Multi-stage phishing website detection method and detection system based on supervised learning

Abstract

The invention relates to a multi-stage phishing website detection method and detection system based on supervised learning. A first detection layer performs phishing website judgment based on a blacklist database or a white list database, the to-be-detected website is directly output if the website is matched with the blacklist database or the white list database; or a second detection layer extracts features of the to-be-detected website URL and constructs a classifier model to perform detection according to the URL features of the known phishing website; if the website is detected as a suspicious website, a third detection layer downloads the page of the to-be-detected website to acquire the page content features, and the classifier model is constructed according to the known phishing website content features so as to perform the detection; an output end outputs the result that to-be-detected website is the phishing website or the normal website, and adds the data to the blacklist database and the white list database. The primary black-white list judges the known website and reduces the detection cost; the secondary URL detects and distinguish the clear phishing website or the normal website; and the third-stage page content detection identifies the suspicious website of the secondary detection, the judgment result is precise; an identification result is accurate, and the detection time is short.

Description

technical field [0001] The present invention relates to the transmission of digital information, such as the technical field of telegraph communication, and in particular to a multi-level phishing website detection method and detection system based on supervised learning with high detection accuracy and short running time. Background technique [0002] Internet phishing fraud, referred to as phishing, means that attackers trick users into clicking and visiting fake and counterfeit phishing websites by sending deceptive spam emails, instant messaging messages, etc. or credit card and other detailed information, the attacked user may lose personal private information, or suffer serious economic losses, causing extremely bad effects. This type of attack has become one of the biggest security threats to the current Internet. The main characteristics of current phishing websites are that the relevant pages are hidden more and more deeply, the URL structure is more and more compl...

AI Technical Summary

Problems solved by technology

[0007] The technical problem solved by the present invention is that the phishing website detection in the prior art has the defects that the detection of the page content characteristics is not comprehensive enough, the detection accuracy is low, the black and white list detection has hysteresis, and the new phishing website cannot be detected, and the running time is long. , and then provides an optimized multi-level phishing website detection method and detection system based on supervised learning