Phishing detection algorithm based on attention and feature fusion

ZHANG Sirui; YAN Zhiwei; DONG Kejun; YUCHI Xuebiao

doi:10.11959/j.issn.2096-109x.2024058

您当前的位置：

首页 >

文章列表页 >

Phishing detection algorithm based on attention and feature fusion

Papers

- Phishing detection algorithm based on attention and feature fusion
- Chinese Journal of Network and Information Security Vol. 10, Issue 4, Pages: 123-131(2024)
- 作者机构：
  
  中国互联网络信息中心，北京 100190
- 作者简介：
- 基金信息：
  
  The National Key Research and Development Program of China(2022YFB3105000)
- DOI：10.11959/j.issn.2096-109x.2024058
  CLC： TP393
- Received：21 May 2024，
  
  Revised：2024-07-09，
  
  Published：25 August 2024
- 稿件说明：
移动端阅览
张思睿, 延志伟, 董科军, 等. 基于注意力机制与特征融合的网络钓鱼检测算法[J]. 网络与信息安全学报, 2024, 10(4): 123-131.

Format: ZHANG S R, YAN Z W, DONG K J, et al. Phishing detection algorithm based on attention and feature fusion[J]. Chinese Journal of Network and Information Security, 2024, 10(4): 123-131.
张思睿, 延志伟, 董科军, 等. 基于注意力机制与特征融合的网络钓鱼检测算法[J]. 网络与信息安全学报, 2024, 10(4): 123-131. DOI： 10.11959/j.issn.2096-109x.2024058.

Format: ZHANG S R, YAN Z W, DONG K J, et al. Phishing detection algorithm based on attention and feature fusion[J]. Chinese Journal of Network and Information Security, 2024, 10(4): 123-131. DOI： 10.11959/j.issn.2096-109x.2024058.

摘要

网络钓鱼是攻击者实施网络诈骗犯罪的主要手段。随着国家反网络诈骗力度的不断加大，各类网络钓鱼活动的技术对抗性也日益增加，给网络钓鱼检测工作带来了较大压力。比如，网络钓鱼攻击通常会利用图像来代替文本，并对高权重的网站标志图像加以小尺度偏移或旋转等手段，来逃避传统的基于文本或图像特征的检测算法。针对网络钓鱼技术对抗性日益增加的问题，提出一种基于注意力机制与特征融合的网络钓鱼检测算法，建立包含两个阶段的融合域名、网页结构、网页文本和网页图标等特征的层级分类模型，可有效针对攻击者的各种技术对抗性策略。该算法在第一阶段利用机器学习模型的轻量特性，融合域名、文本、网页结构特征从海量域名中预召回可疑域名子集，在第二阶段基于候选子集，引入注意力机制加深样本与被仿冒对象之间的全局文本关联特征的提取，并增加样本与被仿冒对象图标间的对比特征，建立融合文本和图像特征的深度分类模型。并在实验环节对该算法的有效性进行了验证。这种分层检测方式有效避免了对海量待检测域名的图像数据抽取，在保证检测精度的前提下大大提升了检测效率。

Abstract

Phishing has been the primary means utilized by attackers to conduct cyber fraud. As national anti-cyber fraud efforts continue to increase

the technical confrontation of various phishing activities has also escalated

bringing significant pressure to phishing detection work. For instance

current phishing attacks often employ images in place of text and apply small-scale shifts or rotations to high-weight website logo images to evade traditional detection algorithms that rely on text or image features. To address the problem of escalating adversarial phishing technologies

a phishing detection algorithm based on the attention mechanism and feature fusion was proposed

and a hierarchical classification model was established. This model included two stages of fusion involving domain names

web structure

web text

and web icons

capable of effectively countering various technical adversarial strategies employed by attackers. In the first stage

the algorithm leveraged the lightweight characteristics of the machine learning model to pre-recall a subset of suspicious domain names from a multitude of domain names. This was achieved by fusing the structural features of domain names

text

and web pages. In the second stage

based on the candidate subset

the attention mechanism was introduced to enhance the extraction of global text association features between the samples and the counterfeited objects. Additionally

the contrast features between the samples and the icons of the counterfeited objects were intensified

and a deep classification model fusing text and image features was established. The effectiveness of the algorithm was ultimately verified. This hierarchical detection method effectively avoids the extraction of image data from a large number of domain names to be detected

significantly improving detection efficiency while ensuring the accuracy of detection.

关键词

Keywords

references

Anti-Phishing Working Group . Phishing attack trends report [R ] . 2022 .

曲强 , 于洪涛 , 黄瑞阳 . 基于注意力机制的社交垃圾文本检测方法 [J ] . 网络与信息安全学报 , 2020 , 6 ( 1 ): 54 - 61 .

QU Q ， YU H T ， HUANG R Y . Attention-based approach of detecting spam in social networks [J ] . Chinese Journal of Network and Information Security , 2020 , 6 ( 1 ): 54 - 61 .

JAIN A K , GUPTA B B . A novel approach to protect against phishing attacks at client side using auto-updated white-list [J ] . EURASIP Journal on Information Security , 2016 , 2016 ( 1 ): 9 .

JEEVA S C , RAJSINGH E B . Phishing URL detection-based feature selection to classifiers [J ] . International Journal of Electronic Security and Digital Forensics , 2017 , 9 ( 2 ): 116 .

ZOUINA M , OUTTAJ B . A novel lightweight URL phishing detection system using SVM and similarity index [J ] . Human-Centric Computing and Information Sciences , 2017 , 7 ( 1 ): 17 .

VERMA R , DYER K . On the character of phishing URLs: accurate and robust statistical learning classifiers [C ] // Proceedings of the 5th ACM Conference on Data and Application Security and Privacy . New York : ACM , 2015 : 111 – 122 .

KUMAR J , SANTHANAVIJAYAN A , JANET B , et al . Phishing website classification and detection using machine learning [C ] // Proceedings of the 2020 International Conference on Computer Communication and Informatics (ICCCI) . Piscataway : IEEE Press , 2020 : 1 - 6 .

BAI W H . Phishing website detection based on machine learning algorithm [C ] // Proceedings of the 2020 International Conference on Computing and Data Science (CDS) . Piscataway : IEEE Press , 2020 : 293 - 298 .

GANDOTRA E , GUPTA D . An efficient approach for phishing detection using machine learning [M ] . Multimedia Security . Singapore : Springer , 2021 : 239 - 253 .

CHIEW K L , TAN C L , WONG K , et al . A new hybrid ensemble feature selection framework for machine learning-based phishing detection system [J ] . Information Sciences , 2019 , 484 : 153 - 166 .

VIGNESHWARAN P , ROY A S , SATHVIK B S , et al . Multidimensional features driven phishing detection based on deep learning [M ] // International Conference on Intelligent Emerging Methods of Artificial Intelligence & Cloud Computing . Cham : Springer International Publishing , 2022 : 362 - 369 .

LI Y C , CHU S N , XIAO R . A pharming attack hybrid detection model based on IP addresses and web content [J ] . Optik , 2015 , 126 ( 2 ): 234 - 239 .

CHIEW K L , CHANG E H , SZE S N , et al . Utilisation of website logo for phishing detection [J ] . Computers & Security , 2015 , 54 : 16 - 26 .

YI P , GUAN Y X , ZOU F T , et al . Web phishing detection using a deep learning framework [J ] . Wireless Communications and Mobile Computing , 2018 , 2018 ( 1 ): 4678746 .

YANG P , ZHAO G Z , ZENG P . Phishing website detection based on multidimensional features driven by deep learning [J ] . IEEE Access , 2019 , 7 : 15196 - 15209 .

ZHANG L , ZHANG P , LIU L C , et al . Multiphish: multi-modal features fusion networks for phishing detection [C ] // Proceedings of the ICASSP 2021 - 2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) . Piscataway : IEEE Press , 2021 : 3520 - 3524 .

CHEN T Q , GUESTRIN C . XGBoost: a scalable tree boosting system [C ] // Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining . New York : ACM , 2016 : 785 - 794 .

MIHALCEA R , TARAU P . Textrank: bringing order into text [C ] // Proceedings of the 2004 Conference on Empirical Methods in Natural Language Processing . Barcelona : Spain , 2004 : 404 - 411 .

DEVLIN J , CHANG M , LEE K , et al . Bert: pre-training of deep bidirectional transformers for language understanding [C ] . Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics . 2019 : 4171 - 4186 .

HE K M , ZHANG X Y , REN S Q , et al . Deep residual learning for image recognition [C ] // Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2016 : 770 - 778 .

HADSELL R , CHOPRA S , LECUN Y . Dimensionality reduction by learning an invariant mapping [C ] // Proceedings of the 2006 IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR'06) . Piscataway : IEEE Press , 2006 : 1735 - 1742 .

SINGH S , SINGH M P , PANDEY R . Phishing detection from URLs using deep learning approach [C ] // Proceedings of the 2020 5th International Conference on Computing, Communication and Security (ICCCS) . Piscataway : IEEE Press , 2020 : 1 - 4 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Multi-source forgery detection method based on the fusion of color space features and frequency domain features

Cross-stream attention enhanced central difference convolutional network for CG image detection

Deep learning vulnerability detection method based on optimized inter-procedural semantics of programs

Noise-attention-based forgery face detection method

Image inpainting forensics method based on dual branch network

Related Author

Wang Jiabao

Li Yang

Zhang Qi

Wang Jun

Miao Zhuang

Hou Yifan

HUANG Yuanhang

HUANG Jinkun

Related Institution

Institute of Command-and-Control Engineering, Army Engineering University of PLA

School of Computer Science and Engineering, SunYat-sen University

Guangdong Key Laboratory of Information Security Technology

Services Computing Technology and System Lab, National Engineering Research Center for Big Data Technology

Hubei Key Laboratory of Distributed System Security

⁰