Detection of phishing internet link

1. A computer implemented method in a data processing system comprising a processor and a memory comprising instructions, which are executed by the processor to cause the processor to implement the method for detecting a phishing internet link, wherein an internet link is a Uniform Resource Locator (URL) or a domain name, the method comprising:

receiving, by the processor, the internet link;

identifying, by the processor, one or more accent-based non-English characters in the internet link;

looking up, by the processor, each identified accent-based non-English character in the Unicode Technical Standard (UTS) to obtain the corresponding correct English character;

replacing, by the processor, each of the one or more accent-based non-English characters in the internet link with the corresponding correct English character;

removing, by the processor, a top-level domain from the amended internet link;

removing, by the processor, a common subdomain from the amended internet link;

splitting, by the processor, the remaining internet link into a list of words;

converting, by the processor, the list of words into a list of word vectors;

calculating, by the processor, an average word vector of the list of word vectors; and

providing, by the processor, a phishing score for the average vector, indicating a probability of the internet link being a phishing internet link,

wherein the step of providing a phishing score for the average vector further comprises:

inputting the average vector into an SVM classifier to output a distance to a hyperplane;

converting the distance to the hyperplane to a classification probability using Platt scaling; and

providing the phishing score based on the classification probability.

2. The method as recited in claim 1 , further comprising:

removing, by the processor, a protocol path from the amended internet link, wherein the amended internet link is the URL.

3. The method as recited in claim 1 , further comprising:

splitting, by the processor, the remaining internet link into a list of words based on a Zipf's law.

4. The method as recited in claim 3 , wherein a divide-and-conquer algorithm is applied to split the remaining internet link into the list of words, so that a sum of an occurrence probability of each word is maximized.

5. The method as recited in claim 3 , wherein the Zipf's law obtains an occurrence probability of each word from a frequency table, wherein each word is a unigram, wherein the frequency table includes occurrence probabilities of a plurality of words appearing in a text corpus.

6. The method as recited in claim 1 , further comprising:

converting, by the processor, the list of words into the list of word vectors through an unsupervised learning algorithm GloVe.

7. A computer program product for detecting a phishing internet link, wherein an internet link is a Uniform Resource Locator (URL) or a domain name, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:

receive the internet link;

identify one or more accent-based non-English characters in the internet link;

look up each identified accent-based non-English character in the Unicode Technical Standard (UTS) to obtain the corresponding correct English character;

replace each of the one or more accent-based non-English characters in the internet link with the corresponding correct English character;

remove a top-level domain from the amended internet link;

remove a common subdomain from the amended internet link;

split the remaining internet link into a list of words;

convert the list of words into a list of word vectors;

calculate an average word vector of the list of word vectors; and

provide a phishing score for the average vector, indicating a probability of the internet link being a phishing internet link,

wherein the step of providing a phishing score for the average vector further configures the processor to:

input the average vector into an SVM classifier to output a distance to a hyperplane;

convert the distance to the hyperplane to a classification probability using Platt scaling; and

provide the phishing score based on the classification probability.

8. The computer program product of claim 7 , wherein the program instructions executable by the processor further cause the processor to:

remove a protocol path from the internet link, wherein the amended internet link is the URL.

9. The computer program product of claim 7 , wherein the program instructions executable by the processor further cause the processor to:

split the remaining internet link into the list of words based on a Zipf's law.

10. The computer program product of claim 9 , wherein a divide-and-conquer algorithm is applied to split the remaining internet link into the list of words, so that a sum of an occurrence probability of each word is maximized, wherein each word is a unigram.

11. The computer program product of claim 9 , wherein the Zipf s law is expressed as prob(w)=1/(n*log(N)), where prob(w) is an occurrence probability of word “w,” n is a rank of the word “w” in a frequency table, and “N” is the total number of words in the frequency table.

12. A system for detecting a phishing internet link, wherein an internet link is a Uniform Resource Locator (URL) or a domain name, the system comprising:

a processor configured to:

receive the internet link;

identify one or more accent-based non-English characters in the internet link;

look up each identified accent-based non-English character in the Unicode Technical Standard (UTS) to obtain the corresponding correct English character;

replace each of the one or more accent-based non-English characters in the internet link with the corresponding correct English character;

remove a top-level domain from the amended internet link;

remove a common subdomain from the amended internet link;

split the remaining internet link into a list of words;

convert the list of words into a list of word vectors;

calculate an average word vector of the list of word vectors; and

provide a phishing score for the average vector, indicating a probability of the internet link being a phishing internet link,

wherein the step of providing a phishing score for the average vector further configures the processor to:

input the average vector into an SVM classifier to output a distance to a hyperplane;

convert the distance to the hyperplane to a classification probability using Platt scaling; and

provide the phishing score based on the classification probability.

13. The system of claim 12 , wherein the processor is further configured to:

split the remaining internet link into a list of words based on a Zipf's law, wherein each word is a unigram, wherein the Zipf's law is expressed as prob(w)=1/(n*log(N)), where prob(w) is an occurrence probability of word “w,” n is a rank of the word “w” in a frequency table, and “N” is the total number of words in the frequency table.

14. The system of claim 13 , wherein a divide-and-conquer algorithm is applied to split the remaining internet link into the list of words, so that a sum of an occurrence probability of each word is maximized.

15. The system of claim 12 , wherein the processor is further configured to:

convert the list of words into the list of word vectors through an unsupervised learning algorithm GloVe.