Phishing website detection method and system based on adaptive heterogeneous multi-classification model

Abstract

The invention provides a phishing website detection method and system based on an adaptive heterogeneous multi-classification model. The method is characterized by for a multiple-base classification algorithm, through linear addition, constructing the adaptive heterogeneous multi-classification model; training the multi-classification model, wherein a model input is the input of each base classification algorithm and an output is a sample label, and each base classification algorithm extracts a corresponding characteristic from a sample record and is taken as the input; and using a machine learning algorithm to solve a model parameter, adopting a test set to test and optimize, and finally acquiring the detection model of the type of a phishing website. The system comprises a domain name morpheme characteristic classifier, a subject index characteristic classifier, a content similarity characteristic classifier, a structural style characteristic classifier, a visual rule characteristicclassifier, a linear addition training module, an integrated classifier, a training data set management module, and a detection and alarm module. In the invention, the phishing website can be detectedin real time, and the accuracy and the stability of phishing website detection are increased.

Description

technical field [0001] The invention relates to the field of computer network security, in particular to a method and system for detecting phishing websites based on an adaptive heterogeneous multi-classification model. Background technique [0002] With the vigorous development of Internet technology, network security issues emerge in endlessly. Phishing is a typical online fraud. It uses the Internet as a carrier to deceive users to obtain sensitive information of users by disguising themselves as reputable and legitimate websites. loss. How to quickly and accurately detect phishing websites has become a research hotspot in Web (Global Wide Area Network) information security. Currently public phishing website detection technologies mainly include the following methods: [0003] (1) Detection technology based on the black and white list mechanism: as a practical core technology, the black and white list has the advantages of high efficiency and accuracy. Through the det...

AI Technical Summary

Problems solved by technology

[0011] Among the above technologies, the detection method based on the black and white list is poor in timeliness and the scope of the list is also insufficient; the detection technology based on visual similarity has complex algorithms and takes a long time to detect, and cannot be applied to massive URLs (UniformResoure Locator: Uniform Resource Locator) online real-time detection; Bayesian algorithm-based detection technology is not very ideal in terms of robustness and generalization performance; document structure-based detection technology has the problem of incomplete feature coverage and many false positives; depth-based The learned phishing website detection technology has advantages in feature recognition, but the stability of the features is poor, and it is easy to be interfered by sample pollution

Images