关键词: 钓鱼网页, 统一资源定位符（URL）混淆技术, 规则匹配, 机器学习

Abstract: Aiming at the obfuscation techniques commonly used in phishing URL, a phishing detection method （RMLR） based on rule matching and logical regression is proposed. First, it classifies a given web by using a rule base constructed based on some obfuscation techniques such as the violation of URL naming standards and hidden phishing target. If it can be judged as a phishing site, the subsequent feature extraction and detection process is omitted to meet the need of real-time detection. If it cannot be directly classified as phishing, then it extracts the URL’s features, and uses the logical regression classifier for secondary detection to improve the detection adaptability and accuracy, and avoids false positives due to lack of rules. At the same time, RMLR introduces the Jaccard random domain name recognition method based on string similarity to assist in detecting phishing URL. The experimental results show that the accuracy rate of the RMLR is 98.7%, which means a good performance on phishing detection.

Key words: phishing, Uniform/Universal Resource Locator（URL） obfuscation techniques, rule matching, machine learning