KR102641092B1 - Method for detecting phishing data and computing device using the same - Google Patents

Abstract

In the method of detecting the phishing data using Siamese Network and KD-Tree algorithms with reference to patterning data obtained through regular expressions for phishing data, (a) a plurality of phishing data and each of the plurality of phishing data After patterning each of the plurality of phishing data based on each of the regular expressions to obtain a plurality of patterned data, each of the plurality of phishing data is input to the first CNN of the Siamese Network, and the plurality of patterned data is obtained. Each piece of data is input to the second CNN of the Siamese Network, each first feature is output by the first CNN, and each second feature is output by the second CNN, so that the first feature and the second feature In a state in which the Siamese Network is learned so that the distance is less than or equal to a preset threshold, when the KD-tree device is connected to the output terminal of the Siamese Network, the KD-tree device corresponds to the target patterning data for the target data. Representing target patterned data features on a KD-tree; (b) when new data is input to the first CNN of the Siamese Network and new data features are output, the KD-tree device maps the new data features on the KD-tree; and (c) the KD-tree device stores the new data in the phishing data with reference to the distance between the new data feature corresponding to the new data and the target patterned data feature expressed on the KD-tree. A method including a step of determining whether the method is applicable and a computing device using the same are disclosed.

Description

Method for detecting phishing data and computing device using the same {METHOD FOR DETECTING PHISHING DATA AND COMPUTING DEVICE USING THE SAME}

The present invention relates to a method for detecting phishing data and a computing device using the same.

A phishing attack is an act in which an attacker uses a domain designed for malicious purposes to steal a user's personal or financial information through email or text message.

There is a problem in that it is difficult to respond to various variant attacks and new types of attacks by phishing attackers using only the signature-based detection method, which is a method of detecting malware by storing previously known phishing attacks.

Therefore, in order to detect more diverse phishing patterns than existing signature-based detection methods, the inventor of the present invention allowed the Siamese Network to learn various patterns by referring to patterning data obtained through regular expressions for phishing data. , We developed a method to detect various patterns of phishing data derived from phishing data through a model that combines the learned Siamese Network with the KD-Tree device.

The purpose of the present invention is to solve the above-mentioned problems.

Another purpose of the present invention is to learn Siamese Network to recognize phishing data and patterning data equally by using phishing data and patterning data corresponding thereto.

In addition, in the present invention, after the Siamese Network is learned, with the target patterning data feature corresponding to the target data expressed on the KD-Tree, if any new data is input to the Siamese Network, the new data output from the Siamese Network Another purpose is to increase the accuracy of phishing detection by mapping data features on the KD-Tree.

The characteristic configuration of the present invention for achieving the purpose of the present invention as described above and realizing the characteristic effects of the present invention described later is as follows.

According to one aspect of the present invention, in the method of detecting the phishing data using the Siamese Network and KD-Tree algorithm with reference to patterning data obtained through a regular expression for the phishing data, (a) a plurality of phishing data And after each of the plurality of phishing data is obtained by patterning each of the plurality of phishing data based on each of the regular expressions for each of the plurality of phishing data, each of the plurality of phishing data is transmitted to the first CNN of the Siamese Network. input, and each of the plurality of patterned data is input to a second CNN of the Siamese Network, each of the first features is output by the first CNN, and each of the second features is output by the second CNN, In a state in which the Siamese Network is learned so that the distance between the first feature and the second feature is less than or equal to a preset threshold, when a KD-tree device is connected to the output terminal of the Siamese Network, the KD-tree device expressing target patterning data features corresponding to target patterning data on a KD-tree; (b) when new data is input to the first CNN of the Siamese Network and new data features are output, the KD-tree device maps the new data features on the KD-tree; and (c) the KD-tree device stores the new data in the phishing data with reference to the distance between the new data feature corresponding to the new data and the target patterned data feature expressed on the KD-tree. A method comprising a step of determining whether the information is applicable is disclosed.

As an example, in step (a), after each of the plurality of phishing data is input to the first CNN of the Siamese Network and each of the plurality of patterning data is input to the second CNN of the Siamese Network, With a shared weight (W) between the first CNN and the second CNN of the Siamese Network, if it is determined that each of the plurality of phishing data and each of the plurality of patterning data are the same data, the first CNN is learned so that the distance between each of the first features output from and each of the second features output from the second CNN is less than or equal to a preset threshold, and each of the plurality of phishing data and each of the plurality of patterning data are different data. If it is determined that this is the case, a method is disclosed wherein the distance between each of the first features and each of the second features is learned to exceed a preset threshold.

As an example, in step (a), each of the plurality of phishing data is integerized based on a predetermined dictionary to make each phishing data array composed of numbers, and each of the plurality of patterned data is integerized to be composed of numbers. In a state where each patterned data array is created, when each of the phishing data arrays is input to the first CNN of the Siamese Network, and each of the patterned data arrays is input to the second CNN, the first CNN When each of the phishing data array features corresponding to the phishing data array is output, and each of the pattern data array features corresponding to the pattern data array is output by the second CNN, there is a difference between the phishing data array feature and the pattern data array feature. Calculate the Euclidean distance to measure the similarity between the phishing data and the patterning data, and learn to minimize the similarity between each of the phishing data and the patterning data using a loss function with reference to the similarity. A method characterized by going through the process is disclosed.

As an example, in step (a), each of the plurality of phishing data is obtained and each of the plurality of phishing data is patterned based on each regular expression for each of the plurality of phishing data to obtain each of the plurality of patterned data. After being acquired, each of the plurality of phishing data and each of the plurality of patterning data are input to the Siamese Network, and each of the first feature and each of the second feature is output as a feature vector by the Siamese Network, A method is disclosed wherein when a distance is output from the feature vector by a Siamese Network, the Siamese Network is learned with reference to the distance.

As an example, in step (a), when each of the phishing data and each of the patterning data is input to each of the first CNN and the second CNN of the Siamese Network, between the first CNN and the second CNN With a shared weight (W) and a bias b, the bias b is added to each of the phishing weight data and the patterning weight data for each of the phishing data and each of the patterning data, and then an activation function is applied to the first When the first feature vector for the feature and the second feature vector for the second feature are output, the Euclidean distance between the first feature vector and the second feature vector is calculated to calculate the phishing data and the patterning data. A method is disclosed, which includes measuring the similarity and learning to minimize the similarity between each of the phishing data and the patterning data using a loss function referring to the similarity.

As an example, in step (a), the loss value between the phishing data and the patterned data is calculated using the loss function referring to the similarity between the phishing data and the patterned data, and backpropagation is performed. A method is disclosed, characterized in that the Siamese Network is learned by updating the shared weight (W) and the bias b so that the loss value between the phishing data and the patterning data becomes the minimum value. do.

As an example, in step (a), each normal partial data and each remaining data excluding the normal partial data are extracted based on each special character from each of the phishing data, and each of the remaining data is divided into n abnormal partial data. In the true state, each of the normal partial data is maintained as is, and is replaced with 1_1 patterned data to 1_n patterned data based on regular expressions for each of the abnormal partial data, so that the normal partial data and the 1_1 pattern A method is disclosed, characterized in that it generates each of the patterning data including pattern data to the 1_nth patterning data.

As an example, in step (a), when generating each of the patterned data from each of the phishing data, each of the normal partial data and the n abnormal partial data are divided based on each of the special characters in each of the phishing data. In the extracted state, each of the n abnormal partial data has a first pattern corresponding to an integer excluding the normal domain, a second pattern corresponding to an integer and a character excluding the normal domain, and a third pattern corresponding to the normal domain and an integer. Patterning by determining which pattern corresponds to a pattern, a character, and a fourth pattern corresponding to the normal domain, a fifth pattern corresponding to the normal domain and a character, and a sixth pattern corresponding to a character excluding the normal domain. A characterized method is disclosed.

As an example, in step (b), a plurality of pieces of new data are input, and in step (c), the KD-tree device creates each of the new data features corresponding to each of the new data and the KD-tree. A method is disclosed, characterized in that it determines which domain of at least one normal domain each of the new data features is clustered in, with reference to the distances of each of the target patterned data features expressed in the image.

As an example, in step (c), the KD-tree device distributes the distribution of each of the new data features corresponding to each of the new data and each of the target patterned data features expressed on the KD-tree in two dimensions. In the converted state, if each of the new data features is similar to each of the normal domains, clustering each of the new data features into at least one specific normal domain corresponding to each of the new data features among each of the normal domains. Provides a method to characterize.

According to another aspect of the present invention, in a method of detecting phishing data using a Siamese Network and KD-Tree algorithm with reference to patterning data obtained through a regular expression for phishing data, at least one storing instructions memory; and at least one processor configured to execute the instructions, wherein the processor: (I) patterns each of the plurality of phishing data based on each of the plurality of phishing data and a regular expression for each of the plurality of phishing data; After each of the plurality of patterning data is acquired, each of the plurality of phishing data is input to the first CNN of the Siamese Network, and each of the plurality of patterning data is input to the second CNN of the Siamese Network, Each of the first features is output by the first CNN and each of the second features is output by the second CNN, and the Siamese Network is learned so that the distance between the first feature and the second feature is less than a preset threshold. In this state, when the KD-tree device is connected to the output terminal of the Siamese Network, a process of expressing the target patterning data feature corresponding to the target patterning data for the target data on the KD-tree, (II) the new data is When a new data feature is input to the first CNN of a Siamese Network and output, a process of mapping the new data feature on the KD-tree, and (III) the new data feature corresponding to the new data and the KD- A computing device is provided that performs a process of determining whether the new data corresponds to phishing data by referring to the distance between the target patterned data features expressed on a tree.

As an example, in the process (I), after each of the plurality of phishing data is input to the first CNN of the Siamese Network, and each of the plurality of patterning data is input to the second CNN of the Siamese Network, With a shared weight (W) between the first CNN and the second CNN of the Siamese Network, if it is determined that each of the plurality of phishing data and each of the plurality of patterning data are the same data, the first CNN is learned so that the distance between each of the first features output from and each of the second features output from the second CNN is less than or equal to a preset threshold, and each of the plurality of phishing data and each of the plurality of patterning data are different data. If it is determined that the distance between each of the first features and each of the second features is learned to exceed a preset threshold.

As an example, in the (I) process, each of the plurality of phishing data is integerized based on a predetermined dictionary to make each phishing data array composed of numbers, and each of the plurality of patterned data is integerized to be composed of numbers. In a state where each patterned data array is created, when each of the phishing data arrays is input to the first CNN of the Siamese Network and each of the patterned data arrays is input to the second CNN, the first CNN When each of the phishing data array features corresponding to the phishing data array is output, and each of the pattern data array features corresponding to the pattern data array is output by the second CNN, there is a difference between the phishing data array feature and the pattern data array feature. Calculate the Euclidean distance to measure the similarity between the phishing data and the patterning data, and learn to minimize the similarity between each of the phishing data and the patterning data using a loss function with reference to the similarity. Provides a computing device characterized in that it undergoes a process of:

As an example, in the process (I), each of the plurality of phishing data is obtained and each of the plurality of phishing data is patterned based on each regular expression for each of the plurality of phishing data to obtain each of the plurality of patterned data. After being acquired, each of the plurality of phishing data and each of the plurality of patterning data are input to the Siamese Network, and each of the first feature and each of the second feature is output as a feature vector by the Siamese Network, When a distance is output from the feature vector by a Siamese Network, a computing device is provided that allows the Siamese Network to be learned with reference to the distance.

As an example, in the process (I), when each of the phishing data and each of the patterning data are input to each of the first CNN and the second CNN of the Siamese Network, between the first CNN and the second CNN With a shared weight (W) and a bias b, the bias b is added to each of the phishing weight data and the patterning weight data for each of the phishing data and each of the patterning data, and then an activation function is applied to the first When the first feature vector for the feature and the second feature vector for the second feature are output, the Euclidean distance between the first feature vector and the second feature vector is calculated to calculate the phishing data and the patterning data. A computing device is provided, characterized in that it measures the similarity and goes through a process of learning to minimize the similarity between each of the phishing data and each of the patterned data using a loss function referring to the similarity.

As an example, in the process (I), backpropagation is performed while calculating a loss value between the phishing data and the patterning data using the loss function referring to the similarity between the phishing data and the patterning data. A computing device characterized in that the Siamese Network is learned by updating the shared weight (W) and the bias b so that the loss value between the phishing data and the patterning data is minimal. to provide.

As an example, in the process (I), each normal partial data and each remaining data excluding the normal partial data are extracted based on each special character from each of the phishing data, and each of the remaining data is divided into n abnormal partial data. In the true state, each of the normal partial data is maintained as is, and is replaced with 1_1 patterned data to 1_n patterned data based on regular expressions for each of the abnormal partial data, so that the normal partial data and the 1_1 pattern A computing device is provided, characterized in that it generates each of the patterned data, including pattern data to the 1_nth patterned data.

As an example, in the process (I), when generating each of the patterned data from each of the phishing data, each of the normal partial data and the n abnormal partial data are divided based on each of the special characters in each of the phishing data. In the extracted state, each of the n abnormal partial data has a first pattern corresponding to an integer excluding the normal domain, a second pattern corresponding to an integer and a character excluding the normal domain, and a third pattern corresponding to the normal domain and an integer. Patterning by determining which pattern corresponds to a pattern, a character, and a fourth pattern corresponding to the normal domain, a fifth pattern corresponding to the normal domain and a character, and a sixth pattern corresponding to a character excluding the normal domain. A computing device featuring features is provided.

As an example, in the (II) process, a plurality of new data is input, and the processor, in the (III) process, represents each of the new data features corresponding to each of the new data on the KD-tree. A computing device is provided, wherein each new data feature is clustered into one of at least one normal domain, with reference to the distance of each of the target patterned data features.

As an example, in the process (III), the processor converts the distribution of each of the new data features corresponding to each of the new data and each of the target patterned data features expressed on the KD-tree into two dimensions. In the state, if each of the new data features is similar to each of the normal domains, clustering each of the new data features into at least one specific normal domain corresponding to each of the new data features among each of the normal domains. Provides a computing device.

According to the present invention, the following effects are achieved.

The present invention has the effect of enabling Siamese Network to learn to recognize phishing data and patterning data equally by using phishing data and patterning data corresponding thereto.

In addition, in the present invention, after the Siamese Network is learned, with the target patterning data feature corresponding to the target data expressed on the KD-Tree, if any new data is input to the Siamese Network, the new data output from the Siamese Network By mapping data features onto the KD-Tree, the accuracy of phishing detection can be improved.

The following drawings attached for use in explaining embodiments of the present invention are only some of the embodiments of the present invention, and to those skilled in the art (hereinafter “those skilled in the art”), the invention Other drawings can be obtained based on these drawings without further work being done.
Figure 1 is a diagram showing the schematic configuration of a device that detects the phishing data using the Siamese Network and KD-Tree algorithm, according to an embodiment of the present invention.
Figure 2 is a flowchart schematically showing the process of detecting new phishing data using the Siamese Network and KD-Tree algorithm learned with reference to phishing data and patterning data, according to an embodiment of the present invention.
Figure 3 is a diagram illustrating the process of learning a Siamese Network using phishing data input to the first CNN of the Siamese Network and patterning data input to the second CNN of the Siamese Network, according to an embodiment of the present invention. am.
Figure 4 shows, according to an embodiment of the present invention, after the Siamese Network is learned, when new data is input to the first CNN of the Siamese Network and new data features are output, the KD-tree image in which the target patterned data feature is expressed is shown. This is a diagram to explain the process of mapping new data features to .

The detailed description of the present invention described below refers to the accompanying drawings, which show by way of example specific embodiments in which the present invention may be practiced to make clear the objectives, technical solutions and advantages of the present invention. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention.

Additionally, throughout the description and claims, the word “comprise” and variations thereof are not intended to exclude other technical features, attachments, components or steps. Other objects, advantages and features of the invention will appear to those skilled in the art, partly from this description and partly from practice of the invention. The examples and drawings below are provided by way of example and are not intended to limit the invention.

Moreover, the present invention encompasses all possible combinations of the embodiments shown herein. It should be understood that the various embodiments of the present invention are different from one another but are not necessarily mutually exclusive. For example, specific shapes, structures and characteristics described herein with respect to one embodiment may be implemented in other embodiments without departing from the spirit and scope of the invention. Additionally, it should be understood that the location or arrangement of individual components within each disclosed embodiment may be changed without departing from the spirit and scope of the invention. Accordingly, the detailed description that follows is not intended to be taken in a limiting sense, and the scope of the invention is limited only by the appended claims, together with all equivalents to what those claims assert, if properly described. Similar reference numbers in the drawings refer to identical or similar functions across various aspects.

Hereinafter, in order to enable those skilled in the art to easily practice the present invention, preferred embodiments of the present invention will be described in detail with reference to the attached drawings.

1 is a diagram showing a schematic configuration of a computing device that detects the phishing data using a Siamese Network and KD-Tree algorithm, according to an embodiment of the present invention.

As shown in FIG. 1, the computing device 100 that detects phishing data using the Siamese Network and KD-Tree algorithm may include a memory 110 and a processor 120. Here, the computing device 100 may be a concept that includes both a Siamese Network and a KD-tree device equipped with the KD-Tree algorithm, but is not limited thereto.

The memory 110 of the computing device 100, which detects phishing data using the Siamese Network and KD-Tree algorithms with reference to patterning data obtained through regular expressions for phishing data, contains instructions to be performed by the processor 120. Specifically, the instructions are codes generated for the purpose of allowing the computing device 100 to function in a specific way to provide content, and are a computer that can be directed to a computer or other programmable data processing equipment. It may be stored in accessible or computer-readable memory. Instructions may perform processes to execute functions described in the specification of the present invention.

In addition, the processor 120 of the computing device 100, which detects phishing data using the Siamese Network and KD-Tree algorithm with reference to patterned data obtained through regular expressions for phishing data, is an MPU (Micro Processing Unit) or It may include hardware components such as CPU (Central Processing Unit), cache memory, and data bus. Additionally, the computing device 100 may further include an operating system and a software component of an application that performs a specific purpose.

Additionally, the computing device 100 may be linked to a database. Here, the database is a flash memory type, hard disk type, multimedia card micro type, card type memory (e.g. SD or XD memory), and RAM (Random). At least one type of Access Memory (RAM), SRAM (Static Random Access Memory), ROM (ReadOnly Memory, ROM), EEPROM (Electrically Erasable Programmable ReadOnly Memory), PROM (Programmable ReadOnly Memory), magnetic memory, magnetic disk, and optical disk. It may include a storage medium, but is not limited to this and may include any medium that can store data. In addition, the database may be installed separately from the computing device 100, or alternatively, may be installed inside the computing device 100 to transmit data or record received data, or, unlike shown, may be implemented separately into two or more parts. It may be, and this may vary depending on the implementation conditions of the invention.

A method using the computing device 100 according to an embodiment of the present invention configured as described above will be described with reference to FIG. 2 as follows.

Figure 2 is a flowchart schematically showing the process of detecting new phishing data using the Siamese Network and KD-Tree algorithm learned with reference to phishing data and patterning data, according to an embodiment of the present invention.

Referring to FIG. 2, the Siamese Network can be learned first. Specifically, each of the plurality of phishing data is patterned based on the plurality of phishing data and the regular expressions for each of the plurality of phishing data to form a plurality of patterned data. Once each is obtained, each of the plurality of phishing data is input to the first CNN of the Siamese Network, and each of the plurality of patterning data is input to the second CNN of the Siamese Network, so that the first feature output by the first CNN The Siamese Network can be trained so that the distance between each feature and the second feature output by the second CNN is below a preset threshold. In this state in which the Siamese Network is learned, the computing device 100 connects the KD-tree device to the output terminal of the Siamese Network, and then selects the target patterning data feature corresponding to the target patterning data for the target data to the KD- It can be expressed on a tree (S201).

Here, the patterned data can be created by applying a regular expression according to a predetermined standard to the phishing data, but is not limited to this.

Specifically, in the process of patterning each piece of phishing data into patterned data through regular expressions, for example, when patterning phishing data ('webmaildaum.com' and 'cafe.midnaver.com') through regular expressions, In each phishing data, the normal part data ('daum', 'naver') is based on special characters ('.', '-'), and the remaining data excluding the normal part data ('webmail', 'com', 'cafe') 'mid''com') is extracted, and each of the remaining data ('webmail''com', 'cafe' 'mid''com') can be divided into at least one abnormal part data again, and then normal Each of the partial data ('daum', 'naver') is maintained as is, and each of the abnormal partial data is {1. Integer excluding normal domain is #P1# pattern, 2. Integer + character excluding normal domain is #P2# pattern , 3. Normal domain + integer is domain name#P3# pattern, 4. Character + normal domain is domain name#P4# pattern, 5. Normal domain + character is domain name#P5# pattern, characters excluding normal domain are # By replacing the contents of {P6 pattern} with criteria containing the content, it will be possible to generate patterned data ('#P4#daum.#P6#' and '#P6#.#P4#naver.#P6#'), respectively. . Of course, it is not limited to this example, and various modifications can be assumed.

Meanwhile, phishing data and patterning data may be converted into an array of integers by converting each data into an integer and input into the Siamese Network ( 300 ).

Specifically, based on a Dictionary that divides numbers, alphabets, and special symbols according to a predetermined standard and maps them to each integer, each integer is matched to each number, each alphabet, and each special symbol to form a plurality of phishing data and a plurality of patterns. You will be able to integerize each piece of data.

For example, in order to integerize each of the plurality of phishing data and the plurality of patterning data, {'0': 0, '1': 1, '2': 2, '3': 3, '4': 4 , '5': 5, '6': 6, '7': 7, '8': 8, '9': 9, 'a': 10, 'b': 11, 'c': 12, 'd': 13, 'e': 14,'f': 15, 'g': 16, 'h': 17, 'i': 18, 'j': 19, 'k': 20, 'l' : 21, 'm': 22, 'n': 23, 'o': 24, 'p': 25, 'q': 26, 'r': 27, 's': 28, 't': 29 , 'u': 30, 'v': 31, 'w': 32, 'x': 33, 'y': 34, 'z': 35, '.': 36, '-': 37, ' Based on the Dictionary containing the correspondence relationship of _': 38 }, each of the plurality of phishing data and each of the plurality of patterning data is replaced with an integer to form an array of integers, and the Siamese Network ( 300 ) Each piece of phishing data can be input to the first CNN 310 in an integer array, and each patterned data array can be input to the second CNN 320 in an integer array. Of course, the contents included in the dictionary are not limited to letters and numbers, and in cases where symbols not included in the dictionary must be replaced, if symbols such as '#' that are not included in the dictionary are added, the number is 39 or more and 40 or less. It may be replaced by matching with an integer.

Figure 3 illustrates in more detail the process of learning a Siamese Network using phishing data input to the first CNN of the Siamese Network and patterning data input to the second CNN of the Siamese Network, according to an embodiment of the present invention. This is a drawing for this purpose.

For example, referring to Figure 3, when phishing data is input to the first CNN ( 310 ) of the Siamese Network (300) and patterning data is input to the second CNN ( 320 ) of the Siamese Network (300), the first CNN It can be seen that the first feature is output by 310 and the second feature is output by the second CNN 320.

In this way, after each of the plurality of phishing data is input to the first CNN ( 310 ) of the Siamese Network (300) and each of the plurality of patterning data is input to the second CNN (320) of the Siamese Network ( 300 ), the plurality of phishing data is input to the first CNN (310) of the Siamese Network (300). If each of the data and each of the plurality of patterning data are the same data, the Siamese Network ( 300 ) is The distance is learned to be close, and when each of the plurality of phishing data and each of the plurality of patterning data are different data, the Siamese Network ( 300 ) may be learned so that the distance between each of the first and second features is large. will be.

Specifically, in the process of learning Siamese Network ( 300 ), when the input value input to Siamese Network ( 300 ) is input(x_1, x_2) = input (phishing data, patterning data), phishing data (x_1 ) When each and the patterning data (x_2) are respectively input to the first CNN (310) and the second CNN (320) of the Siamese Network ( 300 ), between the first CNN (310) and the second CNN (320) With shared weight (W) and bias b, obtain each of the phishing weight data (Wx_1) and patterning weight data (Wx_2) for each of the phishing data (x_1) and patterning data (x_2) and bias accordingly. If you add b and then apply the LeakyReLU activation function, you will get the formula: f_1 = LeakyReLU(Wx_1+b), f_2 = LeakyReLU(Wx_2+b). Here, LeakyReLU may mean f(x) = max(0.01x, x).

)을 획득할 수 있을 것이다.Here, the first feature that is the output of the first CNN (310) can be expressed as a first feature vector (f_1) by the formula f_1 = LeakyReLU(Wx_1+b), and the second feature that is the output of the second CNN (320) The feature may be expressed as a second feature vector (f_2) by the formula f_2 = LeakyReLU(Wx_2+b). Afterwards, the Euclidean distance (d) between the first feature vector (f_1) and the second feature vector (f_2) is calculated, and the value corresponding to the similarity between the phishing data and the patterning data (formula:

) will be able to obtain.

)를 이용하여 피싱 데이터 각각과 패턴화 데이터 각각의 유사도를 최소화하는 방향으로 Siamese Network(300)를 학습할 수 있는데, 구체적으로, 피싱 데이터와 패턴화 데이터 사이의 로스값을 이용하여 Backpropagation을 진행하여 공유 가중치(W)와 편향 b를 업데이트하는 과정을 거치면서, Siamese Network(300)가 학습될 수 있을 것이다.Afterwards, the loss function (RMSE, formula: RMSE=

) can be used to learn the Siamese Network (300) in the direction of minimizing the similarity between each phishing data and each patterning data. Specifically, backpropagation is performed using the loss value between the phishing data and the patterning data. Through the process of updating the shared weight (W) and bias b, the Siamese Network ( 300 ) can be learned.

Next, when new data is input to the first CNN (310) of the Siamese Network ( 300 ) and new data features are output, the KD-tree device can map the new data features on the KD-tree (S202) .

Figure 4 shows, according to an embodiment of the present invention, after the Siamese Network is learned, when new data is input to the first CNN of the Siamese Network and new data features are output, the KD-tree image in which the target patterned data feature is expressed is shown. This is a diagram to explain the process of mapping new data features to .

Specifically, referring to FIG. 4, when new data is input to the first CNN 310 and the new data feature is output while the target patterning data feature for the target data has already been expressed on the KD-tree in step S201, , new data features output from the first CNN (310) can be mapped onto the KD-tree (400).

At this time, unlike step S201 in which the Siamese Network ( 300 ) is performing learning, patterning data for new data may not be input to the second CNN ( 320 ). This is because, even if the new data is not necessarily made into new patterning data, the Siamese Network (300) has already learned that the new data is close to the corresponding new patterning data, so new data created using only the new data This is because the desired results can be achieved by mapping only features onto the KD-tree.

Accordingly, the KD-tree device 400 determines whether the new data corresponds to phishing data by referring to the distance between the new data feature corresponding to the new data and the target patterned data feature expressed on the KD-tree. Can be judged (S203).

Specifically, referring to FIG. 4, when new data is input to the first CNN 310 and new data features are output, and the new data features output from the first CNN 310 are mapped on the KD-tree, KD -tree(400) calculates the distance between the target patterned data feature already expressed on the KD-tree and the new data feature mapped on the KD-tree, and if the distance is greater than a predetermined threshold, the new data is transferred to the normal domain. If the distance is less than a predetermined threshold, the new data can be determined to be a phishing domain.

At this time, the target patterning data feature refers to data that is generated through a regular expression for the target data to be detected, input to the Siamese Network (300), and then output as a target patterning data feature. The data falls under a phishing domain.

In addition, the KD-tree device 400 calculates the distance by converting the distribution of each new data feature corresponding to each new data and each target patterned data feature expressed on the KD-tree into two dimensions, If each new data is similar to each normal domain, each new data can be clustered near each corresponding normal domain.

Embodiments according to the present invention described above may be implemented in the form of program instructions that can be executed through various computer components and recorded on a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, etc., singly or in combination. Program instructions recorded on the computer-readable recording medium may be specially designed and configured for the present invention, or may be known and usable by those skilled in the computer software field. Examples of computer-readable recording media include hard disks, magnetic media such as floppy disks and magnetic tapes, optical recording media such as CD-ROMs and DVDs, and magneto-optical media such as floptical disks. , and hardware devices specifically configured to store and perform program instructions, such as ROM, RAM, flash memory, etc. Examples of program instructions include not only machine language code such as that created by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules to perform processing according to the invention and vice versa.

In the above, the present invention has been described with specific details such as specific components and limited embodiments and drawings, but this is only provided to facilitate a more general understanding of the present invention, and the present invention is not limited to the above embodiments. , a person skilled in the art to which the present invention pertains can make various modifications and variations from this description.

Therefore, the spirit of the present invention should not be limited to the above-described embodiments, and the scope of the patent claims described below as well as all modifications equivalent to or equivalent to the scope of the claims fall within the scope of the spirit of the present invention. They will say they do it.

Claims (20)

In a method of detecting the phishing data using Siamese Network and KD-Tree algorithms with reference to patterning data obtained through regular expressions for phishing data,
(a) After patterning each of the plurality of phishing data based on each of the plurality of phishing data and the regular expression for each of the plurality of phishing data to obtain each of the plurality of patterned data, each of the plurality of phishing data is is input to a first CNN of the Siamese Network, each of the plurality of patterned data is input to a second CNN of the Siamese Network, each first feature is output by the first CNN, and each of the first features is output by the second CNN When each feature is output and the Siamese Network is learned so that the distance between the first feature and the second feature is less than or equal to a preset threshold, when a KD-tree device is connected to the output terminal of the Siamese Network, the KD- The tree device includes: expressing target patterning data features corresponding to target patterning data for target data on a KD-tree;
(b) when new data is input to the first CNN of the Siamese Network and new data features are output, the KD-tree device maps the new data features on the KD-tree; and
(c) The KD-tree device determines that the new data corresponds to phishing data with reference to the distance between the new data feature corresponding to the new data and the target patterned data feature expressed on the KD-tree. A step of determining whether it is possible;
Including,
In step (a) above,
Each of the plurality of phishing data is integerized based on a predetermined dictionary to create each phishing data array made of numbers, and each of the plurality of patterned data is integerized to make each patterned data array made of numbers, When each of the phishing data arrays is input to the first CNN of the Siamese Network and each of the patterned data arrays is input to the second CNN, a phishing data array feature corresponding to the phishing data array is generated by the first CNN. When each of the patterned data array features corresponding to the patterned data array is output by the second CNN, the Euclidean distance between the phishing data array feature and the patterned data array feature is calculated. Characterized by measuring the similarity between the phishing data and the patterning data and learning to minimize the similarity between each of the phishing data and the patterning data using a loss function with reference to the similarity. How to. According to clause 1,
In step (a) above,
After each of the plurality of phishing data is input to the first CNN of the Siamese Network, and each of the plurality of patterning data is input to the second CNN of the Siamese Network, the first CNN of the Siamese Network and the With a shared weight (W) between the second CNNs, if it is determined that each of the plurality of phishing data and each of the plurality of patterning data are the same data, each of the first features output from the first CNN and the If the distance of each of the second features output from the second CNN is learned to be less than or equal to a preset threshold, and each of the plurality of phishing data and each of the plurality of patterning data are determined to be different data, each of the first features and A method characterized in that the distance of each second feature is learned to exceed a preset threshold. delete According to claim 1,
In step (a) above,
After each of the plurality of phishing data is acquired and each of the plurality of patterned data is obtained by patterning each of the plurality of phishing data based on each regular expression for each of the plurality of phishing data, each of the plurality of phishing data and each of the plurality of patterned data is input to the Siamese Network, each of the first feature and each of the second feature is output as a feature vector by the Siamese Network, and the distance from the feature vector is determined by the Siamese Network. When output, the method is characterized in that the Siamese Network is learned with reference to the distance. In a method of detecting the phishing data using Siamese Network and KD-Tree algorithms with reference to patterning data obtained through regular expressions for phishing data,
(a) After patterning each of the plurality of phishing data based on each of the plurality of phishing data and the regular expression for each of the plurality of phishing data to obtain each of the plurality of patterned data, each of the plurality of phishing data is is input to a first CNN of the Siamese Network, each of the plurality of patterned data is input to a second CNN of the Siamese Network, each first feature is output by the first CNN, and each of the first features is output by the second CNN When each feature is output and the Siamese Network is learned so that the distance between the first feature and the second feature is less than or equal to a preset threshold, when a KD-tree device is connected to the output terminal of the Siamese Network, the KD- The tree device includes: expressing target patterning data features corresponding to target patterning data for target data on a KD-tree;
(b) when new data is input to the first CNN of the Siamese Network and new data features are output, the KD-tree device maps the new data features on the KD-tree; and
(c) The KD-tree device determines that the new data corresponds to phishing data with reference to the distance between the new data feature corresponding to the new data and the target patterned data feature expressed on the KD-tree. A step of determining whether it is possible;
Including,
In step (a) above,
When each of the phishing data and each of the patterning data are input to each of the first CNN and the second CNN of the Siamese Network, with a shared weight (W) and bias b between the first CNN and the second CNN In the state, the bias b is added to each of the phishing weight data and the patterning weight data for each of the phishing data and each of the patterning data, and then an activation function is applied to create a first feature vector for the first feature and the first feature vector. 2 When the second feature vector for the feature is output, the Euclidean distance between the first feature vector and the second feature vector is calculated to measure the similarity between the phishing data and the patterning data, and the similarity is referred to. A method characterized in that it undergoes a learning process in the direction of minimizing the similarity between each of the phishing data and each of the patterning data using a loss function. According to clause 5,
In step (a) above,
With the loss value between the phishing data and the patterning data calculated using the loss function referring to the similarity between the phishing data and the patterning data, backpropagation is performed to obtain the phishing data and the patterning data. A method characterized in that the Siamese Network is learned by updating the shared weight (W) and the bias b so that the loss value between them becomes the minimum value. In a method of detecting the phishing data using Siamese Network and KD-Tree algorithms with reference to patterning data obtained through regular expressions for phishing data,
(a) After patterning each of the plurality of phishing data based on each of the plurality of phishing data and the regular expression for each of the plurality of phishing data to obtain each of the plurality of patterned data, each of the plurality of phishing data is is input to a first CNN of the Siamese Network, each of the plurality of patterned data is input to a second CNN of the Siamese Network, each first feature is output by the first CNN, and each of the first features is output by the second CNN When each feature is output and the Siamese Network is learned so that the distance between the first feature and the second feature is less than or equal to a preset threshold, when a KD-tree device is connected to the output terminal of the Siamese Network, the KD- The tree device includes: expressing target patterning data features corresponding to target patterning data for target data on a KD-tree;
(b) when new data is input to the first CNN of the Siamese Network and new data features are output, the KD-tree device maps the new data features on the KD-tree; and
(c) The KD-tree device determines that the new data corresponds to phishing data with reference to the distance between the new data feature corresponding to the new data and the target patterned data feature expressed on the KD-tree. A step of determining whether it is possible;
Including,
In step (a) above,
From each of the phishing data, each normal partial data and each remaining data excluding the normal partial data are extracted based on each special character, and each of the remaining data is divided into n abnormal partial data, each of the normal partial data By keeping the abnormal partial data as is and replacing it with the 1_1st patterned data to the 1_nth patterned data based on the regular expressions for each of the abnormal partial data, the normal partial data and the 1_1th patterned data to the 1_nth patterned data are A method comprising generating each of the patterned data. According to clause 7,
In step (a) above,
In generating each of the patterned data from each of the phishing data, each of the normal partial data and the n abnormal partial data are extracted from each of the phishing data based on each of the special characters, and the n abnormal partial data are extracted from each of the phishing data. A first pattern corresponding to an integer excluding the normal domain, a second pattern corresponding to an integer and a character excluding the normal domain, and a third pattern corresponding to the normal domain and an integer, a character and a character corresponding to the normal domain, respectively. A method characterized in that patterning is performed by determining which pattern among a fourth pattern, a fifth pattern corresponding to the normal domain and characters, and a sixth pattern corresponding to characters excluding the normal domain. In a method of detecting the phishing data using Siamese Network and KD-Tree algorithms with reference to patterning data obtained through regular expressions for phishing data,
(a) After patterning each of the plurality of phishing data based on each of the plurality of phishing data and the regular expression for each of the plurality of phishing data to obtain each of the plurality of patterned data, each of the plurality of phishing data is is input to a first CNN of the Siamese Network, each of the plurality of patterned data is input to a second CNN of the Siamese Network, each first feature is output by the first CNN, and each of the first features is output by the second CNN When each feature is output and the Siamese Network is learned so that the distance between the first feature and the second feature is less than or equal to a preset threshold, when a KD-tree device is connected to the output terminal of the Siamese Network, the KD- The tree device includes: expressing target patterning data features corresponding to target patterning data for target data on a KD-tree;
(b) when new data is input to the first CNN of the Siamese Network and new data features are output, the KD-tree device maps the new data features on the KD-tree; and
(c) The KD-tree device determines that the new data corresponds to phishing data with reference to the distance between the new data feature corresponding to the new data and the target patterned data feature expressed on the KD-tree. A step of determining whether it is possible;
Including,
In step (b) above,
A plurality of the new data are input,
In step (c) above,
The KD-tree device, with reference to the distance between each of the new data features corresponding to each of the new data and each of the target patterned data features expressed on the KD-tree, determines that each of the new data features is at least one A method characterized by determining which domain is clustered into each of the normal domains. According to clause 9,
In step (c) above,
In a state where the KD-tree device converts the distribution of each of the new data features corresponding to each of the new data and each of the target patterned data features expressed on the KD-tree into two dimensions, the new data feature If each is similar to each of the normal domains, each of the new data features is clustered into at least one specific normal domain corresponding to each of the new data features among each of the normal domains. In a computing device that detects the phishing data using Siamese Network and KD-Tree algorithms with reference to patterned data obtained through regular expressions for the phishing data,
at least one memory storing instructions; and
At least one processor configured to execute the instructions,
The processor, (I) patterns each of the plurality of phishing data based on each of the plurality of phishing data and the regular expression for each of the plurality of phishing data to obtain each of the plurality of patterned data, and then obtains each of the plurality of patterned data, Each piece of data is input to a first CNN of the Siamese Network, each of the plurality of patterned data is input to a second CNN of the Siamese Network, each first feature is output by the first CNN, and the second CNN When each second feature is output and the Siamese Network is learned so that the distance between the first feature and the second feature is less than a preset threshold, when a KD-tree device is connected to the output terminal of the Siamese Network , a process of expressing target patterning data features corresponding to target patterning data for target data on a KD-tree, (II) when new data is input to the first CNN of the Siamese Network and new data features are output , a process of mapping the new data feature on the KD-tree, and (III) referring to the distance between the new data feature corresponding to the new data and the target patterned data feature expressed on the KD-tree. Perform a process to determine whether the new data corresponds to phishing data,
In process (I) above,
Each of the plurality of phishing data is integerized based on a predetermined dictionary to create each phishing data array made of numbers, and each of the plurality of patterned data is integerized to make each patterned data array made of numbers, When each of the phishing data arrays is input to the first CNN of the Siamese Network and each of the patterned data arrays is input to the second CNN, a phishing data array feature corresponding to the phishing data array is generated by the first CNN. When each of the patterned data array features corresponding to the patterned data array is output by the second CNN, the Euclidean distance between the phishing data array feature and the patterned data array feature is calculated. Characterized by measuring the similarity between the phishing data and the patterning data and learning to minimize the similarity between each of the phishing data and the patterning data using a loss function with reference to the similarity. A computing device that does. According to clause 11,
In process (I) above,
After each of the plurality of phishing data is input to the first CNN of the Siamese Network, and each of the plurality of patterning data is input to the second CNN of the Siamese Network, the first CNN of the Siamese Network and the With a shared weight (W) between the second CNNs, if it is determined that each of the plurality of phishing data and each of the plurality of patterning data are the same data, each of the first features output from the first CNN and the If the distance of each of the second features output from the second CNN is learned to be less than or equal to a preset threshold, and each of the plurality of phishing data and each of the plurality of patterning data are determined to be different data, each of the first features and A computing device characterized in that the distance of each second feature is learned to exceed a preset threshold. delete According to clause 11,
In process (I) above,
After each of the plurality of phishing data is acquired and each of the plurality of patterned data is obtained by patterning each of the plurality of phishing data based on each regular expression for each of the plurality of phishing data, each of the plurality of phishing data and each of the plurality of patterned data is input to the Siamese Network, each of the first feature and each of the second feature is output as a feature vector by the Siamese Network, and the distance from the feature vector is determined by the Siamese Network. When output, a computing device characterized in that the Siamese Network is learned with reference to the distance. In a computing device that detects the phishing data using Siamese Network and KD-Tree algorithms with reference to patterned data obtained through regular expressions for the phishing data,
at least one memory storing instructions; and
At least one processor configured to execute the instructions,
The processor, (I) patterns each of the plurality of phishing data based on each of the plurality of phishing data and the regular expression for each of the plurality of phishing data to obtain each of the plurality of patterned data, and then obtains each of the plurality of patterned data, Each piece of data is input to a first CNN of the Siamese Network, each of the plurality of patterned data is input to a second CNN of the Siamese Network, each first feature is output by the first CNN, and the second CNN When each second feature is output and the Siamese Network is learned so that the distance between the first feature and the second feature is less than a preset threshold, when a KD-tree device is connected to the output terminal of the Siamese Network , a process of expressing target patterning data features corresponding to target patterning data for target data on a KD-tree, (II) when new data is input to the first CNN of the Siamese Network and new data features are output , a process of mapping the new data feature on the KD-tree, and (III) referring to the distance between the new data feature corresponding to the new data and the target patterned data feature expressed on the KD-tree. Perform a process to determine whether the new data corresponds to phishing data,
In process (I) above,
When each of the phishing data and each of the patterning data are input to each of the first CNN and the second CNN of the Siamese Network, with a shared weight (W) and bias b between the first CNN and the second CNN In the state, the bias b is added to each of the phishing weight data and the patterning weight data for each of the phishing data and each of the patterning data, and then an activation function is applied to create a first feature vector for the first feature and the first feature vector. When the second feature vector for the 2 feature is output, the Euclidean distance between the first feature vector and the second feature vector is calculated to measure the similarity between the phishing data and the patterning data, and the similarity is referred to. A computing device characterized in that it undergoes a learning process to minimize the similarity between each of the phishing data and each of the patterned data using a loss function. According to clause 15,
In process (I) above,
With the loss value between the phishing data and the patterning data calculated using the loss function referring to the similarity between the phishing data and the patterning data, backpropagation is performed to obtain the phishing data and the patterning data. A computing device characterized in that it undergoes a process of learning the Siamese Network by updating the shared weight (W) and the bias b so that the loss value between them becomes the minimum value. In a computing device that detects the phishing data using Siamese Network and KD-Tree algorithms with reference to patterned data obtained through regular expressions for the phishing data,
at least one memory storing instructions; and
At least one processor configured to execute the instructions,
The processor, (I) patterns each of the plurality of phishing data based on each of the plurality of phishing data and the regular expression for each of the plurality of phishing data to obtain each of the plurality of patterned data, and then obtains each of the plurality of patterned data, Each piece of data is input to a first CNN of the Siamese Network, each of the plurality of patterned data is input to a second CNN of the Siamese Network, each first feature is output by the first CNN, and the second CNN When each second feature is output and the Siamese Network is learned so that the distance between the first feature and the second feature is less than a preset threshold, when a KD-tree device is connected to the output terminal of the Siamese Network , a process of expressing target patterning data features corresponding to target patterning data for target data on a KD-tree, (II) when new data is input to the first CNN of the Siamese Network and new data features are output , a process of mapping the new data feature on the KD-tree, and (III) referring to the distance between the new data feature corresponding to the new data and the target patterned data feature expressed on the KD-tree. Perform a process to determine whether the new data corresponds to phishing data,
In process (I) above,
From each of the phishing data, each normal partial data and each remaining data excluding the normal partial data are extracted based on each special character, and each of the remaining data is divided into n abnormal partial data, each of the normal partial data By keeping the abnormal partial data as is and replacing it with the 1_1st patterned data to the 1_nth patterned data based on the regular expressions for each of the abnormal partial data, the normal partial data and the 1_1th patterned data to the 1_nth patterned data are A computing device comprising generating each of the patterned data. According to clause 17,
In process (I) above,
In generating each of the patterned data from each of the phishing data, each of the normal partial data and the n abnormal partial data are extracted from each of the phishing data based on each of the special characters, and the n abnormal partial data are extracted from each of the phishing data. A first pattern corresponding to an integer excluding the normal domain, a second pattern corresponding to an integer and a character excluding the normal domain, and a third pattern corresponding to the normal domain and an integer, a character and a character corresponding to the normal domain, respectively. A computing device characterized in that patterning is performed by determining which pattern corresponds to a fourth pattern, a fifth pattern corresponding to the normal domain and characters, and a sixth pattern corresponding to characters excluding the normal domain. In a computing device that detects the phishing data using Siamese Network and KD-Tree algorithms with reference to patterned data obtained through regular expressions for the phishing data,
at least one memory storing instructions; and
At least one processor configured to execute the instructions,
The processor, (I) patterns each of the plurality of phishing data based on each of the plurality of phishing data and the regular expression for each of the plurality of phishing data to obtain each of the plurality of patterned data, and then obtains each of the plurality of patterned data, Each piece of data is input to a first CNN of the Siamese Network, each of the plurality of patterned data is input to a second CNN of the Siamese Network, each first feature is output by the first CNN, and the second CNN When each second feature is output and the Siamese Network is learned so that the distance between the first feature and the second feature is less than a preset threshold, when a KD-tree device is connected to the output terminal of the Siamese Network , a process of expressing target patterning data features corresponding to target patterning data for target data on a KD-tree, (II) when new data is input to the first CNN of the Siamese Network and new data features are output , a process of mapping the new data feature on the KD-tree, and (III) referring to the distance between the new data feature corresponding to the new data and the target patterned data feature expressed on the KD-tree. Perform a process to determine whether the new data corresponds to phishing data,
In process (II) above,
A plurality of the new data are input,
The processor,
In process (III) above,
With reference to the distance between each of the new data features corresponding to each of the new data and each of the target patterned data features expressed on the KD-tree, each of the new data features is selected from one of at least one normal domain. A computing device characterized in that it determines whether it is clustered. According to clause 19,
The processor,
In process (III) above,
In a state where the distribution of each of the new data features corresponding to each of the new data and each of the target patterned data features expressed on the KD-tree is converted into two dimensions, each of the new data features is divided into each of the normal domains and If similar, each of the new data features is clustered into at least one specific normal domain corresponding to each of the new data features among the normal domains.