Method and system for recognizing suspicious phishing web page in combination with local content rule base

Abstract

The invention discloses a method, client side, cloud server and system for recognizing a suspicious phishing web page in combination with a local content rule base. The local content rule base comprises at least one rule and rule identification corresponding to each rule. The method includes the steps that when a browser loads a web page, content information of the web page is obtained, and appointed information is extracted from the content information of the web page; the appointed information is matched with the rules in the local content rule base; if the appointed information is matched with at least one rule in the local content rule base, the rule identification of the rule matched locally is sent to the cloud server, so that the cloud server recognizes whether the web page is the suspicious phishing web page or not according to the rule identification of the rule matched locally. Local matching and cloud recognition are combined, the detection range of the phishing web page is widened, the recognition accuracy of the phishing web page is improved, and resources of the cloud server are saved.

Description

technical field [0001] The invention relates to the technical field of the Internet, in particular to a method, a client, a cloud server and a system for identifying suspicious phishing webpages in combination with a local content rule base. Background technique [0002] With the development of the Internet, WEB-based applications are becoming more and more popular. People can query bank accounts, online shopping, e-commerce, query information, acquire knowledge, and perform entertainment through browsers. WEB provides people with a convenient and fast way of interaction. However, when people are surfing the Internet and browsing the web, they often encounter attacks from malicious websites, causing computers to be infected by viruses, Trojan horses, and the like. [0003] Malicious websites, such as phishing websites, or fraudulent, counterfeit websites, etc., mainly fake the URL address or webpage content of the real website, pretend to be banking and e-commerce websites, ...

AI Technical Summary

Problems solved by technology

[0004] The existing main means to prevent malicious websites is that when a user visits a website, the client sends the URL of the website to the server-side blacklist and whitelist database for query. However, when phishing authors use safe and normal webpages as carriers, such as government websites, in The webpage is embedded with phishing features, and the method of detecting phishing webpages based on the URL of the webpage cannot identify the embedded webpage, and the false positive rate is high

Images