Method and system for detecting phishing website based on SEO (search engine optimization)

Abstract

The invention provides a method for detecting a phishing website based on SEO. The method comprises the steps as follows: the known phishing website is analyzed, and a title of the known phishing website is taken as a keyword and added into a malicious title database; a webpage obtained by saving a webpage crawler, and a webpage index database is built after an obtained webpage abstract and a corresponding URL (uniform resource locator) are filtered and reabsorbed; the webpage abstract in the webpage index database is retrieved by using the keyword in the malicious title database and / or a preset keyword, and a successfully matched webpage is saved as a suspicious webpage; and the suspicious webpage is judged with a judgment strategy, the title of the suspicious webpage which is judged to be the phishing website is added into the malicious title database. The invention further discloses a system for detecting the phishing website based on the SEO. According to the method and the system for detecting the phishing website based on the SEO, the retrieval range is reduced by abstracting the keyword, active crawling and judgment are performed on the website and the database is updated continuously, the false alarm rate is decreased, the obtained phishing website is judged automatically, and the missing report rate is reduced.

Description

technical field [0001] The invention relates to the technical field of computer network security, in particular to a method and system for actively monitoring phishing websites based on search engine optimization. Background technique [0002] Due to the development of e-commerce, online shopping has become a part of the lives of the majority of netizens. Due to the temptation of economic interests, many criminals take advantage of the psychology of netizens hoping to buy goods at low prices to set up many phishing websites to steal user accounts and conduct online shopping. scam. [0003] To deal with the current flood of phishing websites, the more mainstream method is to use the blacklist method to monitor the visited websites. Once the visited website URL appears in the blacklist database, an alarm will be issued to remind the user. At present, there are many methods for detecting phishing websites. The traditional method based on whitelist and blacklist has the disadva...

AI Technical Summary

Problems solved by technology

Phishing detection based on the Hungarian matching algorithm extracts information from the rendered webpage, uses text information and image information to form a signature, and then compares it. If the similarity exceeds a certain threshold, it is considered a phishing website. The life cycle is very short, the characteristics change quickly, and there are a large number of normal websites, which can easily cause false positives; the phishing website detection method based on classification integration needs to analyze a large number of normal websites and phishing websites, and requires good conditions in the early stage

The phishing website detection system of Zhou Zhiping of China Public Security University uses the similarity of URL to detect a single target, which can only be used to protect specific websites, and the method is relatively lagging

Images