基于链接分析的钓鱼网站检测方法

发布时间：2018-02-26 11:16

本文关键词： 钓鱼检测链接分析网络社区相关网页群网站签名特征提取感知哈希　出处：《南京邮电大学》2014年硕士论文　论文类型：学位论文

【摘要】：钓鱼攻击是一种网络诈骗行为，钓鱼者通过钓鱼邮件以及与合法网页十分相似甚至相同的假冒网站，，骗取受害人的敏感信息，使受害人遭受直接或间接的经济及名誉损失。随着近年来电子商务的发展和普及，钓鱼攻击更加变本加厉，因此钓鱼检测的研究刻不容缓。钓鱼者之所以能够蒙蔽受害人，正是因为钓鱼网页与其模仿的目标网页之间特殊的链接关系以及高相似性。本文结合了钓鱼网页与目标网页之间特殊的链接关系和网络社区的链接构造特点，通过抓取与钓鱼网页相关的网页构造钓鱼网页的网络社区，识别钓鱼网页的相关网页群，进而确定潜在目标网页群。该方法是一种在线检测方法，不需要庞大的特征库或黑名单库，只需要利用网页之间的链接关系，减少了检测时间。在获取了潜在目标网页群之后，我们从网站的角度出发，提取网站的网站签名，确定可疑网站的目标网站。这是因为钓鱼网页有时不仅仅是模仿某个单独的目标网页，而是模仿目标网站中的一些相互链接的网页，建立一个视觉上十分相似的钓鱼网站。通过比较钓鱼网页所在的网站与其潜在目标网页群中的网站签名之间的相似性来确定目标网站。我们从网页的全局特征和感知哈希特征两个方面提取了网站签名，再通过匹配算法匹配不同长度的网站签名，最终得到签名的相似度。最后实验验证了我们提出的钓鱼检测方法的可行性和有效性。
[Abstract]:Phishing attacks are a form of cyber fraud in which anglers defraud victims of sensitive information through phishing emails and fake websites that are very similar to or even identical to legitimate web pages. With the development and popularization of electronic commerce in recent years, the fishing attack becomes more and more serious, so the study of fishing detection is urgent. The reason the anglers are able to hoodwink their victims, It is precisely because of the special link relationship and high similarity between the phishing page and the target page that it imitates. This paper combines the special link relationship between the phishing page and the target web page and the link construction characteristics of the network community. By grabbing the web pages associated with phishing pages to construct the phishing web pages' network communities, the related web pages of phishing pages can be identified and the potential target web pages can be identified. This method is an online detection method. There is no need for a large library of features or blacklists, only to use the links between web pages to reduce the detection time. After we get a potential target page group, we extract the site's signature from a website's point of view and determine the target site for a suspicious site. This is because phishing pages sometimes do more than just mimic a single target page. Instead of imitating some of the linked pages in the target site, Build a visually similar phishing site. Determine the target site by comparing the similarity between the site where the phishing page is located and the signature of the site in its potential target page group. Two aspects of perceptual hashing feature are used to extract the website signature. Then the matching algorithm is used to match the different length of website signature, and finally the similarity of the signature is obtained. Finally, the feasibility and effectiveness of the proposed fishing detection method are verified by experiments.
【学位授予单位】：南京邮电大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.092

【相似文献】