The Research On Phishing Clustering Algorithm Based On GIST Global Feature

With the rapid development of Internet technology,network fraud is an explosive growth trend,which seriously affects the safety of people's personal property.Phishing attack is a typical network fraud.Phishing attackers defraud sensitive information of victims by making fake websites that are very similar to legitimate web pages.In recent years,experts and scholars at home and abroad have put forward a series of anti-phishing web page detection methods,and achieved certain results,but in the behavior of phishing attackers,have very little research,based on this,this paper put forward a phishing site clustering algorithm based on the characteristics of GIST global to study the behavior characteristics of attackers.This article use the global scene characteristic information of GIST model for feature extraction,through using the Kmeans clustering method to group for eigenvalue cluster,finally the results of clustering analysis,verified the phishing attacks having the team behavior characteristics of attackers.The main work of this paper is as follows:(1)This paper extracts the phishing site scene GIST feature,completing the construction of characteristic library,seen from the experimental results,the scene GIST can well describe layout structure characteristics of web page,making cluster being more accurate.(2)The traditional Kmeans clustering results are unstable because of the uncertainty of the number of clusters k and the random selection of initial center points.In this paper,the selection of cluster number k and the initial center and eliminating the traditional isolated Kmeans algorithm is improved,and by the experimental results,it is concluded that the improved Kmeans clustering of phishing sites have better clustering effect.The improved Kmeans algorithm is used to cluster the GIST features of the phishing website.(3)By analyzing the clustering results of eBay and PayPal fishing sites,it can be concluded that phishing attacks may be made by one or several teams,who using a similar page template attacking the same legal website.