KR101265448B1 - Method of detecting phishing site using network filter driver - Google Patents

Abstract

PURPOSE: A phishing site test method is provided to reduce the burden of maintenance by implementing an anti-phishing function with a network filter driver. CONSTITUTION: A web browser(110) generates and delivers an HTTP(Hypertext Transfer Protocol) request message. A network filter driver(120) analyzes the HTTP request message and stores URL(Uniform Resource Locator) information of a web site. The network filter driver verifies if an HTTP response message is a response to the HTTP request message. The network filter driver inserts a test request script and delivers to the web browser. A verification server(300) checks if the web site is a phishing site by using the URL information of the web site. [Reference numerals] (110) Web browser; (121) HTTP session management part; (122) Packet transmitting part; (123) Packet receiving part; (124) HTTP request processing part; (125) HTTP response processing part; (130) Network interface card; (200) Web server; (300) Verification server

Description

Phishing site inspection method using network filter driver {METHOD OF DETECTING PHISHING SITE USING NETWORK FILTER DRIVER}

The present invention relates to a phishing site inspection method using a network filter driver. More specifically, the network filter inserts a phishing site inspection request script into an HTTP response message transmitted from a web server by a web browser request to the web browser. And a phishing site inspection method using a network filter driver that checks whether the verification server is a phishing site and delivers it to the web browser when the web browser executes the inspection request script.

Phishing is a compound word of private data and fishing. It is a fraudulent method that extracts user's personal information by using e-mails and fake websites forging Internet identifiers such as domain names and IP addresses. .

In general, phishing attackers send impersonated messages to a victim by sending them through a means of communication such as e-mail or messenger. The attacker then tries to obtain confidential personal information such as social security numbers, passwords, and financial information of the victim who came to the fake site pretended by fake messages.

Client-side anti-phising solutions to prevent such phishing attacks usually detect phishing sites through website monitoring that users access, and notify the user. In order to detect phishing sites, these anti-phishing solutions must be basically monitored and analyzed by the user's website. In order to implement such a task, a plug-in method provided by a web browser is usually used. . For example, if your anti-phishing solution wants to support Microsoft's Microsoft Internet Explorer browser, you'll need to develop functionality using the Internet Explorer's toolbar or Browser Helper Objects (BHO).

1 is a view showing an anti-phishing process according to the prior art, it describes the anti-phishing system of the plug-in manufacturing method.

When a user requests a web page from a web browser through a web browser, the web server generates a web page and a session ID to be sent to the web browser. The generated web page is hashed to calculate a hash value (H (Spage)), and the calculated hash value is stored in a database along with the session ID and the IP (Internet Protocol) of the web browser that requested the web page. In this process, as shown in FIG. 1, the web server transmits a web page (Cpage) and a session ID to the web browser.

The web browser receives a web page generated from a web server and also receives a session ID through a cookie.

The web page received from the web server contains the code to execute the plug-in. As a result, the plug-in generates a session key (SK) to be shared with the web server.

The generated session key is encrypted using the unique key of the plug-in shared with the web server, and then transmitted along with the unique ID of the plug-in, the session ID received from the web server, and the message authentication code. Here, as shown in FIG. 1, the message authentication code MAC is generated using the session key SK based on an encrypted session key, a unique ID of a plug-in, a session ID, and a hash value of a web page.

When the plug-in is installed for the first time, it generates its own unique key (Pluginkey), encrypts it using the public key used when deploying the plug-in in the web server, and sends it to the web server. The web server decrypts it with the private key, stores it in the database with the unique ID (PluginID) generated by the web server, and sends the unique ID (PluginID) to the plug-in. Through this process, the plug-in and the web server can share the plug-in unique key and the plug-in unique ID.

The web server first checks the message authentication code (MAC) received from the plug-in and sends an image notifying the plug-in if there is a problem. If there is no error in the message authentication code (MAC), the web server restores the encrypted session key received from the plug-in using the plug-in unique key (PluginKey) assigned to the ID of the plug-in stored in the web server. Using the key, the thumbnail image to be displayed on the tray of the web page is transmitted to the plug-in together with the hash value (H (Spage)) of the web page stored in the database. In addition, the web server renames the original image for the thumbnail image sent to the plug-in to the name hashed by Spage and the session key (SK) (Image.bmp-> H (Spage | SK)).

The plug-in first decrypts the content received from the web server using the session key, and then compares H (Spage) with the H (Cpage) it has. As a result of the comparison, if H (Spage) and H (Cpage) are the same, since the correct contents are received from the web server, the image received from the web server is displayed in the tray of the web page. The web page code requests the original image (H (Spage | SK) .bmp) file from the web server. The original image you are requesting is the picture that will be displayed on the web page.

Since the web server already has H (Spage | SK) .bmp, the web server responds to the image request from the web browser, and the web browser outputs the normal image. Finally, the user can directly determine whether the current web page is a phishing site by comparing the thumbnail image displayed in the tray with the original image displayed in the web page.

This web browser-specific plug-in creation method must first support add-ons or plug-ins that enable users to monitor websites accessed by the supported web browsers. Since the production, it was difficult to find a quick phishing site.

In addition, if the web browser that the web browser to support in the web browser creation method does not provide the necessary functions to implement the anti-phishing function through the plug-in, the browser had to give up the anti-phishing support or find another way.

In addition, the conventional anti-phishing solution operates in the order of "anti-phishing check-> web page browsing or blocking", the web page can not be browsed until the anti-phishing check is over, the web page opening speed is slowed .

Republic of Korea Patent Publication No. 2010-0008729

The present invention for solving the above problems intercepts and records the incoming or outgoing HTTP message from the web browser, by inserting the phishing site inspection request script into the HTML code of the HTTP response message coming from the external web server verification server An object of the present invention is to provide a phishing site inspection method using a network filter driver that can obtain a result of whether or not a phishing site is obtained from a network.

The present invention devised to solve the above-described problem is a method for informing and confirming whether or not a website to be accessed by the user terminal 100 is a phishing site, and the web request message generated by the web browser 110 is transmitted to the network filter driver. A first step (120) analyzing and storing URL information of a website which the web browser (110) tries to access; When the HTTP response message is transmitted from the web server 200 managing the website, the network filter driver 120 determines whether the HTTP response message is an answer to the HTTP request message, and the body of the HTTP response message. Inserting a check request script to check whether a phishing site is included in HTML code included in the second code and transmitting the same to the web browser 110; When the web browser 110 executes the inspection request script, the verification server 300 receives the URL information of the website from the web browser 110 and confirms whether the website is a phishing site, and confirms the result. It includes; a third step of delivering to the user terminal 100.

In the first step, when the web browser 110 generates a TCP packet and transmits it to the network filter driver 120 to access a specific website, the packet transmitter 122 included in the network filter driver 120 Step 1-1 to intercept all the TCP packets transmitted by the web browser 110 to the HTTP session management unit 121; A first step (2) of the HTTP session manager (121) monitoring whether a TCP (Trasmission Control Protocol) session is established in the web browser (110); The first and second steps of the HTTP session manager 121 selecting the TCP packet at the time when the TCP session is established in the web browser 110 and storing the session information included in the selected TCP packet in a session table; ; If the HTTP packet transmitted from the web browser 110 is an HTTP request message, steps 1-4 of the HTTP session managing unit 121 delivering the HTTP packet to the HTTP request processing unit 124; The HTTP request processing unit 124 analyzes the header of the HTTP packet received from the HTTP session management unit 121, and extracts and stores URL information of a website to which the web browser 110 attempts to access. Step 5; After the extraction and storage of the URL information is finished, the HTTP request processing unit 124 to deliver the HTTP packet to the network interface card 130 to transmit to the web server 200; steps 1-6.

In the second step, the packet receiver 123 included in the network filter driver 120 intercepts all HTTP packets received through the network interface card 130 and delivers the received HTTP packets to the HTTP session manager 121. -1 step; When the same session information as the session information of the HTTP packet transmitted from the packet receiver 123 is already stored in the session table, the HTTP session manager 121 transmits the HTTP packet to the HTTP response processor 125. Step 2-2; Step 2-3 of the HTTP response processor 125 inserting the test request script into the HTML code included in the body of the HTTP packet received from the HTTP session manager 121; And step 2-4 of the HTTP response processor 125 delivering the HTTP packet including the check request script to the web browser 110.

The third step may include a step 3-1 of the web browser 110 analyzing the HTTP packet including the HTTP response message to browse the website; The web browser 110 executes the inspection request script inserted into the HTTP packet, and transmits the URL information of the website included in the HTTP packet to the verification server 300 to request a phishing site inspection; Step 3-2; When the verification server 300 transmits a result of checking whether or not a phishing site, the web browser 110, step 3-3 to display the content of the test results on the user terminal (100).

The inspection request script is a Java script or HTML tag to be executed by the web browser 110, the address of the verification server 300, the path of a phishing site inspection request page in the verification server 300, phishing It is characterized by including the address of the website to check whether the site.

The check request script is inserted in the body tag when the body tag is present in the HTML code of the HTTP response message. The body tag is not present in the HTML code of the HTTP response message. The tag is inserted above the tag, and when both the body tag and the script tag are not present in the HTML code of the HTTP response message, the tag is inserted into the HTML tag.

According to the present invention, it is possible to support the anti-phishing function even in a web browser that does not provide a plug-in having a specific function, and since a single module of the network filter driver can implement the anti-phishing function regardless of the web browser, This reduces the burden on maintaining the modules.

In addition, compared to the web browser-specific plug-in production method, the product installation and removal is relatively simple effect.

In addition, by inserting a script into HTML code, web page browsing and anti-phishing checking are performed separately. Therefore, even if the anti-phishing check is not completed, the web page is normally browsed, which has little effect on the opening speed of the web page. .

1 illustrates an antiphishing process according to the prior art.
2 is a conceptual diagram showing the configuration of an anti-phishing system according to an embodiment of the present invention.
3 is a block diagram showing a configuration and a connection state of a user terminal.
4 is a flowchart illustrating a process of registering a TCP packet by the HTTP session manager.
5 is a flowchart illustrating a process of inspecting a phishing site.
Fig. 6 is a diagram illustrating a screen for warning that a phishing site has been detected.

Hereinafter, a "phishing site inspection method using a network filter driver" (hereinafter referred to as "phishing inspection method") according to an embodiment of the present invention with reference to the drawings.

2 is a conceptual diagram showing the configuration of an anti-phishing system according to an embodiment of the present invention, Figure 3 is a block diagram showing the configuration and connection state of the user terminal.

The phishing inspection method of the present invention, when the user terminal 100 is connected to the web server 200 via the Internet, to the verification server 300 to check whether the website managed by the web server 200 is a phishing site Implemented by requesting a test. To this end, a module for performing a phishing test method is installed in the user terminal 100.

The process of accessing the web server 200 of a specific website by a user using the phishing test method of the present invention can be divided into three steps. The first step is that the web browser 110 sends an HTTP request message to the web server 200 of the web site to which the user wants to access. The second step is the web server 200 returns a corresponding HTTP response message to the web browser 110 requesting the HTTP message. The third step is to interpret the HTTP response message received by the web browser 110 and output the desired website screen.

The present invention intercepts the HTTP request message generated in the first step and collects URL information of a website that the user wants to access. In the second step, the received HTTP response message is intercepted to find an appropriate location among the entire HTML code, and the phishing site inspection request script is inserted into the web browser 110. Finally, in the third step, the phishing site website currently connected to the phishing site verification server 300 is executed by executing the phishing site inspection request script added in the previous step in the process of interpreting the HTTP response message received by the web browser 110. It is a step of requesting inspection of the site.

The first and second steps are performed within the network filter driver 120, which is designed for inbound / outbound packet inspection and manipulation. The final third step is that the phishing site verification server 300 prepared for phishing site inspection must be operating from the outside.

In order to perform such an operation, a module for transmitting and receiving or intercepting an HTTP message is installed inside the user terminal 100. In the present invention, the network filter driver 120 performs such a function.

As shown in FIG. 3, the user terminal 100 receives a web browser 110 representing a web page data transmitted from the web server 200 and a network data packet coming in or going out through a network interface card (NIC) 130. The network filter driver 120 is provided. The network filter driver 120 filters, modifies, and transmits data packets transmitted and received by the web browser 110, and a data packet monitoring function may be added as in the present invention.

The network filter driver 120 includes an HTTP session manager 121. The HTTP session manager 121 stores information about a session in which a connection is established while monitoring a network connection state between the web browser 110 and the web server 200. In addition, the network packet (HTTP packet) that enters or exits the user terminal 100 is selected and selects an HTTP packet in which information about a session is stored.

The packet transmitter 122 intercepts all HTTP packets transmitted from the user terminal 100 to the outside and delivers them to the HTTP session manager 121, and the packet receiver 123 is reversely transmitted from the outside to the user terminal 100. It intercepts the HTTP packet and delivers it to the HTTP session manager 121.

The HTTP request processing unit 124 analyzes the HTTP packet selected by the HTTP session management unit 121, extracts and stores URL information of a website to which the process of the web browser 110 attempts to access.

The HTTP response processor 125 analyzes the HTTP packet selected by the HTTP session manager 121 and inserts a phishing site inspection request script into an appropriate location of the HTML code included in the body of the message.

The verification server 300 checks whether the website which the web browser 110 is attempting to access is a phishing site at the request of the web browser 110, and transmits the result to the web browser 110.

This article describes how to scan phishing sites in more detail.

First, a description will be given of how the HTTP session manager 121 monitors the process of establishing a session in the web browser 110.

4 is a flowchart illustrating a process of registering a TCP packet by the HTTP session manager.

First, in order to access a specific website, the web browser 110 generates a TCP packet (including an HTTP packet) and transmits it to the network filter driver 120. (S102) The packet transmitter 122 is configured to send a web browser 110. It intercepts all the TCP packets and transmits them to the HTTP session manager 121 (S104).

The HTTP session manager 121 receives the incoming TCP packet through the packet transmitter 122 and monitors the behavior of establishing a TCP (Trasmission Control Protocol) session for the web browser 110 to connect to the website in real time. If the HTTP session manager 121 detects a TCP session made by the web browser 110 during the monitoring, the session information is transmitted to the HTTP session manager 121 for the purpose of efficiently selecting TCP messages generated in the TCP session. (S106) The stored session information is basically included in the TCP packet at the time of establishing a TCP session among all the TCP packets transmitted and received through the packet transmitter 122 and the packet receiver 123. Information includes local IP address, local port number, remote IP address, remote port number, and the like.

In the TCP session, SYN packets, SYN-ACK packets, and ACK packets are sequentially transmitted between the client and the server, thereby storing the port information of the client and the server, and establishing a session while exchanging data between designated ports. Accordingly, the establishment of a session can be detected by monitoring a three-way-handshaking process in which three types of TCP packets are sequentially transmitted. Since the three-way-handshaking process, which is a establishment process of a TCP session, is a general technology, a detailed description thereof will be omitted.

As soon as a TCP session is established through 3 Way-Handshaking without any problem, it is checked in which process of the user terminal 100 the local port number indicated by the TCP session is open. If the local port number being opened by the web browser 110 process, the session becomes a "TCP session of interest" and stores session information about the session in the session table. Therefore, the information stored in the session table of the HTTP session management unit 121 becomes information of the "TCP session established in the web browser 110 process."

In addition, the HTTP session management unit 121 may monitor the termination behavior of the already managed TCP session separately from the website request process and detect the termination of the managed TCP session, and may delete the corresponding session information from the internal session table.

When the HTTP packet is transmitted from the packet transmitter 122 while the information about the TCP session in which the session is established is stored in the session table, the HTTP session management unit 121 stores the session information among the incoming HTTP packets in the session information. Select the HTTP packet (HTTP request message) matching the (S108).

The HTTP session manager 121 checks whether the received HTTP packet is an HTTP request message, and in the case of an HTTP request message, delivers the HTTP request message to the HTTP request processor 124 so that the HTTP request processor 124 analyzes the header of the HTTP request message. do. The HTTP request processing unit 124 analyzes the header of the HTTP request message and extracts and stores URL information of a website to which the current web browser 110 process attempts to access (S110).

After extraction and storage of the URL information, the HTTP request processing unit 124 transmits the intercepted HTTP packet to the network interface card 130 to transmit to the web server 200 (S112).

In this way, the network filter driver 120 registers the HTTP packet and stores the session information.

Next, the HTTP session manager inserts the test request script.

5 is a flowchart illustrating a process of inspecting a phishing site.

First, it is necessary to select whether there is a response message among the HTTP packets. To this end, the packet receiver 123 intercepts all HTTP packets coming into the user terminal 100 through the network interface card 130 and hands them over to the HTTP session manager 121 (S202).

The HTTP session manager 121 selects an HTTP packet including an incoming HTTP response message as a response to the HTTP request message transmitted by the web browser 110 from the incoming HTTP packet to the HTTP server 200, and then the HTTP response processor 125. The screening method inquires whether the session information of the incoming HTTP packet is the same as the session information stored in the session table of the HTTP session management unit 121. If the message has the same session information, it can be regarded as the HTTP response message of the process in which the TCP session is established.

The HTTP response processing unit 125 inserts a script requesting a phishing site inspection at an appropriate position of the HTML code included in the body of the HTTP packet received from the HTTP session management unit 121 (S206).

The check request script is a Java script or HTML tag to be executed by the web browser 110. When the web browser 110 executes this script, it first requests a phishing site inspection page provided by the phishing site verification server 300, and then confirms whether the verification server 300 is a phishing site, and then the user terminal 100. Notify the result.

The phishing site inspection page in the inspection request script inserted at the present stage includes URL information of a website which the HTTP request processing unit 124 has extracted and stored.

There are three cases where the 'proper location' is inserted into the scan request script for phishing site scans. The first is when the body tag exists in the HTML code of an HTTP packet containing an HTTP response message. In this case, a script is inserted inside the body tag.

The second is when the body tag does not exist in the HTML code and the script tag exists. In this case, the test request script is inserted above the top-level script tag.

Finally, when both the body tag and the script tag do not exist, and only the HTML tag exists, in this case, an inspection request script is inserted inside the HTML tag.

The test request script consists of the following format:

body  Tag or HTML  When inserted inside a tag

<iframe src = "(A) (B)? url = (C) & ip = 218.153.8.103" width = 0 height = 0 frameborder = 0></iframe>

Top script  If you insert it above the tag

<script type = "text / javascript">

// <! [CDATA [

document.write ("<iframe src = '(A) (B)? (C) & ip = 218.153.8.103' width = 0 height = 0 frameborder = 0> </ iframe>");

//]]>

Where (A) is the address of the phishing site verification server 300, (B) is the path of the phishing site inspection request page in the verification server 300, (C) is the address of the website to check whether the phishing site That is, the address of the web site where the web browser 110 requested the HTTP response message.

If the address (A) of the verification server 300 is "http://1.1.1.1", the path (B) of the inspection request page is "/anti_phishing_scan.php", and the address (C) of the website to be inspected. ) Is " http: //www.estsoft.co.kr" FIG. 6 shows an example of writing a script inserted into a body tag or an HTML tag, and FIG. 7 shows an example of writing a script inserted over a top-level script tag.

The HTTP response processor 125 decodes all content encoded or transfer encoded HTTP response messages, inserts a script in a plain text state, and re-encodes the script. The HTTP response processor 125 transmits the HTTP packet intercepted for the script insertion to the web browser 110 when the script insertion is completed.

After receiving the HTTP packet to which the inspection request script for the phishing site is added by the HTTP response processor 125, the web browser 110 analyzes the received HTTP packet and browses the website to which the HTTP response message is sent (S210). In the present invention, since the browsing of the website is performed even before the inspection of the phishing site is completed, it is possible to prevent the phenomenon that the execution of the web page is slow when the actual phishing site is not.

In the process of interpreting the HTTP response message, the web browser 110 executes a check request script for a phishing site. (S212) When the check request script is executed, the verification server 300 verifies URL information of a website included in the script. Send a request to the phishing site inspection (S214).

The verification server 300 receiving the inspection request for the phishing site checks whether the website is a phishing site based on the transmitted URL information. (S216) The verification server 300 checks the phishing site according to the present invention. Since the existing technology disclosed before the filing date is used, detailed description thereof will be omitted.

After the inspection of the verification server 300, the verification server 300 transmits the inspection result to the web browser 110 (S218).

The result received from the verification server 300 is composed of Javascript that opens a window containing the results of the content to inform the user whether or not a phishing site, the web browser 110 executes this script received as a result of the user terminal In operation S220, the display apparatus 100 displays the display device.

)이 나타나는 화면이다.8 is a view showing a screen for warning that the phishing site has been detected, the warning window (

) Is displayed.

Although the preferred embodiments of the present invention have been described above with reference to the accompanying drawings, the above-described technical configuration of the present invention may be embodied by those skilled in the art to which the present invention pertains without changing its technical spirit or essential features of the present invention. It will be appreciated that the present invention may be practiced as. Therefore, the above-described embodiments are to be understood as illustrative and not restrictive in all respects, and the scope of the present invention is indicated by the appended claims rather than the detailed description, and the meaning and scope of the claims and All changes or modifications derived from the equivalent concept should be interpreted as being included in the scope of the present invention.

100: user terminal 110: web browser
120: network filter driver 121: HTTP session management unit
122: packet transmitter 123: packet receiver
124: HTTP request processing unit 125: HTTP response processing unit
130: network interface card 200: web server
300: verification server

Claims (6)

delete As a method of confirming whether the user terminal 100 is a phishing site to be connected to the website,
A first step of the network filter driver 120 analyzing the HTTP request message generated and delivered by the web browser 110 to store URL information of a website to which the web browser 110 attempts to access;
When the HTTP response message is transmitted from the web server 200 managing the website, the network filter driver 120 determines whether the HTTP response message is an answer to the HTTP request message, and the body of the HTTP response message. Inserting a check request script to check whether a phishing site is included in HTML code included in the second code and transmitting the same to the web browser 110;
When the web browser 110 executes the inspection request script, the verification server 300 receives the URL information of the website from the web browser 110 and confirms whether the website is a phishing site, and confirms the result. Includes; a third step of delivering to the user terminal 100;
The first step
When the web browser 110 generates a TCP packet and transmits it to the network filter driver 120 to access a specific website, the packet transmitter 122 included in the network filter driver 120 transmits the web browser 110. Intercepting all the TCP packets transmitted by the &lt; RTI ID = 0.0 &gt;)&lt; / RTI &gt;
A first step (2) of the HTTP session manager (121) monitoring whether a TCP (Trasmission Control Protocol) session is established in the web browser (110);
The first and second steps of the HTTP session manager 121 selecting the TCP packet at the time when the TCP session is established in the web browser 110 and storing the session information included in the selected TCP packet in a session table; ;
If the HTTP packet transmitted from the web browser 110 is an HTTP request message, steps 1-4 of the HTTP session managing unit 121 delivering the HTTP packet to the HTTP request processing unit 124;
The HTTP request processing unit 124 analyzes the header of the HTTP packet received from the HTTP session management unit 121, and extracts and stores URL information of a website to which the web browser 110 attempts to access. Step 5;
After the extraction and storage of the URL information is finished, the HTTP request processing unit 124 to deliver the HTTP packet to the network interface card 130 to transmit to the web server 200; including; How to check phishing site using network filter driver. The method of claim 2,
The second step
A step 2-1 of the packet receiving unit 123 included in the network filter driver 120 intercepting all HTTP packets received through the network interface card 130 and delivering them to the HTTP session managing unit 121;
When the same session information as the session information of the HTTP packet transmitted from the packet receiver 123 is already stored in the session table, the HTTP session manager 121 transmits the HTTP packet to the HTTP response processor 125. Step 2-2;
Step 2-3 of the HTTP response processor 125 inserting the test request script into the HTML code included in the body of the HTTP packet received from the HTTP session manager 121;
And a second step (4) of transmitting, by the HTTP response processor (125), the HTTP packet into which the check request script is inserted, to the web browser (110). The method of claim 3,
The third step is
Step 3-1 of the web browser 110 analyzing the HTTP packet including the HTTP response message to browse the website;
The web browser 110 executes the inspection request script inserted into the HTTP packet, and transmits the URL information of the website included in the HTTP packet to the verification server 300 to request a phishing site inspection; Step 3-2;
When the verification server 300 transmits a result of checking whether or not a phishing site, the web browser 110, step 3-3 to display the content of the test results on the user terminal 100; Network filter comprising a, How to check phishing sites using a driver. 5. The method according to any one of claims 2 to 4,
The inspection request script is a Java script or HTML tag to be executed by the web browser 110, the address of the verification server 300, the path of a phishing site inspection request page in the verification server 300, phishing Phishing site inspection method using a network filter driver, characterized in that it includes the address of the website to be checked whether the site. The method of claim 5,
The inspection request script
If a body tag exists in the HTML code of the HTTP response message, it is inserted into the body tag.
The body tag does not exist in the HTML code of the HTTP response message. If a script tag exists, it is inserted above the top level script tag.
If neither the body tag nor the script tag in the HTML code of the HTTP response message, characterized in that inserted into the HTML tag, phishing site inspection method using a network filter driver.

Images