基于注意力机制与特征融合的网络钓鱼检测算法

张思睿; 延志伟; 董科军; 尉迟学彪

doi:10.11959/j.issn.2096-109x.2024058

您当前的位置：

首页 >

文章列表页 >

基于注意力机制与特征融合的网络钓鱼检测算法

学术论文

- 基于注意力机制与特征融合的网络钓鱼检测算法
- Phishing detection algorithm based on attention and feature fusion
- 网络与信息安全学报 2024年10卷第4期页码：123-131
- 作者机构：
  
  中国互联网络信息中心，北京 100190
- 作者简介：
  
  [ "张思睿（1994- ），女，陕西咸阳人，中国互联网络信息中心工程师，主要研究方向为网络安全、机器学习。" ]
  [ "延志伟（1985- ），男，山西兴县人，中国互联网络信息中心研究员，主要研究方向为域名服务安全、信息中心网络。" ]
  [ "董科军（1977- ），男，浙江舟山人，中国互联网络信息中心正高级工程师，主要研究方向为互联网基础资源管理、分布式系统。" ]
  [ "尉迟学彪（1984- ），男，山东高密人，中国互联网络信息中心研究员，主要研究方向为域名服务安全、网络空间治理。" ]
- 基金信息：
  
  国家重点研发计划(2022YFB3105000)
- DOI：10.11959/j.issn.2096-109x.2024058
  中图分类号： TP393
- 收稿：2024-05-21，
  
  修回：2024-07-09，
  
  纸质出版：2024-08-25
- 稿件说明：
移动端阅览
张思睿, 延志伟, 董科军, 等. 基于注意力机制与特征融合的网络钓鱼检测算法[J]. 网络与信息安全学报, 2024, 10(4): 123-131.

Format: ZHANG S R, YAN Z W, DONG K J, et al. Phishing detection algorithm based on attention and feature fusion[J]. Chinese Journal of Network and Information Security, 2024, 10(4): 123-131.
张思睿, 延志伟, 董科军, 等. 基于注意力机制与特征融合的网络钓鱼检测算法[J]. 网络与信息安全学报, 2024, 10(4): 123-131. DOI： 10.11959/j.issn.2096-109x.2024058.

Format: ZHANG S R, YAN Z W, DONG K J, et al. Phishing detection algorithm based on attention and feature fusion[J]. Chinese Journal of Network and Information Security, 2024, 10(4): 123-131. DOI： 10.11959/j.issn.2096-109x.2024058.

摘要

网络钓鱼是攻击者实施网络诈骗犯罪的主要手段。随着国家反网络诈骗力度的不断加大，各类网络钓鱼活动的技术对抗性也日益增加，给网络钓鱼检测工作带来了较大压力。比如，网络钓鱼攻击通常会利用图像来代替文本，并对高权重的网站标志图像加以小尺度偏移或旋转等手段，来逃避传统的基于文本或图像特征的检测算法。针对网络钓鱼技术对抗性日益增加的问题，提出一种基于注意力机制与特征融合的网络钓鱼检测算法，建立包含两个阶段的融合域名、网页结构、网页文本和网页图标等特征的层级分类模型，可有效针对攻击者的各种技术对抗性策略。该算法在第一阶段利用机器学习模型的轻量特性，融合域名、文本、网页结构特征从海量域名中预召回可疑域名子集，在第二阶段基于候选子集，引入注意力机制加深样本与被仿冒对象之间的全局文本关联特征的提取，并增加样本与被仿冒对象图标间的对比特征，建立融合文本和图像特征的深度分类模型。并在实验环节对该算法的有效性进行了验证。这种分层检测方式有效避免了对海量待检测域名的图像数据抽取，在保证检测精度的前提下大大提升了检测效率。

Abstract

Phishing has been the primary means utilized by attackers to conduct cyber fraud. As national anti-cyber fraud efforts continue to increase

the technical confrontation of various phishing activities has also escalated

bringing significant pressure to phishing detection work. For instance

current phishing attacks often employ images in place of text and apply small-scale shifts or rotations to high-weight website logo images to evade traditional detection algorithms that rely on text or image features. To address the problem of escalating adversarial phishing technologies

a phishing detection algorithm based on the attention mechanism and feature fusion was proposed

and a hierarchical classification model was established. This model included two stages of fusion involving domain names

web structure

web text

and web icons

capable of effectively countering various technical adversarial strategies employed by attackers. In the first stage

the algorithm leveraged the lightweight characteristics of the machine learning model to pre-recall a subset of suspicious domain names from a multitude of domain names. This was achieved by fusing the structural features of domain names

text

and web pages. In the second stage

based on the candidate subset

the attention mechanism was introduced to enhance the extraction of global text association features between the samples and the counterfeited objects. Additionally

the contrast features between the samples and the icons of the counterfeited objects were intensified

and a deep classification model fusing text and image features was established. The effectiveness of the algorithm was ultimately verified. This hierarchical detection method effectively avoids the extraction of image data from a large number of domain names to be detected

significantly improving detection efficiency while ensuring the accuracy of detection.

关键词

Keywords

references

Anti-Phishing Working Group . Phishing attack trends report [R ] . 2022 .

曲强 , 于洪涛 , 黄瑞阳 . 基于注意力机制的社交垃圾文本检测方法 [J ] . 网络与信息安全学报 , 2020 , 6 ( 1 ): 54 - 61 .

QU Q ， YU H T ， HUANG R Y . Attention-based approach of detecting spam in social networks [J ] . Chinese Journal of Network and Information Security , 2020 , 6 ( 1 ): 54 - 61 .

JAIN A K , GUPTA B B . A novel approach to protect against phishing attacks at client side using auto-updated white-list [J ] . EURASIP Journal on Information Security , 2016 , 2016 ( 1 ): 9 .

JEEVA S C , RAJSINGH E B . Phishing URL detection-based feature selection to classifiers [J ] . International Journal of Electronic Security and Digital Forensics , 2017 , 9 ( 2 ): 116 .

ZOUINA M , OUTTAJ B . A novel lightweight URL phishing detection system using SVM and similarity index [J ] . Human-Centric Computing and Information Sciences , 2017 , 7 ( 1 ): 17 .

VERMA R , DYER K . On the character of phishing URLs: accurate and robust statistical learning classifiers [C ] // Proceedings of the 5th ACM Conference on Data and Application Security and Privacy . New York : ACM , 2015 : 111 – 122 .

KUMAR J , SANTHANAVIJAYAN A , JANET B , et al . Phishing website classification and detection using machine learning [C ] // Proceedings of the 2020 International Conference on Computer Communication and Informatics (ICCCI) . Piscataway : IEEE Press , 2020 : 1 - 6 .

BAI W H . Phishing website detection based on machine learning algorithm [C ] // Proceedings of the 2020 International Conference on Computing and Data Science (CDS) . Piscataway : IEEE Press , 2020 : 293 - 298 .

GANDOTRA E , GUPTA D . An efficient approach for phishing detection using machine learning [M ] . Multimedia Security . Singapore : Springer , 2021 : 239 - 253 .

CHIEW K L , TAN C L , WONG K , et al . A new hybrid ensemble feature selection framework for machine learning-based phishing detection system [J ] . Information Sciences , 2019 , 484 : 153 - 166 .

VIGNESHWARAN P , ROY A S , SATHVIK B S , et al . Multidimensional features driven phishing detection based on deep learning [M ] // International Conference on Intelligent Emerging Methods of Artificial Intelligence & Cloud Computing . Cham : Springer International Publishing , 2022 : 362 - 369 .

LI Y C , CHU S N , XIAO R . A pharming attack hybrid detection model based on IP addresses and web content [J ] . Optik , 2015 , 126 ( 2 ): 234 - 239 .

CHIEW K L , CHANG E H , SZE S N , et al . Utilisation of website logo for phishing detection [J ] . Computers & Security , 2015 , 54 : 16 - 26 .

YI P , GUAN Y X , ZOU F T , et al . Web phishing detection using a deep learning framework [J ] . Wireless Communications and Mobile Computing , 2018 , 2018 ( 1 ): 4678746 .

YANG P , ZHAO G Z , ZENG P . Phishing website detection based on multidimensional features driven by deep learning [J ] . IEEE Access , 2019 , 7 : 15196 - 15209 .

ZHANG L , ZHANG P , LIU L C , et al . Multiphish: multi-modal features fusion networks for phishing detection [C ] // Proceedings of the ICASSP 2021 - 2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) . Piscataway : IEEE Press , 2021 : 3520 - 3524 .

CHEN T Q , GUESTRIN C . XGBoost: a scalable tree boosting system [C ] // Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining . New York : ACM , 2016 : 785 - 794 .

MIHALCEA R , TARAU P . Textrank: bringing order into text [C ] // Proceedings of the 2004 Conference on Empirical Methods in Natural Language Processing . Barcelona : Spain , 2004 : 404 - 411 .

DEVLIN J , CHANG M , LEE K , et al . Bert: pre-training of deep bidirectional transformers for language understanding [C ] . Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics . 2019 : 4171 - 4186 .

HE K M , ZHANG X Y , REN S Q , et al . Deep residual learning for image recognition [C ] // Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2016 : 770 - 778 .

HADSELL R , CHOPRA S , LECUN Y . Dimensionality reduction by learning an invariant mapping [C ] // Proceedings of the 2006 IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR'06) . Piscataway : IEEE Press , 2006 : 1735 - 1742 .

SINGH S , SINGH M P , PANDEY R . Phishing detection from URLs using deep learning approach [C ] // Proceedings of the 2020 5th International Conference on Computing, Communication and Security (ICCCS) . Piscataway : IEEE Press , 2020 : 1 - 4 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

融合色彩空间特征与频域特征的多源伪造图像检测方法

基于跨流注意力增强中心差分卷积网络的CG图像检测

基于程序过程间语义优化的深度学习漏洞检测方法

基于噪声注意力的伪造人脸检测方法

基于双分支网络的图像修复取证方法