WO2018099219A1 - Method and device for detecting phishing website - Google Patents

Abstract

The invention relates to the field of communications, and specifically, to a method and device for detecting a phishing website, effectively determining, when a URL domain name is a valid domain name, whether a target website being accessed by a user is a phishing website. The method comprises: obtaining a uniform resource locator (URL) to be determined of a target website; determining that the URL to be determined is a valid domain name; obtaining, from the target website, a hypertext transfer protocol secure (HTTPS) certificate to be determined and corresponding to the URL to be determined; obtaining, from a server corresponding to the domain name of the URL to be determined, a valid HTTPS certificate corresponding to the domain name of the URL to be determined; and determining, according to a preconfigured information item in the HTTPS certificate to be determined and a preconfigured information item in the valid HTTPS certificate, whether the target website is a phishing website. As a result, the embodiment is utilized to effectively determine, when a URL domain name is a valid domain name, whether a target website being accessed by a user is a phishing website.

Description

Method and device for detecting phishing website

The present invention claims the priority of the Chinese patent application filed on November 29, 2016 by the Intellectual Property Office of the People's Republic of China, the application number is 201611076447.2, and the invention name is "a phishing website detection method and apparatus", the entire contents of which are incorporated by reference. In the present invention.

Technical field

The present invention relates to the field of communications technologies, and in particular, to a phishing website detecting method and apparatus.

Background technique

Phishing websites usually pretend to be bank and e-commerce websites, stealing private information such as bank accounts and passwords submitted by users. A malicious attacker provides a seemingly normal bank or financial website domain name to the victim through pseudo base stations, phishing emails, etc., and tricks the user into opening a sensitive name, password, card number, ID number, etc. in the phishing website. information.

The existing tools for detecting phishing websites mainly use blacklists, whitelists, heuristic analysis and other techniques to identify the URLs of phishing websites. If the domain name of the Uniform Resource Locator (URL) is incorrect, the blacklist and whitelist phishing detection technologies are used for detection. The blacklist-based phishing detection technology is based on known The database constructed by the wrong URL to determine whether the target website is a phishing website, but because the phishing website often has a short time and the blacklist is updated in a timely manner, it is very difficult to prevent the phishing; the whitelist-based phishing website detection technology It is based on the database constructed by the trusted website address to determine whether the target website is a legitimate website. Due to the large number of trusted website addresses, if the legitimate website accessed by the user is not added to the database, the legitimate website may be misjudged as a phishing website.

When the domain name of the URL to be detected is correct, the phishing detection technology of the heuristic analysis is mainly used for detecting: comparing the similarity between the target website and the legitimate website to determine whether the target website is a phishing website, but This detection method is easily bypassed by some deceptions, resulting in a certain degree of missed detection on the phishing website.

In the prior art, the target website is detected as a phishing website according to the URL to be detected or according to the similarity of the page layout of the target website and the legal website, and the domain name system (DNS) hijacking, traffic hijacking, and secure hypertext transfer protocol are used. (Secure Hypertext Transfer Protocol, HTTPS for short) is a sophisticated phishing attack. The domain name corresponding to the URL to be detected is a legal domain name, and the similarity between the target website and the legitimate website is extremely high. The methods in the prior art cannot be effectively determined. Whether the target website is a phishing website. Therefore, there is a need for a phishing website detection method to effectively detect whether the target website that the user is visiting is a phishing website when the domain name of the URL to be detected is a legal domain name.

Summary of the invention

The embodiment of the invention provides a method and a device for detecting a phishing website, which are used to effectively detect whether a target website that the user is visiting is a phishing website when the domain name of the URL to be detected is a legal domain name.

In a first aspect, the embodiment of the present invention provides a method for detecting a phishing website, including: acquiring a URL of a target website to be detected, and a domain name corresponding to the URL to be detected is a legal domain name; And detecting, by the server corresponding to the domain name of the to-be-detected URL, a legal HTTPS certificate corresponding to the domain name of the to-be-detected URL; and including, according to the to-be-detected HTTPS certificate, the HTTPS certificate to be detected The preset information item and the preset information item included in the legal HTTPS certificate determine whether the target website is a phishing website.

Optionally, the determining, according to the preset information item included in the HTTPS certificate to be detected, and the preset information item included in the legal HTTPS certificate, whether the target website is a phishing website, includes: determining If the preset information item included in the HTTPS certificate and the preset information items included in the legal HTTPS certificate all match, the target website is determined to be a normal website.

Optionally, the determining, according to the preset information item included in the HTTPS certificate to be detected, and the preset information item included in the legal HTTPS certificate, whether the target website is a phishing website, includes: determining If at least one of the preset information items included in the HTTPS certificate and the preset information item included in the legal HTTPS certificate does not match: determining the to-be-checked The certificate issuer identifier included in the HTTPS certificate is matched with the certificate issuer identifier included in the legal HTTPS certificate, and the HTTPS certificate to be detected is determined to be valid at the current time according to the validity period of the certificate in the HTTPS certificate to be detected, and according to And determining, by the information about whether the certificate in the HTTPS certificate to be logged off is logged off, that the HTTPS certificate to be detected is not logged out, determining that the target website is a normal website.

Optionally, the determining, according to the preset information item included in the HTTPS certificate to be detected, and the preset information item included in the legal HTTPS certificate, whether the target website is a phishing website, includes: determining If the at least one of the preset information items included in the HTTPS certificate and the preset information item included in the legal HTTPS certificate does not match: determining that the HTTPS certificate to be detected and the HTTPS certificate to be detected are satisfied Determining, by the at least one of the first preset conditions, that the target website is a phishing website; wherein the first preset condition comprises: determining a certificate issuer identifier included in the HTTPS certificate to be detected and the The certificate issuer identifiers included in the valid HTTPS certificate are not matched; and the HTTPS certificate to be detected is invalidated according to the validity period of the certificate in the HTTPS certificate to be detected; according to whether the certificate in the HTTPS certificate to be detected is cancelled. The information determines that the HTTPS certificate to be detected is logged out.

Optionally, after the obtaining the to-be-detected URL of the target website, obtaining the HTTPS certificate to be detected corresponding to the to-be-detected URL from the target website, the method further includes: determining that the to-be-detected URL uses HTTPS.

Optionally, after the obtaining the to-be-detected URL of the target website, obtaining the HTTPS certificate to be detected corresponding to the URL to be detected from the target website, the method further includes: determining that the URL to be detected does not use HTTPS, The alarm information is reported, and the alarm information is used to indicate that the target website is in danger.

Optionally, after the obtaining the to-be-detected URL of the target website, obtaining the HTTPS certificate to be detected corresponding to the to-be-detected URL from the target website, the method further includes: determining that the to-be-detected URL meets any of the second preset conditions. The one or more items, wherein the second preset condition comprises: determining that the domain name of the URL to be detected matches with at least one preset URL domain name; determining the obtained webpage source code corresponding to the to-be-detected URL At least one of the attribute class keywords in the default The keyword matching is determined; at least one of the input class keywords in the webpage source code corresponding to the obtained URL to be detected is matched with the preset input keyword.

In a second aspect, the phishing website detecting apparatus provided by the embodiment of the present invention includes: an obtaining unit, configured to acquire a URL of a target website to be detected, and a domain name corresponding to the URL to be detected is a legal domain name; The target website obtains the HTTPS certificate to be detected corresponding to the URL to be detected, and obtains a valid HTTPS certificate corresponding to the domain name of the URL to be detected from the server corresponding to the domain name of the URL to be detected; the processing unit is configured to: And determining, according to the preset information item included in the HTTPS certificate to be detected, and the preset information item included in the legal HTTPS certificate, whether the target website is a phishing website.

Optionally, the processing unit is configured to determine the target if it is determined that the preset information item included in the HTTPS certificate to be detected and the preset information items included in the legal HTTPS certificate all match The website is a normal website.

Optionally, the processing unit is configured to: when it is determined that at least one of the preset information items included in the HTTPS certificate to be detected and the preset information item included in the legal HTTPS certificate does not match Determining that the certificate issuer identifier included in the HTTPS certificate to be detected matches the certificate issuer identifier included in the legal HTTPS certificate, and determining the HTTPS certificate to be detected according to the validity period of the certificate in the HTTPS certificate to be detected. The current time is valid, and it is determined that the to-be-detected HTTPS certificate is not logged out according to the information of whether the certificate in the HTTPS certificate to be detected is logged off, and the target website is determined to be a normal website.

Optionally, the processing unit is configured to: when it is determined that at least one of the preset information items included in the HTTPS certificate to be detected and the preset information item included in the legal HTTPS certificate does not match Determining that the to-be-detected HTTPS certificate and the to-be-detected HTTPS certificate satisfy at least one of the first preset conditions, determining that the target website is a phishing website; wherein the first preset condition comprises: determining The certificate issuer identifier included in the HTTPS certificate to be detected does not match the certificate issuer identifier included in the legal HTTPS certificate; and the HTTPS certificate to be detected is determined at the current time according to the validity period of the certificate in the HTTPS certificate to be detected. Determining; determining the to-be-detected according to whether the certificate in the HTTPS certificate to be detected is deregistered The HTTPS certificate was logged out.

Optionally, the processing unit is further configured to: determine that the to-be-detected URL uses HTTPS.

Optionally, the processing unit is further configured to: when it is determined that the to-be-detected URL does not use HTTPS, report alarm information, where the alarm information is used to indicate that the target website is in danger.

Optionally, the processing unit is further configured to: determine that the to-be-detected URL meets any one or more of the second preset conditions, where the second preset condition includes: determining the to-be-determined Detecting a domain name of the URL and matching the at least one preset URL domain name; determining that at least one of the attribute class keywords in the webpage source code corresponding to the acquired URL to be detected matches the preset attribute class keyword; determining the acquired At least one of the input class keywords in the webpage source code corresponding to the to-be-detected URL matches at least one of the preset input class keywords.

In a third aspect, an embodiment of the present invention provides a phishing website detecting apparatus, including a processor and a memory;

The memory is configured to store an executable program;

The processor is configured to read an executable program in the memory and execute:

Obtaining a to-be-detected uniform resource locator URL of the target website; the domain name corresponding to the URL to be detected is a legal domain name; obtaining a security hypertext transfer protocol HTTPS certificate corresponding to the to-be-detected URL from the target website; And obtaining, by the server corresponding to the domain name of the URL, a legal HTTPS certificate corresponding to the domain name of the URL to be detected; determining, according to the preset information item included in the HTTPS certificate to be detected, and the preset information item included in the legal HTTPS certificate. Whether the target website is a phishing website.

In a fourth aspect, an embodiment of the present invention provides a non-transitory computer readable storage medium, where the non-transitory computer readable storage medium stores computer instructions for causing the computer to perform the first aspect or the A method in any possible implementation on the one hand.

In a fifth aspect, an embodiment of the present invention provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions, when the program instruction is The computer, when executed, causes the computer to perform the method of the first aspect or any possible implementation of the first aspect.

In the embodiment of the present invention, the HTTPS certificate to be detected corresponding to the URL to be detected is obtained from the target website, and the domain name of the URL to be detected is correct, so that the legal HTTPS certificate corresponding to the URL to be detected can be obtained; the domain name of one URL corresponds to a legal HTTPS certificate. The server corresponding to the domain name of the detected URL obtains the legal HTTPS certificate corresponding to the domain name of the URL to be detected, and according to the HTTPS certificate to be detected and the legal HTTPS certificate, it can effectively detect whether the target website that the user is visiting is a phishing website.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly described below.

1 is a schematic structural diagram of a system for detecting a phishing website according to an embodiment of the present invention;

2 is a schematic flowchart of a method for detecting a phishing website according to an embodiment of the present invention;

FIG. 3 is a schematic flowchart of another method for detecting a phishing website according to an embodiment of the present invention;

4 is a schematic structural diagram of a phishing website detecting apparatus according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of another phishing website detecting apparatus according to an embodiment of the present invention.

detailed description

The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

FIG. 1 is a schematic diagram showing the system architecture of the phishing website detection according to the embodiment of the present invention. As shown in FIG. 1 , the phishing website detection system architecture 100 applicable to the embodiment of the present invention includes a server 101, a server 102, a terminal 103, and a fishing system. The website detecting device 104; the server 101, the server 102, and the terminal 103 may be connected by a wireless connection or a wired connection or other means; the server 101, the server 102, and the phishing website detecting device 104 may also be connected by a wireless connection or a wired connection or other means; The server 101 is a server corresponding to the target website, the server 102 is a server corresponding to the domain name of the URL to be detected, and the phishing website detecting device 104 is installed in the terminal 103.

The terminal 103 transmits the URL of the access target website to the server 101, and after receiving the URL, the server 101 transmits the web page content corresponding to the URL, such as the web page source code, to the terminal 103. The phishing website detecting means 104 can obtain the HTTPS certificate to be detected from the server 102; the phishing website detecting means 104 can obtain the legal HTTPS certificate corresponding to the domain name of the URL from the server 102. For example, if the target website is Baidu, the URL corresponding to Baidu is https://www.baidu.com/, and the domain name of the URL is www.baidu.com.

Optionally, the terminal 103 may be a mobile phone, a tablet computer, a computer, or the like; optionally, the phishing website detecting device 104 may be installed in the terminal 103 to detect whether the target website accessed by the terminal is a phishing website; The website detection device 104 can be a UnionPay program plugin or a security guard application.

FIG. 2 is a schematic flowchart diagram of a method for detecting a phishing website according to an embodiment of the present invention.

Based on the system architecture shown in FIG. 1, as shown in FIG. 2, a method for detecting a phishing website according to an embodiment of the present invention includes the following steps:

Step S201: The phishing website detecting device acquires the to-be-detected uniform resource locator URL of the target website; the domain name corresponding to the to-be-detected URL is a legal domain name;

Step S202: The phishing website detecting device acquires, from the target website, a security hypertext transfer protocol HTTPS certificate to be detected corresponding to the URL to be detected;

Step S203: The phishing website detecting device acquires a legal HTTPS certificate corresponding to the domain name of the URL to be detected from the server corresponding to the domain name of the URL to be detected;

Step S204: The phishing website detecting device determines, according to the preset information item included in the HTTPS certificate to be detected and the preset information item included in the legal HTTPS certificate, whether the target website is a phishing website.

Based on the above embodiment, in step S201, the legal domain name is the correct domain name of the target website that the user is expected to access; for example, the target website that the user currently visits is expected to visit is ICBC, and the URL to be detected input by the user is http://www. Icbc.com.cn/icbc/, the domain name of the URL to be detected is www.icbc.com.cn, this domain name is the correct domain name of Industrial and Commercial Bank of China, which is a legal domain name. In Under normal circumstances, when the user visits http://www.icbc.com.cn/icbc/, the target website is the website that the user expects to visit: Industrial and Commercial Bank of China; complex in the DNS hijacking, traffic hijacking, HTTPS middleman, etc. In the case of phishing attacks, when the user currently visits http://www.icbc.com.cn/icbc/, the corresponding domain name is still the legal domain name www.icbc.com.cn, but the target website that the user enters is The phishing website can not effectively detect whether the target website corresponding to the domain name of the URL to be detected by the user is a phishing website, and the method provided by the embodiment of the present invention can effectively detect the to-be-detected URL currently accessed by the user. Whether the target website corresponding to the legal domain name is a phishing website.

In the embodiment of the present invention, the phishing website detecting device takes the UnionPay program plug-in as an example, and the UnionPay program plug-in uses a Transport Layer Security Protocol (TLS) to securely connect to the UnionPay backend server; the UnionPay backend server according to the domain name of the URL to be detected. If there is a valid HTTPS certificate corresponding to the domain name of the URL to be detected in the cache database of the UnionPay background server, the legal HTTPS certificate is directly sent to the UnionPay program plug-in to verify the validity of the HTTPS certificate to be detected; if the UnionPay background server caches the database itself The valid HTTPS certificate corresponding to the domain name of the URL to be detected does not exist. The UnionPay background server actively accesses the URL to be detected, obtains the legal HTTPS certificate corresponding to the URL to be detected from the server corresponding to the domain name of the URL to be detected, and stores the legal HTTPS certificate in itself. The database is cached, and the legal HTTPS certificate corresponding to the URL to be detected is sent to the UnionPay program plugin. In order to ensure the timeliness of its own cache database, the UnionPay backend server periodically verifies whether the HTTPS certificate in its own cache database is logged out or not in the validity period. If the HTTPS certificate is logged out or not in the validity period, the HTTPS certificate is marked as invalid. HTTPS certificate.

In the embodiment of the present invention, any one of the HTTPS certificate and the valid HTTPS certificate to be detected includes a plurality of key factors such as a certificate issuer identifier, a certificate validity period, a certificate serial number, and a certificate signature. Optionally, the preset information item may be Including any one of a plurality of key factors, for example, the certificate issuer identifier is used as a preset information item; the preset information item may also include any N of a plurality of key factors, and N is an integer greater than 1, for example, issuing a certificate The identifier of the certificate and the validity period of the certificate are used as preset information items, for example, the certificate issuer identifier and the certificate serial number are used as preset information items, and for example, the certificate is The issuer ID, certificate serial number, and certificate signature are used as preset information items.

In the embodiment of the present invention, the HTTPS certificate to be detected corresponding to the URL to be detected is obtained from the target website, and the domain name of the URL to be detected is correct, so that the legal HTTPS certificate corresponding to the URL to be detected can be obtained; the domain name of one URL corresponds to a legal HTTPS certificate. The server corresponding to the domain name of the URL to be detected obtains the legal HTTPS certificate corresponding to the domain name of the URL to be detected, and according to the HTTPS certificate to be detected and the legal HTTPS certificate, it can effectively detect whether the target website that the user is visiting is a phishing website.

Optionally, the determining, according to the preset information item included in the HTTPS certificate to be detected, and the preset information item included in the legal HTTPS certificate, whether the target website is a phishing website, includes: determining If the preset information item included in the HTTPS certificate and the preset information items included in the legal HTTPS certificate all match, the target website is determined to be a normal website.

Optionally, when the preset information item includes a key factor, for example, the preset information item is a certificate issuer identifier, and the certificate issuer identifier included in the HTTPS certificate to be detected and the certificate included in the legal HTTPS certificate are determined. In the case that the issuer identifier matches, the target website is determined to be a normal website; optionally, when the preset information item includes N key factors, for example, N is equal to 2, and the two key factors included in the preset information item are The certificate issuer identifier and the certificate serial number are used as an example, and the certificate issuer identifier, the certificate serial number, and the certificate issuer identifier and the certificate serial number included in the legal HTTPS certificate are all matched in the determination of the HTTPS certificate to be detected. In the case, the target website is determined to be a normal website; for example, N is equal to 4, and the four key factors included in the preset information item are the certificate issuer identifier, the certificate validity period, the certificate serial number, and the certificate signature. Declaring the certificate issuer ID, the certificate validity period, the certificate serial number, the certificate signature, and the package in the legal HTTPS certificate included in the detected HTTPS certificate The identity of the certificate issuer certificate is valid, the certificate serial number, in the case of all certificate signature matching to determine the target site is a normal website.

Optionally, if it is determined that at least one of the preset information item included in the HTTPS certificate to be detected and the preset information item included in the legal HTTPS certificate does not match, determining that the target website is a phishing website . For example, N is equal to 2, and the four key factors included in the preset information item are the certificate issuer identifier and the certificate serial number, and the certificate included in the HTTPS certificate to be detected is determined. And determining, in the case that the issuer identifier and the certificate issuer identifier included in the legal HTTPS certificate do not match, determining that the target website is a phishing website; or determining a certificate serial number included in the HTTPS certificate to be detected and the If the certificate serial number included in the legal HTTPS certificate does not match, determining that the target website is a phishing website; or determining a certificate issuer identifier, a certificate serial number, and the legal HTTPS included in the HTTPS certificate to be detected. If the certificate issuer ID and the certificate serial number included in the certificate do not match, the target website is determined to be a phishing website. In this way, the phishing website detecting device can determine whether the HTTPS certificate to be detected is a legitimate certificate according to whether the preset information items included in the HTTPS certificate to be detected and the legal HTTPS certificate are completely matched, thereby effectively determining whether the target website is a normal website; If the HTTPS certificate is a valid certificate, the target website is determined to be a normal website, and the terminal can browse the webpage corresponding to the URL to be detected normally; if it is determined that the HTTPS certificate is not a legal certificate, the target website is determined to be a phishing website, and the police information is reported, and Remind users not to continue to access the web page corresponding to the URL to be detected to avoid the disclosure of personal information. The method provided in the embodiment of the present invention does not need to perform black and white list query of the URL to be detected, so the detection result is not affected by the update frequency and coverage rate of the black and white list database.

Optionally, the determining, according to the preset information item included in the HTTPS certificate to be detected, and the preset information item included in the legal HTTPS certificate, whether the target website is a phishing website, includes: determining If at least one of the preset information items included in the HTTPS certificate and the preset information item included in the legal HTTPS certificate does not match, the target is determined if the following three conditions are met simultaneously. The website is a normal website: condition one, determining that the certificate issuer identifier included in the HTTPS certificate to be detected matches the certificate issuer identifier included in the legal HTTPS certificate; condition two, according to the certificate in the HTTPS certificate to be detected The validity period determines that the HTTPS certificate to be detected is valid at the current time; and the third condition determines that the HTTPS certificate to be detected is not logged out according to the information of whether the certificate in the HTTPS certificate to be detected is logged off. In this case, if it is determined that at least one of the preset information items included in the HTTPS certificate to be detected and the preset information item included in the legal HTTPS certificate does not match, the phishing website detecting device may Conditions to determine if the target site is a normal site.

In the actual application scenario, due to the content delivery network (Content Delivery Network, referred to as CDN) or load balancing exists. The HTTPS certificates to be detected may be inconsistent when different terminals access the target website. For example, the terminal in East China connects to the target website server in East China and the terminal in South China connects to the server in South China. The HTTPS certificate includes the same certificate issuer ID, and the certificate serial number may be different. The solution provided by the embodiment of the present invention fully considers that the HTTPS certificate that may be obtained when different terminals access the target website may be inconsistent due to the existence of the CDN or the load balancing, and avoids the preset information of the HTTPS certificate to be detected and the legal HTTPS certificate. There is at least one mismatched normal website identified as a phishing website.

Optionally, the determining, according to the preset information item included in the HTTPS certificate to be detected, and the preset information item included in the legal HTTPS certificate, whether the target website is a phishing website, includes: determining If the at least one of the preset information items included in the HTTPS certificate and the preset information item included in the legal HTTPS certificate does not match: determining that the HTTPS certificate to be detected and the HTTPS certificate to be detected are satisfied Determining, by the at least one of the first preset conditions, that the target website is a phishing website; wherein the first preset condition comprises: determining a certificate issuer identifier included in the HTTPS certificate to be detected and the The certificate issuer identifiers included in the valid HTTPS certificate are not matched; and the HTTPS certificate to be detected is invalidated according to the validity period of the certificate in the HTTPS certificate to be detected; according to whether the certificate in the HTTPS certificate to be detected is cancelled. The information determines that the HTTPS certificate to be detected is logged out. As such, in the solution provided by the embodiment of the present invention, when it is determined that at least one of the preset information items included in the HTTPS certificate to be detected and the preset information item included in the legal HTTPS certificate does not match, Considering the fact that the HTTPS certificate may be inconsistent when different terminals access the target website due to the existence of CDN or load balancing, and more accurately the target website whose HTTPS certificate to be detected satisfies at least one of the above first preset conditions. Determined to be a phishing site. The method provided in the embodiment of the present invention does not need to perform black and white list query of the URL to be detected, so the detection result is not affected by the update frequency and coverage rate of the black and white list database; meanwhile, the URL of all websites can be avoided and verified. Whether the URL of all websites is a waste of resources for phishing websites.

Optionally, after the obtaining the to-be-detected URL of the target website, obtaining the HTTPS certificate to be detected corresponding to the URL to be detected from the target website, the method further includes: determining the URL to be detected. Use secure hypertext transfer protocol HTTPS. For example, the URL to be detected is https://zhidao.baidu.com/, and the protocol of the URL to be detected is HTTPS. In this way, the phishing detection device can continue to obtain the HTTPS certificate to be detected according to the HTTPS used by the URL to be detected, and continue to determine the pending Check the validity of the HTTPS certificate to determine whether the target website is a phishing website.

Optionally, after the obtaining the to-be-detected URL of the target website, obtaining the HTTPS certificate to be detected corresponding to the URL to be detected from the target website, the method further includes: determining that the URL to be detected does not use HTTPS, The alarm information is reported, and the alarm information is used to indicate that the target website is in danger. For example, the URL to be detected is http://abc.com/, the protocol of the URL to be detected is http, and HTTPS is not used; thus, the phishing detection device does not need to continue to obtain the HTTPS certificate to be detected, and may not use HTTPS according to the URL to be detected. Directly report dangerous alarm information on the target website to prevent users from entering the dangerous target website without knowing it.

Optionally, after the obtaining the to-be-detected URL of the target website, obtaining the HTTPS certificate to be detected corresponding to the to-be-detected URL from the target website, the method further includes: determining that the to-be-detected URL meets any of the second preset conditions. One or more, wherein the second preset condition includes: condition one, determining that the domain name of the URL to be detected matches the at least one preset URL domain name; and second, determining the acquired to-be-detected At least one of the attribute class keywords in the webpage source code corresponding to the URL is matched with the preset attribute class keyword; condition three, determining that at least the input class keyword in the webpage source code corresponding to the acquired URL to be detected is present One matches the default input class keyword. Optionally, after the obtaining the to-be-detected URL of the target website, determining that the to-be-detected URL meets any one of the second preset conditions, determining that the target website is a normal website, and the terminal is normally accessible on the terminal. Target website.

In the embodiment of the present invention, the preset URL domain name may be set according to actual needs. Optionally, the preset URL domain name may be set as a domain name of a website related to bank account information and personal information; optionally, The URL domain name can be the domain name of the bank website URL. For example, the domain name of ICBC is www.icbc.com.cn; for example, the domain name of the Agricultural Bank of China is www.abchina.com; the default URL domain name can also be For the social networking site URL domain name, for example, the Sina Weibo URL domain name is weibo.com. The preset attribute category keywords can be set according to actual needs. Optionally, the target website accessed by the terminal is a bank website, and the preset attribute category keywords may be set to include banking, online banking, payment, finance, etc.; the preset input keyword may be set according to actual needs, optionally, The preset input category keywords can be set as the login account, card number, password, ID number, and the like.

Optionally, the attribute class keyword in the webpage source code corresponding to the URL to be detected may be a <TITLE> tag, a <METAname="Keywords"/"Description"/"Copyright"> tag in the webpage source code corresponding to the URL to be detected. The CONTENT attribute in the <body> tag is extracted; optionally, the input class keyword in the webpage source code corresponding to the URL to be detected may be extracted from a tag such as an <input> tag in a webpage source code corresponding to the URL to be detected. . At the same time, it is considered that some phishing websites use screenshots to layout, and the above attribute keywords and input keywords are synchronously extracted in the pictures recognized by Optical Character Recognition (OCR).

For example, if the domain name of the URL to be detected is www.icbc.com.cn, and the domain name of the ICBC is matched, the HTTPS certificate to be detected is continuously obtained from the target website to verify whether the HTTPS certificate to be detected is legal; for example; If the domain name of the URL to be detected is www.abc.com.cn and does not match the domain name of the ICBC, it may continue to determine whether the URL to be detected satisfies Condition 2 and Condition 3 in the second preset condition, that is, Whether the attribute class keyword in the webpage source code corresponding to the URL to be detected matches at least one preset attribute class keyword, or at least one of the input class keywords matches the preset input class keyword, or the attribute class keyword is At least one of the matching with the at least one preset attribute class keyword and the input class keyword matches the preset input class keyword. In this way, whether the target website needs to perform phishing website detection according to whether the URL to be detected satisfies the second preset condition may be simple, easy, efficient, and targeted. Effectively defend against sensitive information disclosure while avoiding affecting the user experience when accessing a normal website on a terminal.

In order to introduce the above method flow more clearly, the following examples are provided by the embodiments of the present invention.

FIG. 3 is a schematic flowchart showing another method for detecting a phishing website according to an embodiment of the present invention. Based on the system architecture shown in FIG. 1, as shown in FIG. 3, the method includes the following steps:

Step S301: The phishing website detecting device acquires the uniform resource locator to be detected of the target website URL;

Step S302: The domain name corresponding to the URL to be detected is a legal domain name; if yes, step S303 is performed; if not, step S312 is performed;

Step S303: The domain name of the URL to be detected is matched with at least one preset URL domain name; if yes, step S306 is performed; if not, step S304 is performed;

Step S304: The at least one attribute keyword in the webpage source code corresponding to the acquired URL to be detected is matched with the preset attribute category keyword; if yes, step S305 is performed; if not, step S313 is performed;

Step S305: determining that at least one of the input class keywords in the webpage source code corresponding to the acquired URL to be detected matches the preset input class keyword; if yes, executing step S306; if not, executing step S313;

Step S306: determining whether the URL to be detected uses the secure hypertext transfer protocol HTTPS; if yes, executing step S307; if not, executing step S314;

Step S307: Obtain an HTTPS certificate to be detected corresponding to the URL to be detected from the target website, and obtain a legal HTTPS certificate corresponding to the domain name of the URL to be detected from the server corresponding to the domain name of the URL to be detected;

Step S308: determining whether the preset information item included in the HTTPS certificate to be detected and the preset information item included in the legal HTTPS certificate are all matched; if yes, executing step S313; if not, executing step S309;

Step S309: determining whether the certificate issuer identifier included in the HTTPS certificate to be detected and the certificate issuer identifier included in the legal HTTPS certificate match; if yes, executing step S310; if not, executing step S312;

Step S310: determining whether the HTTPS certificate to be detected is valid at the current time according to the validity period of the certificate in the HTTPS certificate to be detected; if yes, executing step S311; if not, executing step S312;

Step S311: determining whether the HTTPS certificate to be detected is not logged out according to whether the certificate in the HTTPS certificate is to be logged out; if yes, executing step S313; if not, executing step S312;

Step S312: determining that the target website is a phishing website;

Step S313: determining that the target website is a normal website;

Step S314: Reporting alarm information, where the alarm information is used to indicate that the target website is in danger.

It can be seen from the above that the method for detecting a phishing website in the embodiment of the present invention provides a method for determining whether the target website needs to perform phishing website detection according to whether the URL to be detected satisfies the second preset condition. It is highly efficient and targeted, and can effectively prevent sensitive information from being leaked, while avoiding affecting the user experience when users access the normal website on the terminal. In the embodiment of the present invention, the HTTPS certificate to be detected corresponding to the URL to be detected is obtained from the target website, and the domain name of the URL to be detected is correct, so that the legal HTTPS certificate corresponding to the URL to be detected can be obtained; the domain name of one URL corresponds to a legal HTTPS certificate. The server corresponding to the domain name of the URL to be detected obtains the legal HTTPS certificate corresponding to the domain name of the URL to be detected, and according to the HTTPS certificate to be detected and the legal HTTPS certificate, it can effectively detect whether the target website that the user is visiting is a phishing website. The embodiment of the present invention fully considers that the HTTPS certificate may be inconsistent when different terminals access the target website due to the existence of CDN or load balancing, and more accurately and effectively detect whether the target website that the user is visiting is a phishing website. Further, the method provided in the embodiment of the present invention does not need to perform black and white list query of the URL to be detected, so the detection result is not affected by the update frequency and coverage rate of the black and white list database, and the URL of all websites can be avoided and verified. Whether the URL of all websites is a waste of resources for phishing websites.

FIG. 4 is a schematic structural diagram of a phishing website detecting apparatus according to an embodiment of the present invention.

Based on the same concept, a phishing website detecting apparatus provided by an embodiment of the present invention is configured to execute the foregoing method. As shown in FIG. 4, the phishing website detecting apparatus 400 includes an obtaining unit 401 and a processing unit 402.

The obtaining unit 401 is configured to obtain a to-be-detected uniform resource locator URL of the target website, where the domain name corresponding to the to-be-detected URL is a legal domain name, and obtain the HTTPS certificate to be detected corresponding to the to-be-detected URL from the target website. ; corresponding to the domain name of the URL to be detected Obtaining a legal HTTPS certificate corresponding to the domain name of the URL to be detected on the server;

The processing unit 402 is configured to determine, according to the preset information item included in the HTTPS certificate to be detected, and the preset information item included in the legal HTTPS certificate, whether the target website is a phishing website.

Optionally, the processing unit 402 is configured to: when it is determined that the preset information item included in the HTTPS certificate to be detected and the preset information items included in the legal HTTPS certificate all match, The target website is a normal website.

Optionally, the processing unit 402 is configured to: determine that at least one of the preset information items included in the HTTPS certificate to be detected and the preset information item included in the legal HTTPS certificate does not match The following: determining that the certificate issuer identifier included in the HTTPS certificate to be detected matches the certificate issuer identifier included in the legal HTTPS certificate, and determining the HTTPS certificate to be detected according to the validity period of the certificate in the HTTPS certificate to be detected. And determining, according to the information that the certificate in the HTTPS certificate to be detected is to be logged off, that the HTTPS certificate to be detected is not logged off, determining that the target website is a normal website.

Optionally, the processing unit 402 is configured to: determine that at least one of the preset information items included in the HTTPS certificate to be detected and the preset information item included in the legal HTTPS certificate does not match The following: determining that the to-be-detected HTTPS certificate and the to-be-detected HTTPS certificate meet at least one of the first preset conditions, determining that the target website is a phishing website; wherein the first preset condition includes: Determining that the certificate issuer identifier included in the HTTPS certificate to be detected does not match the certificate issuer identifier included in the legal HTTPS certificate; determining the HTTPS certificate to be detected according to the validity period of the certificate in the HTTPS certificate to be detected. The timeout is invalid; determining that the HTTPS certificate to be detected is logged out according to the information of whether the certificate in the HTTPS certificate to be detected is logged out.

Optionally, the processing unit 402 is further configured to: determine that the to-be-detected URL uses HTTPS.

Optionally, the processing unit 402 is further configured to: report, in the case that the to-be-detected URL is not using the HTTPS, to report the alarm information, where the alarm information is used to indicate that the target website is in danger.

Optionally, the processing unit 402 is further configured to: determine that the to-be-detected URL meets any one or more of the second preset conditions, where the second preset condition includes: determining the The domain name of the URL to be detected matches the at least one preset URL domain name; determining that at least one of the attribute class keywords in the webpage source code corresponding to the acquired URL to be detected matches the preset attribute class keyword; At least one of the input class keywords in the webpage source code corresponding to the obtained URL to be detected is matched with the preset input class keyword.

It can be seen from the above that: in the embodiment of the present invention, a device for detecting a phishing website is provided, and whether the target website needs to perform phishing website detection according to whether the URL to be detected satisfies the second preset condition is simple or easy. It is highly efficient and targeted, and can effectively prevent sensitive information from being leaked, while avoiding affecting the user experience when users access the normal website on the terminal. In the embodiment of the present invention, the HTTPS certificate to be detected corresponding to the URL to be detected is obtained from the target website, and the domain name of the URL to be detected is correct, so that the legal HTTPS certificate corresponding to the URL to be detected can be obtained; the domain name of one URL corresponds to a legal HTTPS certificate. The server corresponding to the domain name of the URL to be detected obtains the legal HTTPS certificate corresponding to the domain name of the URL to be detected, and according to the HTTPS certificate to be detected and the legal HTTPS certificate, it can effectively detect whether the target website that the user is visiting is a phishing website. The embodiment of the present invention fully considers that the HTTPS certificate may be inconsistent when different terminals access the target website due to the existence of CDN or load balancing, and more accurately and effectively detect whether the target website that the user is visiting is a phishing website. Further, the method provided in the embodiment of the present invention does not need to perform black and white list query of the URL to be detected, so the detection result is not affected by the update frequency and coverage rate of the black and white list database, and the URL of all websites can be avoided and verified. Whether the URL of all websites is a waste of resources for phishing websites.

Based on the same concept, the embodiment of the present invention provides another phishing website detecting apparatus, which can be used to execute the phishing website detecting method flow. FIG. 5 is a schematic structural diagram of another phishing website detecting apparatus according to an embodiment of the present invention. As shown in FIG. 5, the phishing website detecting apparatus 500 includes a processor 501 and a memory 502. Optionally, a communication interface 503 is further included, and the processor 501, the memory 502, and the communication interface 503 are connected by a bus 504.

The bus 504 can be a peripheral component interconnect (peripheral component interconnect, Referred to as PCI) bus or extended industry standard architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 5, but it does not mean that there is only one bus or one type of bus.

The memory 502 may include a volatile memory such as a random-access memory (RAM); the memory may also include a non-volatile memory such as a flash memory (flash) Memory), hard disk drive (HDD) or solid-state drive (SSD); the memory 502 may also include a combination of the above types of memory.

The communication interface 503 can be a wired communication access port, a wireless communication interface, or a combination thereof, wherein the wired communication interface can be, for example, an Ethernet interface. The Ethernet interface can be an optical interface, an electrical interface, or a combination thereof. The wireless communication interface can be a WLAN interface.

The processor 501 can be a central processing unit (CPU), a network processor (NP) or a combination of a CPU and an NP.

The processor 501 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (GAL) or any combination.

The processor 501 is configured to read a program in the memory 502 and perform the following methods:

Obtaining a to-be-detected uniform resource locator URL of the target website; the domain name corresponding to the URL to be detected is a legal domain name; obtaining a security hypertext transfer protocol HTTPS certificate corresponding to the to-be-detected URL from the target website; And obtaining, by the server corresponding to the domain name of the URL, a legal HTTPS certificate corresponding to the domain name of the URL to be detected; determining, according to the preset information item included in the HTTPS certificate to be detected, and the preset information item included in the legal HTTPS certificate. Whether the target website is a phishing website.

The memory 502 is configured to store one or more executable programs, and may store data used by the processor 501 when performing operations.

Optionally, the processor 501 is configured to: after determining that the preset information item included in the HTTPS certificate to be detected and the preset information items included in the legal HTTPS certificate all match The target website is a normal website.

Optionally, the processor 501 is configured to: determine that at least one of the preset information items included in the HTTPS certificate to be detected and the preset information item included in the legal HTTPS certificate does not match The following: determining that the certificate issuer identifier included in the HTTPS certificate to be detected matches the certificate issuer identifier included in the legal HTTPS certificate, and determining the HTTPS certificate to be detected according to the validity period of the certificate in the HTTPS certificate to be detected. And determining, according to the information that the certificate in the HTTPS certificate to be detected is to be logged off, that the HTTPS certificate to be detected is not logged off, determining that the target website is a normal website.

Optionally, the processor 501 is configured to: determine that at least one of the preset information items included in the HTTPS certificate to be detected and the preset information item included in the legal HTTPS certificate does not match The following: determining that the to-be-detected HTTPS certificate and the to-be-detected HTTPS certificate meet at least one of the first preset conditions, determining that the target website is a phishing website; wherein the first preset condition includes: Determining that the certificate issuer identifier included in the HTTPS certificate to be detected does not match the certificate issuer identifier included in the legal HTTPS certificate; determining the HTTPS certificate to be detected according to the validity period of the certificate in the HTTPS certificate to be detected. The timeout is invalid; determining that the HTTPS certificate to be detected is logged out according to the information of whether the certificate in the HTTPS certificate to be detected is logged out.

Optionally, the processor 501 is further configured to: determine that the to-be-detected URL uses HTTPS.

Optionally, the processor 501 is further configured to: report alarm information, where the alarm information is used to indicate that the target website is in danger, if it is determined that the to-be-detected URL does not use HTTPS.

Optionally, the processor 501 is further configured to: determine that the to-be-detected URL meets any one or more of the second preset conditions, where the second preset condition includes: determining the The domain name of the URL to be detected matches the at least one preset URL domain name; determining the acquired URL to be detected At least one of the attribute class keywords in the corresponding webpage source code is matched with the preset attribute class keyword; determining that at least one of the input class keywords in the webpage source code corresponding to the acquired URL to be detected is preset and preset Input class keyword matching.

It should be understood that the division of each unit above is only a division of a logical function, and the actual implementation may be integrated into one physical entity in whole or in part, or may be physically separated. In the embodiment of the present invention, the obtaining unit 401 and the processing unit 402 may be implemented by the processor 501. As shown in FIG. 5, the phishing website detecting apparatus 500 may include a processor 501, a memory 502, and optionally, a communication interface 503. The memory 502 can be used to store the code when the processor 501 executes the solution, and the code can be a program/code pre-installed when the phishing website detects the device 500.

It can be seen from the above that the phishing website detection method and device are provided in the embodiment of the present invention. The domain name of the URL to be detected is correct, because the domain name of the URL to be detected is correct, and the domain name of the URL to be detected is correct. The valid HTTPS certificate corresponding to the URL to be detected is obtained. The domain name of the URL is a legal HTTPS certificate, and the legal HTTPS certificate corresponding to the domain name of the URL to be detected is obtained from the server corresponding to the domain name of the URL to be detected. The HTTPS certificate and the legal HTTPS certificate can effectively detect whether the target website that the user is visiting is a phishing website.

In the above embodiments, it may be implemented in whole or in part by software, hardware, firmware or any combination thereof, and when implemented using a software program, may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions described in accordance with embodiments of the present application are generated in whole or in part. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device. The instructions may be stored in a computer storage medium or transferred from one computer storage medium to another computer storage medium, for example, the instructions may be wired from a website site, computer, server or data center (eg, coaxial cable, Fiber, Digital Subscriber Line (DSL) or wireless (eg infrared, wireless, microwave, etc.) is transmitted to another website, computer, server or data center. The computer storage medium can be any available media that can be accessed by a computer or a server, data that includes one or more available media integrations. Data storage devices such as the center. The usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape, a magneto-optical disk (MO), etc.), an optical medium (eg, CD, DVD, BD, HVD, etc.), or a semiconductor medium (eg, ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid state disk (SSD), etc.

Those skilled in the art will appreciate that embodiments of the present application can be provided as a method, system, or computer program product. Therefore, the embodiments of the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Moreover, embodiments of the present application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.

Embodiments of the present application are described with reference to flowchart illustrations and/or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present application. It will be understood that each flow and/or block of the flowcharts and/or block diagrams, and combinations of flow and/or blocks in the flowcharts and/or <RTIgt; These instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine such that instructions executed by a processor of a computer or other programmable data processing device are utilized for implementation A means of function specified in a flow or a flow and/or a block diagram of a block or blocks.

The instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. A function specified in a block or blocks of a flow or a flow and/or a block diagram of a flow chart.

These instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for providing instructions for execution on a computer or other programmable device The steps used to implement the functions specified in one or more of the flow or in a block or blocks of the flowchart.

It is apparent that those skilled in the art can make various modifications and variations to the embodiments of the present application without departing from the spirit and scope of the application. Thus, if these modifications and variations of the embodiments of the present application belong to the present application The scope of the claims and the equivalents thereof are intended to cover such modifications and variations.

Claims (23)

A phishing website detecting method, comprising: Obtaining a to-be-detected uniform resource locator URL of the target website; the domain name corresponding to the to-be-detected URL is a legal domain name; Acquiring, by the target website, a security hypertext transfer protocol HTTPS certificate to be detected corresponding to the URL to be detected; Obtaining a legal HTTPS certificate corresponding to the domain name of the to-be-detected URL from the server corresponding to the domain name of the URL to be detected; And determining, according to the preset information item included in the HTTPS certificate to be detected, and the preset information item included in the legal HTTPS certificate, whether the target website is a phishing website. The method according to claim 1, wherein the determining whether the target website is based on the preset information item included in the HTTPS certificate to be detected and the preset information item included in the legal HTTPS certificate Phishing sites, including: And determining, in the case that all the preset information items included in the HTTPS certificate to be detected and the preset information items included in the legal HTTPS certificate match, the target website is determined to be a normal website. The method according to claim 1 or 2, wherein the determining the target website according to the preset information item included in the HTTPS certificate to be detected and the preset information item included in the legal HTTPS certificate Whether it is a phishing website, including: When it is determined that at least one of the preset information items included in the HTTPS certificate to be detected and the preset information item included in the legal HTTPS certificate does not match: Determining that the certificate issuer identifier included in the HTTPS certificate to be detected matches the certificate issuer identifier included in the legal HTTPS certificate, and determining the HTTPS certificate to be detected according to the validity period of the certificate in the HTTPS certificate to be detected. And determining, according to the information about whether the certificate in the HTTPS certificate to be detected is deregistered, that the HTTPS certificate to be detected is not logged out, determining that the target website is a normal website. The method according to claim 1 or 2, wherein said detecting is based on said The preset information item included in the HTTPS certificate and the preset information item included in the legal HTTPS certificate determine whether the target website is a phishing website, including: When it is determined that at least one of the preset information items included in the HTTPS certificate to be detected and the preset information item included in the legal HTTPS certificate does not match: Determining that the to-be-detected HTTPS certificate and the to-be-detected HTTPS certificate meet at least one of the first preset conditions, and determining that the target website is a phishing website; wherein the first preset condition includes: Determining that the certificate issuer identifier included in the HTTPS certificate to be detected does not match the certificate issuer identifier included in the legal HTTPS certificate; Determining, according to the validity period of the certificate in the HTTPS certificate to be detected, that the HTTPS certificate to be detected is invalid at the current time; Determining that the to-be-detected HTTPS certificate is logged out according to the information of whether the certificate in the HTTPS certificate to be detected is logged out. The method of claim 1, wherein after obtaining the to-be-detected URL of the target website, obtaining the HTTPS certificate to be detected corresponding to the URL to be detected from the target website, the method further includes: Determining that the to-be-detected URL uses HTTPS. The method according to claim 5, wherein, after the obtaining the to-be-detected URL of the target website, obtaining the HTTPS certificate to be detected corresponding to the URL to be detected from the target website, the method further includes: In the case that it is determined that the to-be-detected URL does not use HTTPS, the alarm information is reported, and the alarm information is used to indicate that the target website is in danger. The method of claim 1, wherein after obtaining the to-be-detected URL of the target website, obtaining the HTTPS certificate to be detected corresponding to the URL to be detected from the target website, the method further includes: Determining that the to-be-detected URL satisfies any one or more of the second preset conditions, where the second preset condition includes: Determining that the domain name of the URL to be detected matches at least one preset URL domain name; Determining that at least one of the attribute category keywords in the webpage source code corresponding to the obtained URL to be detected matches at least one of the preset attribute category keywords; Determining that at least one of the input class keywords in the webpage source code corresponding to the acquired URL to be detected matches at least one of the preset input class keywords. A phishing website detecting device, comprising: An obtaining unit, configured to obtain a to-be-detected uniform resource locator URL of the target website; the domain name corresponding to the to-be-detected URL is a legal domain name; and the to-be-detected security hypertext transfer protocol HTTPS certificate corresponding to the to-be-detected URL is obtained from the target website; Obtaining a legal HTTPS certificate corresponding to the domain name of the to-be-detected URL from the server corresponding to the domain name of the URL to be detected; The processing unit is configured to determine, according to the preset information item included in the HTTPS certificate to be detected, and the preset information item included in the legal HTTPS certificate, whether the target website is a phishing website. The apparatus according to claim 8, wherein said processing unit is configured to: And determining, in the case that all the preset information items included in the HTTPS certificate to be detected and the preset information items included in the legal HTTPS certificate match, the target website is determined to be a normal website. The device according to claim 8 or 9, wherein the processing unit is configured to: When it is determined that at least one of the preset information items included in the HTTPS certificate to be detected and the preset information item included in the legal HTTPS certificate does not match: determining the included in the HTTPS certificate to be detected And the certificate issuer identifier is matched with the certificate issuer identifier included in the legal HTTPS certificate, and the HTTPS certificate to be detected is valid at the current time according to the validity period of the certificate in the HTTPS certificate to be detected, and according to the HTTPS certificate to be detected. If the information in the certificate is deregistered, it is determined that the HTTPS certificate to be detected is not logged out, and then the target website is determined to be a normal website. The device according to claim 8 or 9, wherein the processing unit is configured to: When it is determined that at least one of the preset information items included in the HTTPS certificate to be detected and the preset information item included in the legal HTTPS certificate does not match: Determining that the HTTPS certificate to be detected and the HTTPS certificate to be detected satisfy the first preset And determining, by the at least one item, that the target website is a phishing website; wherein the first preset condition includes: Determining that the certificate issuer identifier included in the HTTPS certificate to be detected does not match the certificate issuer identifier included in the legal HTTPS certificate; Determining, according to the validity period of the certificate in the HTTPS certificate to be detected, that the HTTPS certificate to be detected is invalid at the current time; Determining that the to-be-detected HTTPS certificate is logged out according to the information of whether the certificate in the HTTPS certificate to be detected is logged out. The device according to claim 8, wherein the processing unit is further configured to: Determining that the to-be-detected URL uses HTTPS. The device according to claim 12, wherein the processing unit is further configured to: In the case that it is determined that the to-be-detected URL does not use HTTPS, the alarm information is reported, and the alarm information is used to indicate that the target website is in danger. The device according to claim 8, wherein the processing unit is further configured to: Determining that the to-be-detected URL satisfies any one or more of the second preset conditions, where the second preset condition includes: Determining that the domain name of the URL to be detected matches at least one preset URL domain name; Determining that at least one of the attribute category keywords in the webpage source code corresponding to the obtained URL to be detected matches at least one of the preset attribute category keywords; Determining that at least one of the input class keywords in the webpage source code corresponding to the acquired URL to be detected matches at least one of the preset input class keywords. A phishing website detecting device, comprising: a processor and a memory; The memory is configured to store an executable program; The processor is configured to read an executable program in the memory and execute: Obtaining a to-be-detected uniform resource locator URL of the target website; the domain name corresponding to the URL to be detected is a legal domain name; obtaining a security hypertext transfer protocol HTTPS certificate corresponding to the to-be-detected URL from the target website; Obtaining the waiting on the server corresponding to the domain name of the URL Detecting a valid HTTPS certificate corresponding to the domain name of the URL; determining whether the target website is a phishing website according to the preset information item included in the HTTPS certificate to be detected and the preset information item included in the legal HTTPS certificate. The apparatus according to claim 15, wherein said processor is configured to: And determining, in the case that all the preset information items included in the HTTPS certificate to be detected and the preset information items included in the legal HTTPS certificate match, the target website is determined to be a normal website. The device according to claim 15 or 16, wherein the processor is configured to: When it is determined that at least one of the preset information items included in the HTTPS certificate to be detected and the preset information item included in the legal HTTPS certificate does not match: Determining that the certificate issuer identifier included in the HTTPS certificate to be detected matches the certificate issuer identifier included in the legal HTTPS certificate, and determining the HTTPS certificate to be detected according to the validity period of the certificate in the HTTPS certificate to be detected. And determining, according to the information about whether the certificate in the HTTPS certificate to be detected is deregistered, that the HTTPS certificate to be detected is not logged out, determining that the target website is a normal website. The device according to claim 15 or 16, wherein the processor is configured to: When it is determined that at least one of the preset information items included in the HTTPS certificate to be detected and the preset information item included in the legal HTTPS certificate does not match: Determining that the to-be-detected HTTPS certificate and the to-be-detected HTTPS certificate meet at least one of the first preset conditions, and determining that the target website is a phishing website; wherein the first preset condition includes: Determining that the certificate issuer identifier included in the HTTPS certificate to be detected does not match the certificate issuer identifier included in the legal HTTPS certificate; Determining, according to the validity period of the certificate in the HTTPS certificate to be detected, that the HTTPS certificate to be detected is invalid at the current time; Determining that the to-be-detected HTTPS certificate is logged out according to the information of whether the certificate in the HTTPS certificate to be detected is logged out. The device according to claim 15, wherein the processor is further configured to: Determining that the to-be-detected URL uses HTTPS. The device according to claim 19, wherein the processor is further configured to: In the case that it is determined that the to-be-detected URL does not use HTTPS, the alarm information is reported, and the alarm information is used to indicate that the target website is in danger. The device according to claim 15, wherein the processor is further configured to: Determining that the to-be-detected URL satisfies any one or more of the second preset conditions, where the second preset condition includes: Determining that the domain name of the URL to be detected matches at least one preset URL domain name; Determining that at least one of the attribute category keywords in the webpage source code corresponding to the obtained URL to be detected matches at least one of the preset attribute category keywords; Determining that at least one of the input class keywords in the webpage source code corresponding to the acquired URL to be detected matches at least one of the preset input class keywords. A non-transitory computer readable storage medium storing computer instructions for causing a computer to perform the method of any of claims 1-7 . A computer program product, comprising: a computer program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions, when the program instructions are executed by a computer, The computer performs the method of any of claims 1-7.

Images