Method and device for detecting phishing web page

A device for detecting a phishing web page, comprising:

• a trusted domain name database, configured to store a unique domain name that corresponds to a trusted web page;
• a template file database, configured to store multiple template files, wherein the template files comprise a content characteristic extracted from a web page, and the content characteristic comprises at least:
• a coding format, a document object model, a word, and a number of words;
• a domain name determining module, configured to judge whether a unique domain name corresponding to a to-be-detected web page exists in the trusted domain name database;
• a content extracting module, configured to extract a content characteristic from the to-be-detected web page if the unique domain name does not exist in the trusted domain name database;
• a similarity determining module, configured to determine a similarity between the content characteristic extracted from the to-be-detected web page and a content characteristic of each template file in the template file database;
• and
• a phishing web page determining module, configured to determine that the to-be-detected web page is the phishing web page if a similarity between the content characteristic extracted from the to-be-detected web page and a content characteristic of at least one template file is greater than a preset similarity threshold.

A method for detecting a phishing web page, comprising:

• judging whether a unique domain name corresponding to a to-be-detected web page exists in a trusted domain name database;
• if the unique domain name does not exist in the trusted domain name database, determining a similarity between a content characteristic extracted from the to-be-detected web page and a content characteristic of each template file in a template file database, wherein the content characteristic comprises at least:
• a word, a number of words, and a document object model;
• and
• determining that the to-be-detected web page is a phishing web page if the similarity between the content characteristic extracted from the to-be-detected web page and a content characteristic of at least one template file is greater than a preset similarity threshold.