Research on Phishing URL Detection Technology Based on CNN-BiLSTM

NAVIGATE

Table of Contents

STATISTICS

Viewed2441

Downloads1896

Research on Phishing URL Detection Technology Based on CNN-BiLSTM

[HTML] PDF下载 (1896)

[1]BU Youjun,ZHANG Qiao,CHEN Bo,et al.Research on Phishing URL Detection Technology Based on CNN-BiLSTM[J].Journal of Zhengzhou University (Engineering Science),2021,42(06):15-21.[doi:10.13705/j.issn.1671-6833.2021.04.022]

Copy

Journal of Zhengzhou University (Engineering Science)[ISSN 1671-6833/CN 41-1339/T] Volume: 42 Number of periods: 2021 06 Page number: 15-21 Column: Public date: 2021-11-10

Title:: Research on Phishing URL Detection Technology Based on CNN-BiLSTM

Author(s):: BU Youjun1; ZHANG Qiao1; 2; CHEN Bo1; ZHANG Surong1; WANG Fangyu2; China People’s Liberation Army Strategic Support Force Information Engineering University; Zhengzhou University Central Plains Network Security Research Institute;

Keywords:: phishing URL; URL segmentation; CNN; BiLSTM

CLC:: -

DOI:: 10.13705/j.issn.1671-6833.2021.04.022

Abstract:: In order to solve the increasingly serious problem of phishing, a phishing URL detection method based on convolution neural network (CNN) and bi-directional long short termmemory (BiLSTM) was proposed.This method first classified the URL based on the sensitive word segmentation method; classified the URL according to the special characters and sensitive words; and classified the non-sensitive words in the character level, so as to obtain the effective information of the special characters and sensitive words, and improve the use of URL data information. Then the segmented URL was input into CNN and BiLSTM, to obtain the spatial local features of the URL through CNN, to obtain the bidirectional long-distance dependent features of the URL through BiLSTM, and to detect phishing webpages based on the automatically extracted features.Compared with traditional machine learning and blacklist detection methods. Experimental results showed that the phishing URL detection method based on CNN and BiLSTM could achieve better detection results, the accuracy rate was 98.84%, the precision rate was 99.71%, the recall rate was 98.04%, and the F1 value was 98.86%. This method did not require manual feature extraction and could identify newly emerging phishing webpages.

References:: [1] 中国互联网络信息中心.第45次中国互联网络发展状况统计报告[R/OL].(2017-02-17)[2020-03-25].http://www.cnnic.cn/gywm/xwzx/rdxw/20172017_7057/202004/t20200427_70973.htm.
[2] 中国反钓鱼网站联盟.2020年8月钓鱼网站处理简报[EB/OL].(2020-03-20)[2020-10-08].http://www.apac.cn/gzdt/202003/P020200320392664104846.pdf.[3] CANALI D,COVA M,VIGNA G,et al.Prophiler:a fast filter for the large-scale detection of malicious web pages[C]//Proceedings of the 20th International Conference on World Wide Web-WWW′11.New York:ACM,2011:197-206.
[4] THOMAS K,GRIER C,MA J,et al.Design and evaluation of a real-time URL spam filtering service[C]//2011 IEEE Symposium on Security and Privacy.Pisca-taway:IEEE,2011:447-462.
[5] SHENG S,WARDMAN B,WARNER G,et al.An empirical analysis of phishing blacklists[EB/OL].(2009-01-01)[2020-04-08].http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.165.520.
[6] ALEROUD A,ZHOU L N.Phishing environments,techniques,and countermeasures:a survey[J].Computers & security,2017,68:160-196.
[7] LIU G,QIU B T,WENYIN L.Automatic detection of phishing target from phishing webpage[C]//20th International Conference on Pattern Recognition.Pisca-taway:IEEE,2010:4153-4156.
[8] MA J,SAUL L K,SAVAGE S,et al.Beyond blacklists:learning to detect malicious web sites from suspicious URLs[C]//Proceedings of the 15th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining-KDD′09.New York:ACM,2009:681-688.
[9] 沙泓州,刘庆云,柳厅文,等.恶意网页识别研究综述[J].计算机学报,2016,39(3):529-542.
[10] KIM Y.Convolutional neural networks for sentence classification[C]//Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP).Doha:Association for Computational Linguistics,2014:1746-1751.
[11] ZHANG M,XU B Y,BAI S,et al.A deep learning method to detect web attacks using a specially designed CNN[C]//Neural Information Processing.Berlin：Springer,2017:828-836.
[12] CUI J P, LIU M, HU J W. Malicious web request detection technology based on CNN [J]. Computer science,2020,47(2): 281-286.
[13] YU B,PAN J,HU J M,et al.Character level based detection of DGA domain names[C]//2018 International Joint Conference on Neural Networks (IJCNN).Piscataway:IEEE,2018:1-8.

Similar References:

Memo

Last Update: 2021-12-17