基于CNN和BiLSTM的钓鱼URL检测技术研究

Research on Phishing URL Detection Technology Based on CNN-BiLSTM

为了解决日益严峻的网络钓鱼问题,提出一种基于卷积神经网络(CNN)和双向长短记忆网络(BiLSTM)的钓鱼URL检测方法CNN-BiLSTM。该方法首先基于敏感词分词的方法对URL分词,根据特殊字符和敏感词对URL进行单词级别划分,对其中的非敏感词进行字符级别划分,以获取特殊字符和敏感词的有效信息,提升利用URL数据信息的程度;然后将分词后的URL输入到CNN和BiLSTM中,通过CNN获取URL的空间局部特征,通过BiLSTM获取URL的双向长距离依赖特征,基于自动提取的特征检测钓鱼网页。实验结果表明:基于CNN和BiLSTM的钓鱼URL检测方法能够达到较好的检测效果,其准确率达到了98.84%,精确率达到了99.71%,召回率达到了98.04%,F1值达到了98.86%。此方法相对于传统的机器学习和黑名单检测方法,无须人工提取特征且能识别新出现的钓鱼网页。

In order to solve the increasingly serious problem of phishing,a phishing URL detection method based on convolution neural network(CNN)and bi-directional long short termmemory(BiLSTM)was proposed.This method first classified the URL based on the sensitive word segmentation method;classified the URL according to the special characters and sensitive words;and classified the non-sensitive words in the character level,so as to obtain the effective information of the special characters and sensitive words,and improve the use of URL data information.Then the segmented URL was input into CNN and BiLSTM,to obtain the spatial local features of the URL through CNN,to obtain the bidirectional long-distance dependent features of the URL through BiLSTM,and to detect phishing webpages based on the automatically extracted features.Compared with traditional machine learning and blacklist detection methods.Experimental results showed that the phishing URL detection method based on CNN and BiLSTM could achieve better detection results,the accuracy rate was 98.84%,the precision rate was 99.71%,the recall rate was 98.04%,and the F1 value was 98.86%.This method did not require manual feature extraction and could identify newly emerging phishing webpages.