GB2462456A

GB2462456A - A method of determining whether a website is a phishing website, and apparatus for the same

Info

Publication number: GB2462456A
Application number: GB0814461A
Authority: GB
Inventors: Anastasios Bitsios
Original assignee: Individual
Current assignee: Individual
Priority date: 2008-08-08
Filing date: 2008-08-08
Publication date: 2010-02-10
Also published as: GB0814461D0

Abstract

A method of determining whether a subject website is a phishing website which is imitating a genuine website is disclosed together with apparatus for the same, the method comprising the steps of: (a) identifying at least one characteristic of the genuine website; (b) comparing the or each characteristic of the genuine website with a corresponding characteristic or characteristics of the subject website; and (c) based on the comparison in step (b), determining whether the subject website is or is likely to be a phishing website.

Description

I

DESCRIPTION

Title of Invention

A METHOD OF DETERMINING WHETHER A WEBSITE IS A

PHISHING WEBSITE, AND APPARATUS FOR THE SAME.

Field of the Invention

This invention relates to a method of determining whether a subject website is a phishing website which is imitating a genuine website, and apparatus for the same.

Background to the Invention

One of the latest plagues to hit the World Wide Web is that of "phishing" and its variants. Phishing is a type of Internet fraud that attempts to lure users of a certain online service to a fraudulent website impersonating the service's website in order to extract sensitive information such as usernames and passwords, PIN numbers or personal information (Social Security Number, Date of Birth etc.). This is usually accomplished by sending fraudulent emails, often indicating some sort of problem or emergency with the account, so as to urge the user to follow the fraudulent link. The term "phishing" is a variation of "fishing", which alludes to the criminals baiting' users with such emails. Instant Messaging is also used as a baiting' medium.

Phishing most commonly targets financial services such as online banking sites, online payment services such as PayPal� and online auction sites such as eBay�. Other types of phishing targets include email providers in order to hijack accounts to send spam and I or more phishing emails. Subscription-based gaming accounts are also known to have been targeted as have social networks such as MySpace� and FaceBook� in order to spam on-site or harvest contacts' email addresses for spamming or phishing.

Phishing relies on the inexperience of users when it comes to online security.

A user can identify the phishing attempt as a fraud at several points; phishing emails vary from being very amateur (spelling mistakes, bad grammar, wrong message layout) to very professional (spoofed sender address, close copy of original messages, personalized greeting). Usually none hold up to close inspection.

Phishing websites' URL5 are always a strong indicator and almost none are over Secure HTTP connections. Phishing sites themselves are often bad copies of the original and may contain out of date graphics or layouts. Ultimately, the force of habit coupled with inexperience causes a lot of users to miss those clues and surrender sensitive information to criminals. The range of damage from phishing can vary from a relatively harmless denial-of-service (e.g. a hijacked gaming account) to devastating financial losses (credit card charges, transferred bank account balances, identity theft loans, etc.). Gartner, a US Consulting agency, reports more than $2.8 billion losses due to phishing in 2006 in the United States alone.

Most modern web browsers implement some sort of anti-phishing measure, either built-in or as a plug-in. However, to date, anti-ph ishing measures implemented are mostly based on the principle of users reporting phishing sites, vendors verifying the submissions and publishing blacklists of known phishing URL5. It is also known to make use of white lists, that is, lists of verified genuine websites.

Anti-phishing techniques based on black lists have several, significant disadvantages. First, in order for a site to be blacklisted, it must first be detected by someone who is willing to take the time to report the site, and thereafter be verified as a phishing site. Only then will such a site be added to a blacklist but, in the meantime, newly created but as yet unblacklisted phishing sites will continue to pose a threat to users. To make matters worse, due to the fierce competition in the web browser market, black lists are typically not shared between the providers of the market leading browsers.

It should also be noted that phishing websites have a limited lifespan. At the time of writing, this appears to be typically between 3 and 4 days and the current trend is of a decreasing lifespan. This means that the current blacklist anti-phishing technique is in a constant cat-and-mouse game with the phishing sites, and in which it will be left further behind as lifespan continues to decrease.

Object of the Invention The object of the invention is to provide an alternative solution to the problem of detecting phishing websites.

Summary of the Invention

In accordance with a first aspect of the present invention, there is provided a method of determining whether a subject website is a phishing website which is imitating a genuine website, and corresponding client-centric and server-centric architectures for the same. The method comprising the steps of: (a) identifying at least one characteristic of the genuine website; (b) comparing the or each characteristic of the genuine website with a corresponding characteristic or characteristics of the subject website; and (c) based on the comparison in step (b), determining whether the subject website is or is likely to be a phishing website.

The inventor has appreciated that for an anti-phishing service to be truly effective, it must be able to protect users regardless of whether the specific phishing site has been seen before, identified as a phishing site before and I or blacklisted.

The present invention enables a phishing site to be identified from a first sighting, thus avoiding the aforementioned disadvantages with the currently predominant blacklisting techniques employed by commercial browsers.

In certain embodiments: * in step (a), a plurality of characteristics of the genuine website may be identified and, in step (b), a plurality of characteristics of the genuine website my be compared with corresponding characteristics of the subject website.

* steps (a) to (c) may be repeated for a plurality of websites.

The at least one characteristic of the genuine website may include a non-visible characteristic and, for example: * may relate to the structure of the code * may include an ID attribute * may includes the genuine website's primary domain * may relate to an appended file. For example, its file name, the date at which it was last saved and I or modified, and I or its size.

* may relates to a hyperlink. For example, the subject website may be determined to be or likely to be a phishing website if it contains the same hyperlink to the genuine website. Alternative, the subject website may be determined to be or likely to be a phishing website if it contains a corresponding hyperlink which is directed to a page on the subject website, especially one whose content is the same or similar to a corresponding page on the genuine website.

The compared characteristics may be visible characteristics of the subject website's, i.e. an image comparison including between rendered text and image files and between single image and multiple, combined images.

In a client-centric architecture, a computer may be provided which is configured to perform, in the course of a user browsing a subject website, a method according to the present invention. Where this is the case, the client will preferably download from a host server a database of both visual and non-visual characteristics of genuine websites.

Alternatively, in a server-centric architecture, a server may be provided which hosts a database of both visual and non-visual characteristics of genuine websites and is configured to perform, upon receipt of a query from a client computer including an url of a subject website, a method according to the present invention.

Such a server may be further configured to transmit to the client computer the outcome of the determination of whether the subject website is or is likely to be a phishing website enabling such a client computer to notify the user in the event of receipt of such a determination from the server.

In accordance with a second aspect of the present invention, there is provided a method comprising the steps of: (a) providing a database of website domains or website homepages which are thought to be genuine; (b) from such website domains or website homepages, automatically searching for corresponding log-in webpages; and (c) building a database of characteristics of such log-in webpages for use as part of an anti-phishing service in which characteristics of such log-in webpages are compared to those of target websites in order to determine whether such target websites are phishing websites.

Brief Description of the Drawings

The present invention will now be described, by way of example only, with reference to the accompanying figure in which a user's computer 10 connected to the Internet and further able to connect to host servers 11 and 12 hosting web content and I or an anti-ph ishing service associated with the present invention.

Details Description

The method of the present invention may be employed in a client-centric architecture where the determination of whether a subject website is a phishing website is done on a client computer 10; or in a server-centric architecture where the determination is done on a server 11 upon request from a client computer 10.

Client-centric architecture A stand-alone client architecture would mean that all processing would happen on the client computer 10. That is, each client computer would keep a database of known genuine "white" sites including details of their characterising features, and would be responsible for checking each URL browsed by the user against the database.

Such a client-centric architecture has the advantage of not depending on a centralized server 11. This means increased privacy as viewed URL5 are not submitted to a server and, furthermore, this architecture is not unduly affected by server downtime. However, disadvantages of not having a centralized server include an increased processing burden on the client computer 10, a significant bandwidth requirement due to the client having to periodically characterise white sites, and an inability for the browsing community as a whole to maintain a unified, trusted list of known phishing sites.

Server-centric architecture A client-server architecture provides a centralized server 11 that will maintain a database of white sites (including periodic characterising the white sites), and which will check URL5 against that database as per the clients' requests. In such an architecture, the user's computer 10 acts as a thin client and functions to submit each browsed URL to the server for checking and to act in accordance with the server reply. If the reply is positive (i.e. URL is believed to be a phishing site), the user is interrupted by temporarily disabling the page and notified accordingly.

Preferably, the user is given options to provide feedback to the server including to verify the site as a phishing site or to report a false positive.

For privacy reasons, it is desirable if all records of URL5 received from clients and stored on the server 11 are deleted if the outcome of the determinations whether such URL5 relate to phishing sites is negative.

Hereafter, the present invention is described in the context of the server-centric architecture, although many of the characterisation and comparison techniques disclosed will of course be equally applicable to the client-centric architecture, and other possible architectures not disclosed herein.

Characterisinci white sites The following elements form the basis of a database of homepages and login pages (being the pages on a website which are most often targeted by phishers) of white sites stored on the server 11: * domain (e.g. paypal.com) * URL5 of login pages (e.g. www.paypal.com/cgi-bin/webscr?cmd=_login-run) * Links (href attributes in <A> tags) * Filenames (e.g. spacer.gif) * Full Filenames (e.g. http://server.com/spacer.gif) * Text nodes (as they appear in the Document Object Model (DOM)).

* Colours in hexadecimal format (e.g. #ff0000 for red) * Images elements: width, height, average colour (R,G,B), * Names of HTML elements, either ID, Name or Source attribute in HTML tags * Comments (as they appear in the DOM) * Meta Tags such as Title, Description and Keywords * Script Contents (JavaScript, VBScript etc.) * Script Hashes * Appended Style Sheets * Style Attributes * Text (optionally limited to special characterised, non-dictionary words etc) Such information can be automatically harvested from a list of white sites (e.g. from Google's white-domain white list).

In this regard, it is contemplated that all homepages of white sites will be characterised, whether or not they contains a log-in or not. This establishes a base reference for colours and other characterising elements that do not necessarily require the correct login page to be found.

Log-in pages of a white site can also be automatically harvested and characterised by searching from the starting point of a homepage. Techniques for finding such log-in pages include searching for pages with combinations of submit and password-type input fields, "sign-in" or "log-in" text (either in text format or embedded in images), etc. In this regard, it should be noted that not all home pages contain a log-in; and many websites have multiple log-in pages (e.g. PayPal� which has a login page on the homepage and a separate login-only page).

It should also be noted that it can not be assumed that all white sites' login pages are in the same domain as the homepage. Certain sites have login pages in other domains. Therefore the search for the login page cannot be restricted to the original domain. On the other hand, one must avoid characterised a login page belonging to a different site after following an irrelevant link (such as advertisement links) as might be evident from significant changes in certain characterising features of the website, e.g. colour schemes etc. Comparinci characteristics of white sites with those of a subiect website The invention is based on the principle that certain characteristics of a white site would be present in a phishing website; inherently, of course, visual characteristics but also non-visual characteristics. However, it is appreciated that perfected innocuous similarities may exist between certain white websites and certain other websites which are not phishing sites.

Accordingly, an optimal comparison of a white site with a subject website will be one which: * encompasses many characteristics.

* is weighted so as to reflect the certainty with which characteristics match * is weighted in favour of matching characteristics which are stronger pointers to phishing sites that others * the result is expressed as a probability or a points score (reflecting that the methodology proposed is of course not infallible) whereby a probability or points score above a predefined threshold yields a determination of the subject site to be a phishing site.

Comparison of many of the attributes is straight forward, but certain attributes are worthy of special consideration.

In respect of domain names, it is expected that the inclusion of the primary domain of a white site in the entire url of a subject site would be considered a positive comparison of that characteristic, i.e. suggesting a phishing site. For example, were "primarydomain" or "primarydomain.com" to be found in "http:II primarydomain.com.some.bad.site.com". Strings such as "cgi", "bin", "html" and "php" need not be checked being very common. A positive comparison may also be assumed if the target website contains a hyperlink to the white site's domain. Indeed, a matching full file name may result in a positive comparison and one which ought to be highly weighted, especially as dynamic linking is a common phishing practice.

In respect of image checking, this can be very time-consuming because individual image files must be downloaded and each pixel checked for its colour. In order to speed up the checking process, image checking can be left until last and only done if the result is marginal.

The identity of compared subject sites may be cached so as to not have to repeat the comparison unnecessarily. Also, if a phishing site is found, it may be added to a list of black sites as the methodology of the present invention may be supplemented by the conventional approach of referencing a black list.

As previously mentioned, it is contemplated that feedback from a user in the event of a suspected phishing site being identified would be relayed to the server; i.e. either verifying the site as a phishing site or to report a false positive. Such feedback can be used to improve the white list which is the foundation of the present invention.

The above description describes in high level terms the architectures and techniques of the present invention which can be employed to detect suspected phishing sites. Of course, such architectures and techniques could be readily implemented by a person skilled in this art without undue effort, and are not dependent on a particular platform, scripting language etc.

Claims

CLAIMS1. A method of determining whether a subject website is a phishing website which is imitating a genuine website, the method comprising the steps of: (a) identifying at least one characteristic of the genuine website; (b) comparing the or each characteristic of the genuine website with a corresponding characteristic or characteristics of the subject website; and (c) based on the comparison in step (b), determining whether the subject website is or is likely to be a phishing website.
2. A method according to claim I wherein, in step (a), a plurality of characteristics of the genuine website are identified; and wherein, in step (b), a plurality of characteristics of the genuine website are compared with corresponding characteristics of the subject website.
3. A method according to claim 1 or claim 2 wherein steps (a) to (c) are repeated for a plurality of websites.
4. A method according to claim 3 wherein repetition of steps (a) to (c) results in the creation of database of genuine websites and their associated characteristics.
5. A method according to claim 4 wherein the majority of the database records concern either home pages or login pages of the websites.
6. A method according to any of the preceding claims wherein the at least one characteristic of the genuine website includes a non-visible characteristic.
7. A method according to claim 6 wherein the at least one characteristic of the genuine website relates to the structure of the code.
8. A method according to claim 6 wherein the at least one characteristic of the genuine website include an ID attribute.
9. A method according to claim 6 wherein the at least one characteristic of the genuine website includes its url's primary domain.
10. A method according to claim 6 wherein the at least one characteristic of the genuine website relates to an appended file.
11. A method according to claim 10 wherein the at least one characteristic of the genuine website relates to a file name of an appended file.
12. A method according to claim 10 wherein the at least one characteristic of the genuine website relates to the date at which an appended file was last saved and I or modified.
13. A method according to claim 10 wherein the at least one characteristic of the genuine website relates to the size of an appended file.
14. A method according to claim 13 wherein the at least one characteristic of the genuine website relates to a hyperlink; and wherein the subject website is determined to be or likely to be a phishing website if it contains the same hyperlink to the genuine website.
15. A method according to claim 13 wherein the at least one characteristic of the genuine website relates to a hyperlink; and wherein the subject website is determined to be or likely to be a phishing website if it contains a corresponding hyperlink which is directed to a page on the subject website.
16. A method according to claim 15 wherein the subject website is determined to be or likely to be a phishing website if it contains a corresponding hyperlink which is directed to a page on the subject website whose content is the same or similar to a corresponding page on the genuine website.
17. A method according to claim 1 wherein the compared characteristics are visible characteristics of the subject website's.
18. A method according to claim 17 wherein the at least one characteristic of the genuine website includes text matter; wherein the corresponding characteristic of the subject website is an image which contains such text; and wherein the comparison is a visual comparison of the rendered text of the genuine site compared to the image of the subject site.
19. A method according to claim 17 wherein the at least one characteristic of the genuine website includes an image containing text; wherein the corresponding characteristic of the subject website is text matter; and wherein the comparison is a visual comparison of the image of the genuine site compared to the rendered text of the subject site.
20. A method according to claim 17 wherein the at least one characteristic of the genuine website includes an image; wherein the corresponding characteristic of the subject website is a collection of several images; and wherein the comparison is a visual comparison of the image of the genuine site compared to the collection of several images of the subject site.
21. A method according to claim 17 wherein the at least one characteristic of the genuine website includes a collection of images; wherein the corresponding characteristic of the subject website is a combined images; and wherein the comparison is a visual comparison of the collection of images of the genuine site compared to the combined image of the subject site.
22. A computer configured to perform, in the course of a user browsing a subject website, a method according to any of the preceding claims.
23. A computer according to claim 22 further configured to download from a server a database of both visual and non-visual characteristics of genuine websites.
24. A server hosting a database of both visual and non-visual characteristics of genuine websites and configured to export said database to a plurality of client computers.
25. A server hosting a database of both visual and non-visual characteristics of genuine websites and configured to perform, upon receipt of a query from a client computer including an url of a subject website, a method according to any of the preceding claims.
26. A server according to claim 24 further configured to transmit to the client computer the outcome of the determination in step (c).
27. A server according to claim 24 or claim 25 further configured to delete all records of the url received from the client computer if the outcome of the determination in step (c) is that it does not relate to a phishing site.
28. A computer configured to perform, in the course of a user browsing a subject website, a query to an external server including the url of the subject website for determining whether the subject website is a phishing website.
29. A computer according to claim 28 further configured to notify the user in the event of receipt of a determination from the external server that the subject website is or is likely to be a phishing website.
30. A method comprising the steps of: (a) providing a database of website domains or website homepages which are thought to be genuine; (b) from such website domains or website homepages, automatically searching for corresponding log-in webpages; and (C) building a database of characteristics of such log-in webpages for use as part of an anti-phishing service in which characteristics of such log-in webpages are compared to those of target websites in order to determine whether such target websites are phishing websites.
31. A computer configured to perform a method according to claim 30.