WO2019148712A1 - Phishing website detection method, device, computer equipment and storage medium - Google Patents

Abstract

A phishing website detection method, comprising: receiving a website access request sent by a terminal; querying website data according to the website access request; constructing a document object model tree according to the queried website data; comparing the constructed document object model tree to a pre-stored phishing website model tree, and obtaining a comparison result; determining whether a website corresponding to the website access request is a phishing website according to the comparison result; and returning phishing website warning information to the terminal when determining that the website corresponding to the website access request is a phishing website.

Description

Phishing website detection method, device, computer device and storage medium

Cross-reference to related applications

This application claims to be filed on January 30, 2018, the Chinese Patent Office, the application number is 2018100912528, and the priority of the Chinese patent application entitled "Phishing Website Detection Method, Apparatus, Computer Equipment and Storage Medium" is hereby incorporated by reference. Combined in this application.

Technical field

The application relates to a phishing website detecting method, device, computer device and storage medium.

Background technique

With the development of network technology, different companies will build their own websites. Users use the website to obtain company information or services provided by the company. At the same time, there have been some malicious websites, such as phishing websites pretending to be bank websites or e-commerce websites, stealing users' private information through phishing websites.

In order to protect the user's private information, it is necessary to detect the website visited by the user. However, the inventor realized that the traditional phishing website detection is detected by keywords in the webpage content in the website, and the phishing website is detected by the webpage content keyword, and the detection by the keyword is not comprehensive enough to cause the detection of the website to be insufficient. The phishing website has a low detection accuracy.

Summary of the invention

According to various embodiments disclosed herein, a phishing website detecting method, apparatus, computer apparatus, and storage medium are provided.

A phishing website detection method includes:

Receiving a website access request sent by the terminal;

Querying website data according to the website access request;

Constructing a document object model tree based on the queried website data;

Comparing the constructed document object model tree with the pre-stored phishing website model tree to obtain a comparison result;

Determining, according to the comparison result, whether the website corresponding to the website access request is a phishing website; and

When it is determined that the website corresponding to the website access request is a phishing website, the phishing website warning information is returned to the terminal.

A phishing website detecting device includes:

An access request receiving module, configured to receive a website access request sent by the terminal;

a website data query module, configured to query website data according to the website access request;

a model tree building module, configured to build a document object model tree according to the queried website data;

a model tree comparison module, configured to compare the constructed document object model tree with a pre-stored phishing website model tree to obtain a comparison result;

a phishing website determining module, configured to determine, according to the comparison result, whether the website corresponding to the website access request is a phishing website; and

The warning information returning module is configured to return a phishing website warning message to the terminal when determining that the website corresponding to the website access request is a phishing website.

A computer device comprising a memory and one or more processors having stored therein computer readable instructions, the computer readable instructions being executable by the processor to cause the one or more processors to execute The following steps:

Receiving a website access request sent by the terminal;

Querying website data according to the website access request;

Constructing a document object model tree based on the queried website data;

Comparing the constructed document object model tree with the pre-stored phishing website model tree to obtain a comparison result;

Determining, according to the comparison result, whether the website corresponding to the website access request is a phishing website; and

When it is determined that the website corresponding to the website access request is a phishing website, the phishing website warning information is returned to the terminal.

One or more non-volatile storage media storing computer readable instructions, when executed by one or more processors, cause one or more processors to perform the following steps:

Receiving a website access request sent by the terminal;

Querying website data according to the website access request;

Constructing a document object model tree based on the queried website data;

Comparing the constructed document object model tree with the pre-stored phishing website model tree to obtain a comparison result;

Determining, according to the comparison result, whether the website corresponding to the website access request is a phishing website; and

When it is determined that the website corresponding to the website access request is a phishing website, the phishing website warning information is returned to the terminal.

Details of one or more embodiments of the present application are set forth in the accompanying drawings and description below. Other features and advantages of the present invention will be apparent from the description, drawings and claims.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings to be used in the embodiments will be briefly described below. Obviously, the drawings in the following description are only some embodiments of the present application, Those skilled in the art can also obtain other drawings based on these drawings without any creative work.

FIG. 1 is an application scenario diagram of a phishing website detection method according to one or more embodiments.

2 is a flow chart of a method for detecting a phishing website according to one or more embodiments.

3 is a flow diagram of the steps of extracting a phishing website keyword in accordance with one or more embodiments.

4 is a flow diagram of the steps of detecting a suspected phishing website in accordance with one or more embodiments.

FIG. 5 is a flow diagram showing the steps of determining weight values for each phishing website keyword in accordance with one or more embodiments.

6 is a flow diagram showing the steps of calculating the similarity between website text information and phishing website text information in accordance with one or more embodiments.

FIG. 7 is a block diagram of a phishing website detecting apparatus in accordance with one or more embodiments.

Figure 8 is a block diagram of a phishing website detecting apparatus in another embodiment.

9 is a block diagram of a computer device in accordance with one or more embodiments.

Detailed ways

In order to make the technical solutions and advantages of the present application more clear, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the application and are not intended to be limiting.

The phishing website detection method provided by the present application can be applied to an application environment as shown in FIG. 1. Terminal 102 communicates with server 104 over a network over a network. The terminal 102 can be, but is not limited to, various personal computers, notebook computers, smart phones, tablets, and portable wearable devices, and the server 104 can be implemented with a stand-alone server or a server cluster composed of a plurality of servers.

In one embodiment, as shown in FIG. 2, a phishing website detection method is provided. The method is applied to the server in FIG. 1 as an example, and includes the following steps:

S202. Receive a website access request sent by the terminal.

Specifically, the user inputs the website address in the website access page displayed by the terminal, the terminal obtains the input website address, and generates a website access request according to the website address. The terminal sends a website access request to the server. The server receives a website access request sent by the terminal.

In one embodiment, the user inputs a website identifier on the website access page displayed by the terminal, and the terminal obtains the website address according to the input website identifier, and generates a website access request according to the obtained website address.

S204. Query website data according to a website access request.

Specifically, after receiving the website access request, the server parses the website access request, and parses and extracts the website address in the website access request, and queries the website data corresponding to the extracted website address.

S206. Construct a document object model tree according to the queried website data.

Website data includes website frame data and website text information. The website framework data is used to construct a website document object model tree, and the website text information is content related data displayed in the website webpage. The Document Object Model (DOM) is a tree structure in which each element in a web page is regarded as an object, and a node structure is constructed according to the dependency relationship of each element, and only the element label is included in the node of the tree structure.

Specifically, after querying the website data, the server identifies the website frame data and the website text information in the website data according to the element tag, and uses the element label in the identified website frame data as a tree node, according to elements in the website frame data. Between the dependencies and the tree nodes build the document object model tree.

S208. Compare the constructed document object model tree with the pre-stored phishing website model tree to obtain a comparison result.

Specifically, a plurality of phishing website model trees are pre-stored in the server. The server compares the constructed document object model tree with the pre-stored phishing website model tree, and compares the results. The comparison result may be that the same phishing website model tree exists in the pre-stored phishing website model tree or the same phishing website model tree does not exist in the pre-stored phishing website model tree.

S210. Determine, according to the comparison result, whether the website corresponding to the website access request is a phishing website.

Specifically, if the comparison result is that the phishing website model tree is consistent with the constructed document object model tree in the pre-stored phishing website model tree, the server determines that the website corresponding to the website access request is a phishing website; if the comparison result is pre-stored The phishing website model tree does not exist in the phishing website model tree in which the constructed document object model tree is consistent.

For example, the comparison result may be 1 or 0. "1" indicates that there is a phishing website model tree consistent with the constructed document object model tree in the pre-stored phishing website model tree; "0" indicates in the pre-stored phishing website model tree. A phishing website model tree that does not exist in the constructed document object model tree. If the server identifies that the comparison result is "1", the server determines that the website corresponding to the website access request is a phishing website; if the server recognizes that the comparison result is "0", it determines The website corresponding to the website access request is not a phishing website.

S212. When determining that the website corresponding to the website access request is a phishing website, returning the phishing website warning information to the terminal.

Specifically, when determining that the website corresponding to the website access request is a phishing website, the server extracts the terminal address and the website address in the website access request, generates a phishing website warning information according to the website address, and sends the phishing website warning information to the terminal corresponding to the terminal address.

In one embodiment, the server extracts the website address in the website access request and marks the website address as the phishing website address when determining that the website corresponding to the website access request is a phishing website. After receiving the website access request again, the server extracts the terminal address and the website address in the website access request, detects whether the website address is marked as the phishing website address, and if it is marked as the phishing website address, generates a phishing website warning information according to the website address, and will phish The website warning message is sent to the terminal corresponding to the terminal address.

In this embodiment, the website data is queried according to the website access request, and the document object model tree is constructed according to the queried website data. Since most of the phishing websites have the same document object model tree, they are phishing websites that replace the content of the webpage to disguise as different webpage content. By constructing the corresponding document object model tree of the website, the constructed document object model is compared with the pre-stored phishing website model tree to determine whether the website access request corresponding website is a phishing website, and the document object model tree according to the website framework is more comprehensive. To detect phishing websites and improve the accuracy of phishing websites.

In one embodiment, as shown in FIG. 3, the step S202 specifically includes the step of extracting a phishing website keyword, and the step specifically includes the following content:

S302. Extract the phishing website text information and the phishing website model tree from the pre-stored phishing website data and store the phishing website.

Specifically, the server receives the phishing website data uploaded by the terminal, and stores the uploaded phishing website data to obtain pre-stored phishing website data. In the phishing website data pre-stored by the server, the phishing website text information and the phishing website model tree data are identified, the identified phishing website text information is extracted, and the phishing website model tree is obtained according to the identified phishing website model tree data.

In one embodiment, the server receives the phishing website address sent by the terminal, obtains the phishing website data of each phishing website according to each phishing website address, and stores the obtained phishing website data, and obtains corresponding pre-existing phishing websites respectively. Phishing website data. The server extracts the phishing website text information and the phishing website model tree for the pre-stored phishing website data corresponding to each phishing website, and stores the extracted phishing website text information and the phishing website model tree corresponding to the website address.

S304, splitting the phishing website text information to obtain a phishing website split word.

Specifically, the server matches the extracted phishing website text information according to the split vocabulary, extracts the matched words, and obtains a phishing website split word.

In one embodiment, the server splits the phishing website text information of each phishing website according to the split vocabulary, and obtains the phishing website split word by splitting.

S306. Count the word frequency of the phishing website split words in the phishing website text information.

The word frequency is the frequency of occurrence of a word in the phishing website text information.

Specifically, the server counts the total number of split words of the phishing website obtained by the split, the server reads the split words of the phishing website, and counts the number of occurrences of the phishing split words in the phishing website text information, and obtains the phishing websites. The number of occurrences of the word segmentation, the number of occurrences of the split words of each phishing website is divided by the total number of split words of the phishing website, and the word frequency of the split words of each phishing website is obtained.

S308, extracting a phishing website keyword from the phishing website split word according to the statistical word frequency.

Specifically, a word frequency threshold is preset in the server. The server compares the word frequency of each phishing website split word with the preset word frequency threshold, determines the phishing website split word whose word frequency exceeds the preset word frequency threshold, and extracts the determined phishing website split word as the phishing website keyword.

In one embodiment, S308 specifically includes the following steps: identifying a stop word in the phishing website split word according to the preset stop word table; deleting the stop word identified in the phishing website split word, and obtaining the remaining fishing Website split words; according to the statistics of the word frequency, the phishing website keywords are extracted from the remaining phishing website split words.

Stop words means that in the information retrieval, in order to save storage space and improve search efficiency, certain words or words are automatically filtered before or after processing natural language data or text. These words or words are called stop words. . Words that appear more frequently, but do not have substantial meaning, such as: "this", "that", "of" and so on.

Specifically, a preset stop word table is stored in the server. The server calls the preset stop word table to identify the stop word in the phishing website split word, and if the stop word in the phishing website split word is recognized, the identified stop word is deleted from the phishing website split word The remaining phishing website split words are obtained, and the phishing website split words whose word frequency exceeds the preset word frequency threshold are extracted from the remaining phishing website split words, and the extracted phishing website split words are extracted as the phishing website keywords.

S310: Store the extracted phishing website keywords to obtain pre-stored phishing website keywords.

Specifically, the server stores the extracted phishing website keywords into the phishing website keyword library, and uses the phishing website keywords in the phishing website keyword library as the pre-stored phishing website keywords.

S312. Receive a website access request sent by the terminal.

S314, querying website data according to the website access request.

S316. Detect, according to the pre-stored phishing website keyword and the website data, whether the website corresponding to the website access request is a suspected phishing website.

Specifically, the server extracts the pre-stored phishing website keyword, queries the pre-stored phishing website keyword in the website data, and counts the number of pre-stored phishing website keywords queried in the website data, and compares the counted number with the preset threshold. If the ratio is greater than the preset threshold, the website corresponding to the website access request is detected as a suspected phishing website.

In one embodiment, the server extracts the pre-stored phishing website keywords, counts the total number of pre-stored phishing website keywords, queries the pre-stored phishing website keywords in the website data, and counts the number of pre-stored phishing website keywords queried in the website data. . The server divides the number of statistics by the total number of keywords in the pre-existing phishing website, and obtains the proportion of keywords in the phishing website. The ratio of the keyword occurrence of the phishing website is compared with the threshold of the preset appearance ratio. When the proportional threshold is set, the website corresponding to the website access request is detected as a suspected phishing website.

In this embodiment, the phishing website text information is split to obtain the phishing website split word, and the phishing website keyword is extracted from the phishing website split word according to the word frequency, and the phishing website keyword is extracted to query the queried website data. When detecting that there are more pre-existing phishing websites in the website data, if it detects that the website corresponding to the website access request is a suspected phishing website, it needs to continue to detect the website according to the document object model tree, thereby improving The detection accuracy of the phishing website.

In one embodiment, as shown in FIG. 4, S316 specifically includes the step of detecting a suspected phishing website, and the step specifically includes the following contents:

S402. Extract website text information in the website data.

Specifically, the server identifies the webpage label in the website data, and identifies whether the text information included in the webpage label is included. If the webpage label includes text information, the recognized text information is extracted, and all the webpage tags in the website data are to be extracted. After the text information is included, the website text information is obtained.

S404. Detect a phishing website keyword included in the extracted website text information according to the pre-stored phishing website keyword.

Specifically, the server performs word splitting on the extracted website text information, obtains a text split word of the website text information through word splitting, identifies a stop word in the text split word, and identifies the identified stop word from the text. The split word is deleted to get the remaining text split words. The server queries the pre-stored phishing website keywords in the remaining text split words, and searches for the pre-stored phishing website keywords as the phishing website keywords included in the website text information.

In one embodiment, after S404, the method further includes: calculating the similarity between the extracted website text information and the phishing website text information according to the detected phishing website keyword and the pre-stored phishing website keyword; When the similarity is greater than the preset similarity threshold, S406 is performed.

S406: Statistics the detected word frequency of the phishing website keyword in the extracted website text information.

Specifically, the server counts the number of occurrences of each phishing website keyword in the remaining text split words, and simultaneously counts the total number of split words of the remaining text split words, and divides the number of occurrences of each phishing website keyword by the total number of split words. The word frequency of each phishing website keyword.

The word frequency is represented by TF, N is the number of occurrences of the keyword in the text information of the website, M is the total number of words of the keyword in the text information of the website, and the word frequency is calculated according to the formula TF=N/M; the word frequency refers to the text information of the keyword website. The frequency appears in the middle, that is, for a certain keyword, in the website text information including M keywords, the keyword appears N times.

S408: When the word frequency of each of the phishing website keywords is greater than a preset word frequency threshold, detecting that the website corresponding to the website access request is a suspected phishing website.

Specifically, the server compares the counted word frequency of each phishing website keyword with a preset word frequency threshold. If the word frequency of each phishing website keyword is greater than the preset word frequency threshold, the website corresponding to the website access request is detected as suspected fishing. The website performs the step of constructing a document object model tree based on the queried website data.

In this embodiment, the phishing website keyword included in the extracted website text information is detected according to the pre-stored phishing website keyword, and the word frequency of the phishing website keyword in the website text information is counted, and according to the key word frequency of each phishing website, whether the website is Suspected phishing websites, when detected as suspected phishing websites, once tested the document object model tree and improved the detection accuracy of phishing websites through various phishing websites.

In one embodiment, as shown in FIG. 5, after S308, the method further includes the step of determining a weight value of each phishing website keyword, and the step specifically includes the following content:

S502: Count the total number of phishing websites corresponding to the pre-stored phishing website data and the number of phishing websites corresponding to each phishing website keyword.

Specifically, the server extracts the phishing website identifier corresponding to the pre-stored phishing website data, and collects the total number of identifiers corresponding to the extracted phishing website identifier, and uses the total number of statistics as the total number of phishing websites. The phishing website keyword is read, and the phishing website keyword is searched for in the phishing website data corresponding to each phishing website identifier, and the number of phishing website identification corresponding to the phishing website data of the phishing website keyword is queried. The number of statistics is stored in association with the phishing website keywords read, and the number of statistics is used as the number of phishing websites corresponding to the keywords of the phishing website.

S504: Determine a weight value corresponding to each phishing website keyword according to the total number of phishing websites and the number of phishing websites corresponding to each phishing website keyword.

Specifically, IDF is used to identify the weight value corresponding to the phishing website keyword, D is used to identify the total number of phishing websites, D _{W is the} number of phishing websites corresponding to the phishing website keywords, and each fishing is calculated according to the formula IDF=log(D/D _W ). The IDF of the website keyword. The server stores the weight values corresponding to the keywords of each phishing website.

In this embodiment, according to the importance degree of the phishing website keyword in the phishing website, the weight value corresponding to each phishing website keyword is calculated, that is, the more phishing websites corresponding to a phishing website keyword, the corresponding phishing website keyword The higher the weight value, the weight value is determined according to the importance level, and the accuracy of the weight value is improved.

In one embodiment, as shown in FIG. 6, the similarity between the extracted website text information and the phishing website text information is calculated according to the detected phishing website keyword and the pre-stored phishing website keyword, specifically including calculating the website text information. The step of similarity with the phishing website text information, the step specifically includes the following contents:

S602. Query a weight value corresponding to the pre-stored phishing website keyword.

Specifically, the server stores the pre-stored phishing website keywords and the weight values corresponding to the pre-existing phishing website suspense words. The server queries each of the pre-stored phishing website keywords and the weight value corresponding to each pre-stored phishing website keyword.

S604. Build the visited website feature vector corresponding to the detected phishing website keyword and the phishing website feature vector corresponding to the pre-stored phishing website keyword according to the queried weight value.

Specifically, the server sorts the pre-stored phishing website keywords, sorts the weight values corresponding to the pre-stored phishing website keywords in the order of the pre-stored phishing website keywords, and constructs a phishing website feature vector corresponding to the pre-stored phishing website keyword. The server adds the weight value corresponding to the detected phishing website keyword to the corresponding position of the vector according to the phishing website feature vector, and sets the weight value corresponding to the undetected phishing website keyword to zero, and obtains the detected phishing website keyword corresponding Access to website feature vectors.

For example, if there are 5 pre-existing phishing website keywords a, b, c, d, and e, the corresponding weight values are 50, 40, 30, 20, and 10, and the phishing website keywords corresponding to the phishing website keywords are pre-stored. The vector is A=(50,40,30,20,10), then the phishing website keywords detected in the website data of the visiting website are a, b, c and d, then the website feature vector B=(50, 40, 30, 20, 0).

S606. Determine, according to the visited website feature vector and the phishing website feature vector, the similarity between the extracted website text information and the pre-stored phishing website text information.

Specifically, the similarity between the visited website feature vector and the phishing website feature vector is calculated, and the calculated similarity is used as the similarity between the extracted website text information and the pre-stored phishing website text information.

For example, suppose there are n keywords in the default phishing website, the feature vector of the phishing website is A=(A ₁ , A ₂ , A ₃ , ... A _n ), and the feature vector of the visiting website is B=(B ₁ , B ₂ , B ₃ ,...B _n ), the similarity between the phishing website feature vector A and the visiting website feature vector B is represented by Sim(A, B), and Sim(A, B) is calculated according to the following formula, where 1<k≤n:

In this embodiment, by accurately calculating the similarity between the visited website feature vector and the phishing website feature vector, determining whether it is a suspected phishing website according to the similarity degree, detecting whether the visiting website is a phishing website by using the similarity calculation and the document object model tree. Improve the detection efficiency of phishing websites.

It should be understood that although the various steps in the flowcharts of FIGS. 2-6 are sequentially displayed as indicated by the arrows, these steps are not necessarily performed in the order indicated by the arrows. Except as explicitly stated herein, the execution of these steps is not strictly limited, and the steps may be performed in other orders. Moreover, at least some of the steps in FIGS. 2-6 may include a plurality of sub-steps or stages, which are not necessarily performed at the same time, but may be executed at different times, these sub-steps or stages The order of execution is not necessarily performed sequentially, but may be performed alternately or alternately with at least a portion of other steps or sub-steps or stages of other steps.

In one embodiment, as shown in FIG. 7, a phishing website detecting apparatus 700 is provided, including: an access request receiving module 702, a website data query module 704, a model tree building module 706, a model tree comparing module 708, and fishing. Website determination module 710 and warning information return module 712, wherein:

The access request receiving module 702 is configured to receive a website access request sent by the terminal.

The website data query module 704 is configured to query the website data according to the website access request.

The model tree building module 706 is configured to construct a document object model tree according to the queried website data.

The model tree comparison module 708 is configured to compare the constructed document object model tree with the pre-stored phishing website model tree to obtain a comparison result.

The phishing website determining module 710 is configured to determine, according to the comparison result, whether the website corresponding to the website access request is a phishing website.

The warning information returning module 712 is configured to return the phishing website warning information to the terminal when determining that the website corresponding to the website access request is a phishing website.

In this embodiment, the website data is queried according to the website access request, and the document object model tree is constructed according to the queried website data. Since most of the phishing websites have the same document object model tree, they are phishing websites that replace the content of the webpage to disguise as different webpage content. By constructing the corresponding document object model tree of the website, the constructed document object model is compared with the pre-stored phishing website model tree to determine whether the website access request corresponding website is a phishing website, and the document object model tree according to the website framework is more comprehensive. To detect phishing websites and improve the accuracy of phishing websites.

In one embodiment, as shown in FIG. 8, the phishing website detecting apparatus 700 further includes: a model tree extracting module 714, a text information splitting module 716, a word frequency statistic module 718, a keyword extracting module 720, and a keyword storage module. 722 and suspected website detection module 724, wherein:

The model tree extraction module 714 is configured to extract and store the phishing website text information and the phishing website model tree from the pre-stored phishing website data.

The text information splitting module 716 is configured to split the phishing website text information to obtain a phishing website split word.

The word frequency statistics module 718 is configured to count the word frequency of the split words of each phishing website in the phishing website text information.

The keyword extraction module 720 is configured to extract a phishing website keyword from the phishing website split word according to the statistical word frequency.

The keyword storage module 722 is configured to store the extracted phishing website keywords to obtain pre-stored phishing website keywords.

The suspected website detecting module 724 is configured to detect, according to the pre-stored phishing website keyword and the website data, whether the website corresponding to the website access request is a suspected phishing website;

The model tree construction module 706 is further configured to construct a document object model tree according to the queried website data when detecting that the website corresponding to the website access request is a suspected phishing website.

In this embodiment, the phishing website text information is split to obtain the phishing website split word, and the phishing website keyword is extracted from the phishing website split word according to the word frequency, and the phishing website keyword is extracted to query the queried website data. When detecting that there are more pre-existing phishing websites in the website data, if it detects that the website corresponding to the website access request is a suspected phishing website, it needs to continue to detect the website according to the document object model tree, thereby improving The detection accuracy of the phishing website.

In one embodiment, the keyword extraction module 720 is further configured to identify a stop word in the phishing website split word according to the preset stop word table; delete the stop word identified in the phishing website split word, and obtain the remaining The phishing website splits the words; according to the statistics of the word frequency, the phishing website keywords are extracted from the remaining phishing website split words.

In one embodiment, the suspected website detection module 724 is further configured to extract website text information in the website data; detect the phishing website keywords included in the extracted website text information according to the pre-stored phishing website keywords; and statistically detect the phishing The word frequency of the website keyword in the extracted website text information; when the word frequency of each phishing website keyword is greater than the preset word frequency threshold, the website corresponding to the website access request is detected as a suspected phishing website.

In one embodiment, the suspected website detection module 724 calculates the similarity between the extracted website text information and the phishing website text information according to the detected phishing website keyword and the pre-stored phishing website keyword; when the calculated similarity is greater than When the similarity threshold is preset, the detected word frequency of the phishing website keyword in the extracted website text information is counted.

In this embodiment, the phishing website keyword included in the extracted website text information is detected according to the pre-stored phishing website keyword, and the word frequency of the phishing website keyword in the website text information is counted, and according to the key word frequency of each phishing website, whether the website is Suspected phishing websites, when detected as suspected phishing websites, once tested the document object model tree and improved the detection accuracy of phishing websites through various phishing websites.

In one embodiment, the phishing website detecting apparatus 700 further includes: a weight value determining module.

The weight value determining module is configured to count the total number of phishing websites corresponding to the pre-stored phishing website data and the number of phishing websites corresponding to the keywords of each phishing website; and determine the phishing websites according to the total number of phishing websites and the number of phishing websites corresponding to the keywords of each phishing website. The weight value corresponding to the keyword.

In one embodiment, the suspected website detection module 724 is further configured to query a weight value corresponding to the pre-stored phishing website keyword; and construct the visited website feature vector corresponding to the detected phishing website keyword according to the queried weight value, and Pre-existing the phishing website feature vector corresponding to the phishing website keyword; determining the similarity between the extracted website text information and the pre-stored phishing website text information according to the visiting website feature vector and the phishing website feature vector.

In this embodiment, the website data is queried according to the website access request, and the document object model tree is constructed according to the queried website data. Since most of the phishing websites have the same document object model tree, they are phishing websites that replace the content of the webpage to disguise as different webpage content. By constructing the corresponding document object model tree of the website, the constructed document object model is compared with the pre-stored phishing website model tree to determine whether the website access request corresponding website is a phishing website, and the document object model tree according to the website framework is more comprehensive. To detect phishing websites and improve the accuracy of phishing websites.

For the specific definition of the phishing website detecting device 700, reference may be made to the above definition of the phishing website detecting method, and details are not described herein again. Each of the above-described phishing website detecting devices 700 may be implemented in whole or in part by software, hardware, and combinations thereof. Each of the above modules may be embedded in or independent of the processor in the computer device, or may be stored in a memory in the computer device in a software form, so that the processor can invoke the operations corresponding to the above modules.

In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as shown in FIG. The computer device includes a processor, memory, network interface, and database connected by a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium, an internal memory. The non-volatile storage medium stores an operating system, computer readable instructions, and a database. The internal memory provides an environment for operation of an operating system and computer readable instructions in a non-volatile storage medium. The database of the computer device is used to store phishing website data. The network interface of the computer device is used to communicate with an external terminal via a network connection. The computer readable instructions are executed by the processor to implement a phishing website detection method.

It will be understood by those skilled in the art that the structure shown in FIG. 9 is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation of the computer device to which the solution of the present application is applied. The specific computer device may It includes more or fewer components than those shown in the figures, or some components are combined, or have different component arrangements.

In one embodiment, a computer apparatus is provided comprising a memory and one or more processors having stored therein computer readable instructions that, when executed by a processor, cause one or more processors The steps of the phishing website detecting method provided in any one of the embodiments of the present application are implemented.

In this embodiment, the website data is queried according to the website access request, and the document object model tree is constructed according to the queried website data. Since most of the phishing websites have the same document object model tree, they are phishing websites that replace the content of the webpage to disguise as different webpage content. By constructing the corresponding document object model tree of the website, the constructed document object model is compared with the pre-stored phishing website model tree to determine whether the website access request corresponding website is a phishing website, and the document object model tree according to the website framework is more comprehensive. To detect phishing websites and improve the accuracy of phishing websites.

In one embodiment, there is provided one or more non-volatile storage media having computer readable instructions that, when executed by one or more processors, cause one or more processors to implement the present The steps of applying the phishing website detection method provided in any of the embodiments.

In this embodiment, the website data is queried according to the website access request, and the document object model tree is constructed according to the queried website data. Since most of the phishing websites have the same document object model tree, they are phishing websites that replace the content of the webpage to disguise as different webpage content. By constructing the corresponding document object model tree of the website, the constructed document object model is compared with the pre-stored phishing website model tree to determine whether the website access request corresponding website is a phishing website, and the document object model tree according to the website framework is more comprehensive. To detect phishing websites and improve the accuracy of phishing websites.

One of ordinary skill in the art can understand that all or part of the process of implementing the above embodiments can be completed by computer readable instructions, which can be stored in a non-volatile computer. The readable storage medium, which when executed, may include the flow of an embodiment of the methods as described above. Any reference to a memory, storage, database, or other medium used in the various embodiments provided herein can include non-volatile and/or volatile memory. Non-volatile memory can include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of formats, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronization chain. Synchlink DRAM (SLDRAM), Memory Bus (Rambus) Direct RAM (RDRAM), Direct Memory Bus Dynamic RAM (DRDRAM), and Memory Bus Dynamic RAM (RDRAM).

The technical features of the above embodiments may be arbitrarily combined. For the sake of brevity of description, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, It is considered to be the range described in this specification.

The above-mentioned embodiments are merely illustrative of several embodiments of the present application, and the description thereof is more specific and detailed, but is not to be construed as limiting the scope of the invention. It should be noted that a number of variations and modifications may be made by those skilled in the art without departing from the spirit and scope of the present application. Therefore, the scope of the invention should be determined by the appended claims.

Claims (20)

A method for detecting a phishing website, comprising: Receiving a website access request sent by the terminal; Querying website data according to the website access request; Constructing a document object model tree based on the queried website data; Comparing the constructed document object model tree with the pre-stored phishing website model tree to obtain a comparison result; Determining, according to the comparison result, whether the website corresponding to the website access request is a phishing website; and When it is determined that the website corresponding to the website access request is a phishing website, the phishing website warning information is returned to the terminal. The method according to claim 1, wherein before the receiving the website access request sent by the terminal, the method further comprises: Extracting phishing website text information and phishing website model tree from pre-stored phishing website data and storing it; Splitting the text information of the phishing website to obtain a phishing website split word; Counting the word frequency of each phishing website split word in the text information of the phishing website; Extracting phishing website keywords from the phishing website split words according to the statistical word frequency; and The extracted phishing website keywords are stored to obtain pre-stored phishing website keywords; After the querying the website data according to the website access request, the method further includes: Determining, according to the pre-stored phishing website keyword and the website data, whether the website corresponding to the website access request is a suspected phishing website; and If yes, the step of constructing the document object model tree based on the queried website data is performed. The method according to claim 2, wherein the extracting the phishing website keywords from the phishing website split words according to the statistical word frequency comprises: Identify stop words in the phishing website split word according to the preset stop word table; Deleting the stop words identified in the phishing website split words, and obtaining the remaining phishing website split words; According to the statistics of the word frequency, the phishing website keywords are extracted from the remaining phishing website split words. The method according to claim 3, wherein the detecting whether the website corresponding to the website access request is a suspected phishing website according to the pre-stored phishing website keyword and the website data comprises: Extracting website text information in the website data; The phishing website keyword included in the extracted website text information is detected according to the pre-stored phishing website keyword; Statistically detecting the word frequency of the phishing website keyword in the extracted website text information; and When the word frequency of each of the phishing website keywords is greater than the preset word frequency threshold, the website corresponding to the website access request is detected as a suspected phishing website. The method according to claim 4, wherein after the detecting the phishing website keyword included in the extracted website text information according to the pre-stored phishing website keyword, the method further comprises: Calculating the similarity between the extracted website text information and the phishing website text information according to the detected phishing website keyword and the pre-stored phishing website keyword; And when the calculated similarity is greater than the preset similarity threshold, the step of performing the statistically detected keyword of the phishing website keyword in the extracted website text information is performed. The method according to claim 5, wherein after the extracting the phishing website keyword from the phishing website split word according to the statistical word frequency, the method further comprises: Counting the total number of phishing websites corresponding to the pre-stored phishing website data and the number of phishing websites corresponding to each phishing website keyword; The weight value corresponding to each phishing website keyword is determined according to the total number of phishing websites and the number of phishing websites corresponding to each phishing website keyword. The method according to claim 6, wherein the calculating the similarity between the extracted website text information and the phishing website text information according to the detected phishing website keyword and the pre-stored phishing website keyword comprises: Query the weight value corresponding to the pre-stored phishing website keyword; Constructing the visited website feature vector corresponding to the detected phishing website keyword and pre-existing the phishing website feature vector corresponding to the phishing website keyword according to the queried weight value; And determining, according to the visited website feature vector and the phishing website feature vector, the similarity between the extracted website text information and the pre-stored phishing website text information. A phishing website detecting device, comprising: An access request receiving module, configured to receive a website access request sent by the terminal; a website data query module, configured to query website data according to the website access request; a model tree building module, configured to build a document object model tree according to the queried website data; a model tree comparison module, configured to compare the constructed document object model tree with a pre-stored phishing website model tree to obtain a comparison result; a phishing website determining module, configured to determine, according to the comparison result, whether the website corresponding to the website access request is a phishing website; and The warning information returning module is configured to return a phishing website warning message to the terminal when determining that the website corresponding to the website access request is a phishing website. The device according to claim 8, further comprising: a model tree extraction module, configured to extract and store phishing website text information and a phishing website model tree from pre-stored phishing website data; a text information splitting module for splitting the phishing website text information to obtain a phishing website split word; The word frequency statistics module is used to count the word frequency of the phishing website split words in the phishing website text information; a keyword extraction module, configured to extract a phishing website keyword from a phishing website split word according to a statistical word frequency; a keyword storage module, configured to store the extracted phishing website keywords to obtain pre-stored phishing website keywords; The suspected website detection module is configured to detect whether the website corresponding to the website access request is a suspected phishing website according to the pre-stored phishing website keyword and the website data; The model tree building module is further configured to: when detecting that the website corresponding to the website access request is a suspected phishing website, construct a document object model tree according to the queried website data. The device according to claim 9, wherein the keyword extraction module is further configured to identify a stop word in the phishing website split word according to the preset stop word table; The keyword extraction module is further configured to delete the stop words identified in the phishing website split words, and obtain the remaining phishing website split words; The keyword extraction module is further configured to extract a phishing website keyword from the remaining phishing website split words according to the statistical word frequency. A computer device comprising a memory and one or more processors having stored therein computer readable instructions, the computer readable instructions being executed by the one or more processors to cause the one or more The processors perform the following steps: Receiving a website access request sent by the terminal; Querying website data according to the website access request; Constructing a document object model tree based on the queried website data; Comparing the constructed document object model tree with the pre-stored phishing website model tree to obtain a comparison result; Determining, according to the comparison result, whether the website corresponding to the website access request is a phishing website; and When it is determined that the website corresponding to the website access request is a phishing website, the phishing website warning information is returned to the terminal. The computer apparatus according to claim 11, wherein said processor further performs the following steps when said computer readable instructions are executed: Extracting phishing website text information and phishing website model tree from pre-stored phishing website data and storing it; Splitting the text information of the phishing website to obtain a phishing website split word; Counting the word frequency of each phishing website split word in the text information of the phishing website; Extracting phishing website keywords from the phishing website split words according to the statistical word frequency; and The extracted phishing website keywords are stored to obtain pre-stored phishing website keywords; After the querying the website data according to the website access request, the method further includes: Determining, according to the pre-stored phishing website keyword and the website data, whether the website corresponding to the website access request is a suspected phishing website; and If yes, the step of constructing the document object model tree based on the queried website data is performed. The computer apparatus according to claim 12, wherein said processor further performs the following steps when said computer readable instructions are executed: Identify stop words in the phishing website split word according to the preset stop word table; Deleting the stop words identified in the phishing website split words, and obtaining the remaining phishing website split words; According to the statistics of the word frequency, the phishing website keywords are extracted from the remaining phishing website split words. The computer apparatus according to claim 13, wherein said processor further performs the following steps when said computer readable instructions are executed: Extracting website text information in the website data; The phishing website keyword included in the extracted website text information is detected according to the pre-stored phishing website keyword; Statistically detecting the word frequency of the phishing website keyword in the extracted website text information; and When the word frequency of each of the phishing website keywords is greater than the preset word frequency threshold, the website corresponding to the website access request is detected as a suspected phishing website. The computer apparatus according to claim 14, wherein said processor further performs the following steps when said computer readable instructions are executed: Calculating the similarity between the extracted website text information and the phishing website text information according to the detected phishing website keyword and the pre-stored phishing website keyword; And when the calculated similarity is greater than the preset similarity threshold, the step of performing the statistically detected keyword of the phishing website keyword in the extracted website text information is performed. One or more non-transitory computer readable storage mediums storing computer readable instructions, when executed by one or more processors, cause the one or more processors to perform the following steps: Receiving a website access request sent by the terminal; Querying website data according to the website access request; Constructing a document object model tree based on the queried website data; Comparing the constructed document object model tree with the pre-stored phishing website model tree to obtain a comparison result; Determining, according to the comparison result, whether the website corresponding to the website access request is a phishing website; and When it is determined that the website corresponding to the website access request is a phishing website, the phishing website warning information is returned to the terminal. The storage medium of claim 16, wherein the processor further performs the following steps when the computer readable instructions are executed: Extracting phishing website text information and phishing website model tree from pre-stored phishing website data and storing it; Splitting the text information of the phishing website to obtain a phishing website split word; Counting the word frequency of each phishing website split word in the text information of the phishing website; Extracting phishing website keywords from the phishing website split words according to the statistical word frequency; and The extracted phishing website keywords are stored to obtain pre-stored phishing website keywords; After the querying the website data according to the website access request, the method further includes: Determining, according to the pre-stored phishing website keyword and the website data, whether the website corresponding to the website access request is a suspected phishing website; and If yes, the step of constructing the document object model tree based on the queried website data is performed. A storage medium according to claim 17, wherein said processor further performs the following steps when said computer readable instructions are executed: Identify stop words in the phishing website split word according to the preset stop word table; Deleting the stop words identified in the phishing website split words, and obtaining the remaining phishing website split words; According to the statistics of the word frequency, the phishing website keywords are extracted from the remaining phishing website split words. The storage medium of claim 18, wherein the processor further performs the following steps when the computer readable instructions are executed: Extracting website text information in the website data; The phishing website keyword included in the extracted website text information is detected according to the pre-stored phishing website keyword; Statistically detecting the word frequency of the phishing website keyword in the extracted website text information; and When the word frequency of each of the phishing website keywords is greater than the preset word frequency threshold, the website corresponding to the website access request is detected as a suspected phishing website. The storage medium of claim 19, wherein the processor further performs the following steps when the computer readable instructions are executed: Calculating the similarity between the extracted website text information and the phishing website text information according to the detected phishing website keyword and the pre-stored phishing website keyword; And when the calculated similarity is greater than the preset similarity threshold, the step of performing the statistically detected keyword of the phishing website keyword in the extracted website text information is performed.

Images