基于交叉注意力和原型学习的小样本钓鱼邮件检测  

Cross-attention and prototype learning for few-shot phishing mail detection

作　　者：闫驰 张贵强 郑礼 YAN Chi;ZHANG Guiqiang;ZHENG Li(School of Information Engineering,Lanzhou Petrochemical Univ.of Vocational Technology,Lanzhou 730060,China;School of Electronic and Information Engineering,Lanzhou Jiaotong Univ.,Lanzhou 730070,China)

机构地区：[1]兰州石化职业技术大学信息工程学院,兰州730060 [2]兰州交通大学电子与信息工程学院,兰州730070

出　　处：《海军工程大学学报》2025年第1期91-97,共7页Journal of Naval University of Engineering

基　　金：甘肃省青年科学基金资助项目(23JRRA1695);甘肃省科技计划资助项目(24JRZA156)。

摘　　要：针对现有钓鱼邮件检测方法的性能过度依赖训练数据集,以及对新出现的钓鱼邮件检测泛化性不强的问题,提出了一种基于交叉注意力和原型学习的小样本钓鱼邮件检测方法。该方法采用支持分支和查询分支的元学习框架,首先利用Transformer网络的Encoder编码器将双分支网络输入的钓鱼邮件映射到同一深度特征空间,并利用下采样操作构造多尺度特征集;其次,在每一尺度特征图上计算自注意力,强化模型对钓鱼邮件中关键信息的捕获能力,并利用平均池化在自注意力后的每一尺度特征图上生成原型表示;再次,在支持分支和查询分支生成的多个原型表示上建立交叉注意力,促进分支间信息的交流,提升模型的泛化性;最后,将查询分支中待测邮件和交互原型集送入度量模块中,实现待测邮件的检测。实验结果表明:所提出的钓鱼邮件检测方法可以实现96.4%的检测精准率,具有较好的实际应用价值。To address the issues of over-reliance on training datasets and poor generalization to new phishing emails in existing phishing email detection methods,a novel few-shot phishing email detection method based on cross-attention and prototype learning was proposed.The meta-learning framework with support and query branches was utilized in that method.Firstly,the encoder of the Transformer network was used to map the input from both branches into a unified depth feature space and construct multi-scale feature sets through down sampling operations.Secondly,the self-attention was computed on each scale feature map to enhance the ability for capturing critical information in phishing emails,and prototype representations were generated using the average pooling after self-attention on each scale feature map.Subsequently,the cross-attention was established between the multiple prototype representations generated by the support and query branches to facilitate information exchange between branches and improve model generalization.Finally,the emails to be tested in the query branch and interaction prototype set were fed into the metric module for detection.The experimental results demonstrate that the proposed detection method achieves a detection accuracy of 96.4%,de-monstrating its practical applicability.

关 键 词：钓鱼邮件检测 交叉注意力 原型学习 元学习 TRANSFORMER 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]