摘要：

Web3作为"去中心化的下一代互联网"范式, 依托区块链技术, 成为数智服务生态中极具潜力的新兴领域。然而, Web3钓鱼网站对生态健康构成了严重威胁, 钓鱼者精心设计域名作为主要诱饵, 诱导用户访问并进行高风险操作以窃取数字资产。目前, Web3反钓鱼工作主要集中在钓鱼账户检测、钓鱼交易检测和钓鱼团伙挖掘, 而现有钓鱼网站域名检测工作主要面向传统钓鱼网站, 存在适应性不足、缺乏系统性分析等局限性。为此, 提出一种针对Web3钓鱼网站域名的检测方法WPWHunter, 对检测到的真实Web3钓鱼网站进行多维度分析, 并探究大语言模型(LLM)在网页分析方面的应用潜力。WPWHunter检测算法对Web3钓鱼网站域名中的诱导词、视觉欺骗、项目名模仿3种特征进行检测, 实验结果表明, WPWHunter能够有效检测出可疑的Web3钓鱼域名, 在测试集上G-means指标达到0.769, 相比表现最佳的基线方法提升了0.048。此外, 作为补充的探索实验, 使用3个通用LLM对WPWHunter未能成功检测的Web3钓鱼网页内容进行分析, 总结LLM判定Web3钓鱼网站时的依据。

关键词: Web3, 网络安全, 钓鱼网站, 域名检测, 大语言模型

Abstract:

As the paradigm of ″decentralized next-generation Internet, ″ Web3, relying on blockchain technology, has become an emerging field with great potential in the digital intelligence service ecosystem. However, Web3 phishing websites pose a serious threat to ecological health. Phishers carefully design domain names as the primary bait, inducing users to visit and engage in high-risk operations to steal digital assets. Currently, the antiphishing works of Web3 primarily focus on phishing account detection, phishing transaction detection, and phishing gang mining, whereas the existing phishing website domain name detection primarily targets traditional phishing websites, which have limitations such as insufficient adaptability and a lack of systematic analysis. To this end, a detection method called WPWHunter is proposed for Web3 phishing website domain names, which conducts multidimensional analysis on the detected real Web3 phishing websites and explores the potential application of Large Language Model (LLM) in web page analysis. The WPWHunter algorithm detects three features in Web3 phishing website domain names: inducing words, visual deception, and item name imitation. The experimental results show that WPWHunter can effectively detect suspicious Web3 phishing domains with a G-means index of 0.769 on a test set, which is 0.048 higher than that of the best-performing baseline method. Additionally, as a supplementary exploratory experiment, three universal LLM are used to analyze the content of Web3 phishing websites that WPWHunter failed to detect and the logic used by LLM to determine Web3 phishing websites is summarized.

Key words: Web3, cyber security, phishing website, domain detection, Large Language Model (LLM)