Multistage phishing website detecting method and system

Abstract

The invention provides a multistage phishing website detecting method and system. The core concept includes that rapid filtration is integrated with precision filtration. Suspected phishing websites are controlled within a narrow range by multistage rapid filtration. Further, an accurate judgment model is trained by analyzing statistical characteristics of positive and negative patterns within a narrow range. The method includes the steps: selecting websites to be detected within a range, rapidly filtering the websites and eliminating obvious non-phishing websites; accurately judging whether the rest websites after rapid filtration are phishing websites. The system comprises a rapid filtration module and an accurate judgment module, wherein the rapid filtration module is used for selecting the websites to be detected within the range, rapidly filtering the websites and eliminating the obvious non-phishing websites, and the accurate judgment module is used for accurately judging the rest websites to be detected after rapid filtration.

Description

technical field [0001] The invention relates to the field of information technology, in particular to the field of network security technology, in particular to a multi-stage phishing website detection method and system. Background technique [0002] Today, the Internet has become an important part of people's social life, but with the continuous popularization of the Internet and the continuous improvement of application levels, in addition to traditional information security threats such as Trojan horses, viruses, and botnets, Internet phishing fraud has gradually become a One of the top attack vectors for cybercriminals. [0003] Internet phishing (phishing) is a new word commonly used in the world. The first two letters ph of phreak (the person who steals the phone line) are replaced with the f of fishing (fishing). It is a combination of social engineering (that is, deception) and network communication technology. Cybercrime means. The purpose of Internet phishing is ...

AI Technical Summary

Problems solved by technology

If the model learned based on the above machine learning algorithm is to achieve good results in the actual Internet, a necessary condition is that the training samples need to cover various Internet pages. However, most of the existing anti-phishing technology research is based on relatively small sample sets to verify the algorithm Effectiveness, some sample sets even contain only dozens of samples, and its generalizability is doubtful

In addition, even if the sample set is really large enough to cover all kinds of samples, and all kinds of samples conform to the proportion of the actual Internet, considering that phishing detection is an extremely unbalanced problem (that is, there are only hundreds of thousands of websites in the world's billion-level websites every year. Phishing websites), it is difficult to achieve good detection results by directly using existing pattern classification algorithms

Images