Phishing webpage detection method based on Hungary matching algorithm

Abstract

A phishing webpage detection method based on Hungary matching algorithm is characterized by firstly extracting the text feature signatures, image feature signatures and general webpage feature signatures of the rendered webpages and more comprehensively depicting the features after access to webpages; and then computing the optimal matching of bipartite graphs by Hungary algorithm to search for the matched feature pairs among different webpage signatures and more objectively measuring the similarity among the webpages on the basis, thereby improving the phishing webpage detection efficiency. The method is also characterized by determining the inside weights of the text features, image features and global image features by utilizing the area under curve and determining the relative weightsamong the text similarity, image similarity and global image similarity during webpage similarity computation by utilizing logarithmic regression analysis. The precision and the recall rate are greatly improved in the method provided by the invention.

Description

technical field [0001] The invention relates to a method for detecting phishing websites, which mainly uses a Hungarian matching algorithm to analyze and identify phishing webpages from the perspective of similarity detection, and belongs to the intersecting field of information security and information acquisition. Background technique [0002] "Phishing website" is an online fraud that has become extremely rampant with the popularity of the Internet and the increase in online transactions. "Phishing websites" are fraudulent websites made by criminals. "Phishing websites" are usually almost identical to bank websites or other well-known websites, thereby luring website users to submit sensitive information (such as: user name, password, account ID, ATM PIN or credit card details, etc.). The most typical phishing attack process is as follows: first, lure users to a carefully designed phishing website that is very similar to the target organization's website, and then obtain...

AI Technical Summary

Problems solved by technology

This method expands the characteristics of phishing webpages and further improves the detection accuracy of phishing webpages to a certain extent. However, this method still only uses the information of a single webpage when extracting the characteristics of phishing webpages, so it is easy to be detected by phishing webpage creators. cheat

[0007] Existing methods mainly use a single web page request as the comparison object, and in the process of calculating web page similarity, do not select the appropriate feature pair for comparison, resulting in low calculation accuracy of web page similarity, which directly affects the accuracy and recall rate of phishing web page detection

Images