspected of being involved in fraud.

9. A system for detecting and identifying fraudulent websites based on network attribute features, characterized in that, The system for implementing the methods of claims 1-8 includes a data acquisition module, a data processing module, a feature extraction module, a relationship network construction module, and a large model analysis module; The data acquisition module is used to initiate distributed DNS resolution requests to collect resolution data, and to call third-party APIs and crawlers to collect basic domain name information and URL structure data. The data processing module is used to deduplicate the collected data, supplement incomplete data, verify the consistency of information, generate cleaned data, and integrate and build a database. The feature extraction module is used to extract four types of features: website content, domain name resolution, IP association, and domain name certificate. The relational network construction module is used to organize core relations, build a network using a graph database, and identify and delete isolated nodes. The large model analysis module is used to construct training datasets, perform single / multi-feature association analysis, and calculate risk scores to label suspected domain names.

10. An electronic device, characterized in that, The device for implementing the method of claims 1-8 includes a processor and a memory; The processor is used to perform all computational tasks to implement a method for detecting and identifying fraudulent websites based on network attribute features; The memory is used to store processor-executable instructions and statically stored data.

Images