CN116032508A - A method for automatic whitelist detection of phishing attacks based on process control - Google Patents

Abstract

The invention discloses a method for detecting phishing attacks by an automatic white list based on process control, which is characterized by comprising a matching module, a user confirmation module and a white list database updating module, wherein the anti-reconnaissance technology is used in the process control; the matching module comprises a URL matching sub-module and a DNS matching sub-module; the user confirmation module confirms whether the web page has phishing attack or not by extracting the hyperlink and then applying a phishing detection algorithm, wherein the phishing detection algorithm comprises an algorithm 1 for checking whether the hyperlink is legal or phishing type, if the hyperlink is in the latter state, the system will send out a warning to the user, and if the hyperlink is in the former state, the system will update the white list database; and the white list updating database module writes legal hyperlinks of the first access webpage into a white list database, wherein the legal hyperlinks comprise an IP address and a DNS domain name. The invention can improve the detection rate of the phishing attack, thereby reducing network crimes, avoiding property loss, disclosing confidential information to the public and the like.

Description

A method for automatic whitelist detection of phishing attacks based on process control

Technical Field

The present invention relates to the technical fields of network security, SOC (Security operation center), phishing, trusted centralized control, data collection, operating system, file system and data encryption, and in particular to a method for automatic whitelist detection of phishing attacks based on process control.

Background Art

The use of cyberspace is increasing as it plays an important role in today's business and commercial activities, providing many online services that often simplify people's daily lives. These services allow people to access information everywhere. For example, online banking through the Internet has become very popular, as well as online shopping, as many people have become accustomed to it. The ubiquity of Internet information sharing technology has undoubtedly brought various forms of attacks. The most prominent of these is phishing.

Phishing can be succinctly defined as fraud and malicious behavior, which is often used by hackers to reconnaissance the target network. According to the process control model (Figure 2), reconnaissance is the first step for hackers to launch an attack. If anti-phishing attack technology exists, it can block hackers from the target network, making it impossible for them to break into the "door" and causing no damage or loss to the enterprise network, thereby ensuring the normal operation order of the enterprise network. Therefore, it is crucial to study anti-phishing attack technology.

Several existing anti-phishing technologies have the disadvantage of low detection rates. Blacklists are the most commonly used method for detecting phishing. Blacklists contain phishing websites; however, maintaining blacklists requires a lot of resources to report and verify suspicious websites. In addition, it is difficult to maintain a global blacklist because new phishing websites are constantly emerging. On the other hand, whitelists contain legitimate websites; but just like blacklists, global whitelists are difficult to maintain; it is impossible to develop a database for a whitelist that contains all available real legitimate websites because these websites are so large and growing rapidly.

Summary of the invention

In order to solve the above technical problems, the present invention provides a method for detecting phishing attacks by automatic whitelist based on process control, which adopts an automatic whitelist to detect phishing attack algorithms to improve the detection rate of phishing attacks, thereby reducing cybercrime, avoiding property losses and disclosure of confidential information to the public.

A method for automatic whitelist detection of phishing attacks based on process control, characterized in that it is an anti-reconnaissance technology used in process control, including a matching module, a user confirmation module and a whitelist database update module; the matching module includes a URL matching submodule and a DNS matching submodule; the user confirmation module confirms whether a web page has a phishing attack, which is achieved by extracting a hyperlink and then applying a phishing detection algorithm, the phishing detection algorithm includes Algorithm 1, which is used to check whether the hyperlink is legitimate or a phishing type, if the status is the latter, the system will issue a warning to the user, if the status is the former, the system will update the whitelist database; the whitelist database update module writes the legitimate hyperlink of the first visit to the web page into the whitelist database, including the IP address and DNS domain name; the method also includes the following steps:

(1) If the user is visiting a web page for the first time, based on Algorithm 1, the user confirms whether the web page contains phishing. If it is phishing, the system will warn the user. If it is a legitimate web page, the system will update the whitelist database.

(2) If the user is not visiting the web page for the first time, the URL matches. If the DNS also matches, the website is a legitimate website. Otherwise, it is a phishing website, and a warning is issued to the user.

The algorithm 1 determines the whitelist by performing a comprehensive analysis of actual links and visual links. In addition, it can also calculate the similarity of known trusted websites and make a final decision on the information extracted from the hyperlinks, which can also be obtained from the URL provided by the user. The reason behind extracting the hyperlinks is that the phishing website copies the content of the page from the target original or legitimate web page. The web page may have many forged and simulated hyperlinks pointing to the target legitimate page. Some available URLs in the phishing database will redirect to their corresponding original or legitimate websites. However, if the web page is a genuine web page, it will not point to the phishing web page. The algorithm for detecting phishing determines the status of any URL based on three indicators: empty links present in the source code, web pages that do not contain any hyperlinks, and external links present in the source code.

Furthermore, the empty link in the source code, that is, the web page containing the empty pointer, when the link does not point to any web page or document, it is called an empty link or empty pointer, which is usually represented by <a href="#">. Whenever the link is clicked, it returns to the link on the same page. The attacker uses the empty pointer to achieve his ulterior motives.

Further, the web page that does not contain any hyperlinks, if a website is legitimate, then at least one hyperlink can be easily extracted, and if the total number of links extracted is zero, then the website is considered to be a phishing website, however, if no hyperlink is extracted, then the web page is also considered to be a phishing type.

Furthermore, the external links existing in the source code, Algorithm 1 will be determined based on the results of the extracted hyperlinks. If the hyperlinks are legitimate, most of the hyperlinks point to the same domain, while for phishing websites, most of the hyperlinks point to their respective target domains or external domains. This Algorithm 1 is able to calculate the total number of links extracted from the web page source code and the total number of links pointing to external domains, and select a suitable threshold for the ratio. The determination of the nature of the hyperlink is determined by the following equation:

Wherein, ND _i = the total number of links pointing to the own domain, ∑L = the total number of links extracted from the web page source of the suspicious web page.

The technical effects of the present invention are:

In the present invention, a method for automatically detecting phishing attacks based on a whitelist of process control is provided, characterized in that it is an anti-reconnaissance technology used in process control, including a matching module, a user confirmation module and an update whitelist database module; the matching module includes a URL matching submodule and a DNS matching submodule; the user confirmation module confirms whether a web page has a phishing attack, which is achieved by extracting a hyperlink and then applying a phishing detection algorithm, the phishing detection algorithm includes Algorithm 1, which is used to check whether the hyperlink is legitimate or a phishing type, if the state is the latter, the system will issue a warning to the user, if the state is the former, the system will update the whitelist database; the update whitelist database module writes the legitimate hyperlink of the first visit to the web page into the whitelist database, including the IP address and the DNS domain name. Through the present invention, the detection rate of phishing attacks can be improved, thereby reducing cybercrime, avoiding property losses and disclosing confidential information to the public, etc.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram of a phishing attack life cycle of a method for detecting phishing attacks using an automatic whitelist based on process control;

FIG2 is a schematic diagram of process control of a method for detecting phishing attacks using an automatic whitelist based on process control;

FIG3 is a schematic diagram of a method for detecting phishing attacks through an automatic whitelist based on process control;

FIG. 4 is a schematic diagram of Algorithm 1 of a method for detecting phishing attacks based on an automatic whitelist.

DETAILED DESCRIPTION

The following is a further detailed description of the present invention based on the accompanying drawings and examples:

FIG1 is a schematic diagram of a phishing attack life cycle of a method for detecting phishing attacks using an automatic whitelist based on process control. The disguised web page usually contains a Trojan horse program, etc. The phishing attack involves the following steps:

1. Attackers copy content from the websites of well-known companies or banks and create phishing websites. Attackers keep the visual similarity of the phishing website similar to the corresponding legitimate website to attract more users.

2. The attacker writes emails, including links to phishing websites, and sends them to a large number of users or selected target users.

3. When the user opens the email and visits the disguised website, the Trojan program embedded in the disguised website is activated; this application is to detect before the user visits the disguised website. If it is a legitimate website, the user is allowed to access it. Otherwise, an alarm is issued if it is a phishing website.

4. The attacker delivers the "Trojan program" to the target network through a disguised website. In other words, the attacker delivers the "weaponization" to the target network through a disguised website, and then installs it, elevates permissions, etc.

Figure 2 is a schematic diagram of process control of a method for automatically detecting phishing attacks using a whitelist based on process control. The process control includes three stages:

The first stage: the network stage of the process control model (including: reconnaissance, delivery), the enterprise network system operates normally without any intrusion; at this stage, hackers or attackers will use attacks such as phishing to reconnaissance the target network; and this application provides an anti-reconnaissance technology for detecting the said phishing attacks.

The second stage is the endpoint stage of the process control model (including installation and privilege escalation). From the beginning, the system is always under threat. The attacker is within the enterprise network but does not have full control over the enterprise network.

Phase 3: The domain phase or evacuation phase of the process control model (including: lateral movement, operational objectives, and evacuation), where the attacker elevates privileges and fully controls the machine. The attacker can delete and manipulate logs to make traces of the attack disappear.

Specifically, the reconnaissance phase involves hackers actively or passively gathering information that can be used to support targeting. Such information may include detailed information about the victim's business, critical infrastructure, or personnel. Hackers can use this information to assist in other stages of the hacker lifecycle, such as using the collected information to plan and execute deliveries, determine the scope and priority of post-intrusion targets, or drive and lead further reconnaissance efforts.

Figure 3 is a structural diagram of a method for automatically detecting phishing attacks using a whitelist based on process control. A method for automatically detecting phishing attacks using a whitelist based on process control, characterized in that it includes a matching module, a user confirmation module, and a whitelist database update module; the matching module includes a URL matching submodule and a DNS matching submodule; the user confirmation module confirms whether a web page has a phishing attack, which is achieved by extracting a hyperlink and then applying a phishing detection algorithm, the phishing detection algorithm includes Algorithm 1, which is used to check whether the hyperlink is legitimate or phishing type, if the status is the latter, the system will issue a warning to the user, if the status is the former, the system will update the whitelist database; the whitelist database update module writes the legitimate hyperlink of the first visit to the web page into the whitelist database, including the IP address and DNS domain name; the method also includes the following steps:

(1) If the user is visiting a web page for the first time, based on Algorithm 1, the user confirms whether the web page contains phishing. If it is phishing, the system will warn the user. If it is a legitimate web page, the system will update the whitelist database.

(2) If this is not the first time the user visits a web page, the URL matches. If the DNS also matches, the website is a legitimate website. Otherwise, it is a phishing website, and a warning is issued to the user.

FIG4 is a schematic diagram of Algorithm 1 of a method for detecting phishing attacks based on an automatic whitelist. Algorithm 1 determines the whitelist by performing a comprehensive analysis of actual links and visual links. In addition, the similarity of known trusted websites can be calculated and a final decision can be made on the information extracted from the hyperlinks. This information can also be obtained from the URL provided by the user. The reason behind extracting the hyperlinks is that the phishing website copies the content of the page from the target original or legitimate web page. The web page may have many forged and simulated hyperlinks pointing to the target legitimate page. Some available URLs in the phishing database redirect to their corresponding original or legitimate websites. However, if the web page is a genuine web page, it will not point to the phishing web page. The algorithm for detecting phishing determines the status of any URL based on three indicators: empty links existing in the source code, web pages that do not contain any hyperlinks, and external links existing in the source code.

Furthermore, the empty link in the source code, that is, the web page containing the empty pointer, when the link does not point to any web page or document, it is called an empty link or empty pointer, which is usually represented by <a href="#">. Whenever the link is clicked, it returns to the link on the same page. The attacker uses the empty pointer to achieve his ulterior motives.

Furthermore, the webpage that does not contain any hyperlinks, if a website is legitimate, it is easy to extract at least one hyperlink, if the total number of extracted links is zero, then the website is considered as a phishing website, however, if there is no hyperlink extraction, then the webpage is also considered as a phishing type. The attacker creates a null pointer in the fake webpage for the following two reasons:

1. The first reason is to create live hyperlinks that are nowhere. A real website contains a lot of web pages, but a fake website contains very limited web pages. So, in order to disguise as a legitimate web page, the attacker creates a fake web page and puts empty values into the hyperlinks. When the user rolls the mouse over the empty links, they appear to be active.

2. Hackers use javascript with empty links to attack web browser vulnerabilities. The attacker creates a hyperlink in such a way that when the user rolls the mouse over the hyperlink, it displays other content instead of the actual hyperlink. In the example (shown below), the link looks like www.example1.org, but in fact, the real domain is http://example2.org. By using href="#", the link is activated and points to the same location, so the onClick attribute can be activated.

Furthermore, the external links existing in the source code, Algorithm 1 will be determined based on the results of the extracted hyperlinks. If the hyperlinks are legitimate, most of the hyperlinks point to the same domain, while for phishing websites, most of the hyperlinks point to their respective target domains or external domains. This Algorithm 1 is able to calculate the total number of links extracted from the web page source code and the total number of links pointing to external domains, and select a suitable threshold for the ratio. The determination of the nature of the hyperlink is determined by the following equation:

Wherein, ND _i = the total number of links pointing to the own domain, ∑L = the total number of links extracted from the web page source of the suspicious web page.

The above description is only a preferred embodiment of the present invention and is not intended to limit the scope of implementation of the present invention; all equivalent changes and modifications made according to the present invention are deemed to be covered by the patent scope of the present invention.

Claims (4)

1. A method for automatically detecting phishing attacks based on a whitelist of process control, characterized in that it is an anti-reconnaissance technology used in process control, including a matching module, a user confirmation module and a whitelist database update module; the matching module includes a URL matching submodule and a DNS matching submodule; the user confirmation module confirms whether a web page has a phishing attack, which is achieved by extracting a hyperlink and then applying a phishing detection algorithm, the phishing detection algorithm includes Algorithm 1, which is used to check whether the hyperlink is legitimate or a phishing type, if the status is the latter, the system will issue a warning to the user, if the status is the former, the system will update the whitelist database; the whitelist database update module writes the legitimate hyperlink of the first visit to the web page into the whitelist database, including the IP address and DNS domain name; the method also includes the following steps: (1) If the user is visiting a web page for the first time, based on Algorithm 1, the user confirms whether the web page contains phishing information. If it is phishing information, the system will warn the user. If it is a legitimate web page, the system will update the whitelist database. (2) If this is not the first time the user visits a web page, the URL matches. If the DNS also matches, the website is a legitimate website. Otherwise, it is a phishing website, and a warning is issued to the user. The algorithm 1 determines the whitelist by performing a comprehensive analysis of actual links and visual links. In addition, it can also calculate the similarity of known trusted websites and make a final decision on the information extracted from the hyperlinks, which can also be obtained from the URL provided by the user. The reason behind extracting the hyperlinks is that the phishing website copies the content of the page from the target original or legitimate web page. The web page may have many forged and simulated hyperlinks pointing to the target legitimate page. Some available URLs in the phishing database will redirect to their corresponding original or legitimate websites. However, if the web page is a genuine web page, it will not point to the phishing web page. The algorithm for detecting phishing determines the status of any URL based on three indicators: empty links present in the source code, web pages that do not contain any hyperlinks, and external links present in the source code. 2. A method for automatic whitelist detection of phishing attacks based on process control as described in claim 1 is characterized in that the empty link existing in the source code, that is, a web page containing a null pointer, when the link does not point to any web page or document, it is called an empty link or null pointer, it is usually represented by <a href="#">, whenever the link is clicked, it will return to the link on the same page, and the attacker uses the null pointer to achieve his ulterior motives. 3. A method for automatic whitelist detection of phishing attacks based on process control as described in claim 1 is characterized in that the web page that does not contain any hyperlinks can be easily extracted on at least one hyperlink if a website is legitimate, and if the total number of extracted links is zero, the website is regarded as a phishing website, but if no hyperlink is extracted, the web page is also regarded as a phishing type. 4. A method for detecting phishing attacks based on automatic whitelisting of process control as described in claim 1, characterized in that the external links existing in the source code, Algorithm 1 will be determined based on the results of the extracted hyperlinks. If the hyperlinks are legitimate, most of the hyperlinks point to the same domain, while for phishing websites, most of the hyperlinks point to their respective target domains or external domains. This Algorithm 1 can calculate the total number of links extracted from the web page source code and the total number of links pointing to external domains, and select a suitable threshold for the ratio. The determination of the nature of the hyperlink is determined by the following equation: Ratio =

in,

= the total number of links pointing to own domain,

=The total number of links extracted from the web source of the suspicious web page.

Images