JP2007156690A - Method for taking countermeasure to fishing fraud, terminal, server and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To surely issue warning when fishing fraud is suspected even in a terminal whose user interface is limited such as a portable telephone. <P>SOLUTION: This system is provided with a URL/enterprise name relation calculation part 25 for analyzing received mail to extract an enterprise name and URL included in the mail, and for extracting an enterprise deeply relating to the URL from the positional relation of the enterprise name and the URL in the mail for every extracted URL, and for outputting the corresponding enterprise ID; a URL white list 23 in which the enterprise and the URL of the legal site corresponding to the enterprise are carried; and a white list confirmation part 26 for, when any URL is selected, verifying the validity of the site shown by the URL according to whether or not the selected URL is carried in an URL white list 23 as the URL corresponding to the enterprise shown by the enterprise ID by referring to the URL white list 23. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to the field of network security, and in particular, to a countermeasure method for preventing damage caused by phishing scams, and a server and a terminal adapted to this countermeasure method.

  With the recent development of network technology, phishing that steals personal information such as name, age, address, phone number, and credit information such as credit card number, ID, password, etc. using network tools such as e-mail and web Scams are becoming more frequent.

  Phishing scams often begin with the sending of emails that ask for confirmation or correction of personal information. This email looks as if it was sent by a famous bank or credit card company to “fish” the recipient (victim), invites the recipient to the camouflage website, and on the camouflage website Requests input / correction of personal information and credit information. Such mail is called phishing mail. In the phishing mail, a URL (uniform resource locator) of a counterfeit website is described, but the URL is of course different from the URL of a regular (ie, original bank or credit card company) web page. The screen of the camouflage website is very similar to the screen of the legitimate website, or the address bar display in the web page browsing software (browser software) is spoofed, and it is a camouflage site used for phishing It pretends to be invisible to the user. Hereinafter, a camouflaged site used for a phishing scam is referred to as a phishing site.

  Various techniques have been proposed as countermeasures against such phishing scams.

  CoreStreet's SpoofStick (trademark) alerts the user by using a technique that displays the name of the currently connected site on the toolbar of the display screen in the web browser, and addresses Suspicious websites, such as only IP (Internet protocol) addresses, are easy to understand <URL: http://www.corestreet.com/spoofstick/>.

  Deepnet Explorer (trademark) of Deepnet Technologies, Inc. browses irregular websites such as when trying to browse blacklisted sites as phishing sites, or only IP addresses are displayed. When trying to do so, a method to alert the user with a pop-up dialog is adopted <URL: http://www.deepnetexplorer.com/>.

  Netscape 8.0 (trademark) of Netscape has adopted a method of eliminating phishing sites using a blacklist <URL: http://browser.netscape.com/nsb/support/relnotes.jsp> .

  These technologies attempt to prevent connections to suspicious sites that are phishing sites using a blacklist that lists sites that are already known to be suspicious. The method using lists is considered dangerous.

  First, it is very difficult to find all phishing sites on the Internet, and leakage always occurs.

  Second, after the phishing camouflage site is online (ie, accessible from the Internet), it takes a certain period of time to find the phishing camouflage site and register it on the blacklist. However, phishing sites are usually closed within a short time after their opening, and their average life span is less than 6 days, so when a phishing site is blacklisted, The “blacklist lifetime” until the site goes offline and disappears becomes very short. It is highly possible that blacklisting will occur after the phishing site disappears.

Third, users tend to judge that sites not listed on the blacklist are not “dangerous sites”, so the method using the blacklist is not registered in the blacklist for the reasons described above. Since there is no effect on phishing sites, and the user's alertness tends to be relaxed, if the matching with the black list fails (does not exist in the list), the system will fail out It has become.
Therefore, a method using a white list registered by a site considered to be safe has been proposed. As such a system, for example, there is PhishWall (trademark) (Non-patent Document 1) of SecureBrain and nProtect: Netizen (trademark 2) of NetMove.

  Also, phishing scams are triggered by phishing emails, but the countermeasures against phishing emails are software by companies that develop anti-virus software. Typical examples include Symantec's Norton Internet Security (trademark) <URL: http://www.symantec.co.jp/region/jp/products/nis/index.html>, Trend Micro ) Virus Buster (trademark) <URL: http://www.trendmicro.com/jp/products/desktop/vb/evaluate/features.htm>.

  However, the anti-spam email technology used in these software products is diverted to anti-spam email technology. However, phishing emails that spoof emails from financial institutions are inappropriate for spam email detection. Since the expression is hardly seen, its effectiveness is not sufficient.

The conventional anti-phishing technology and software products described above are mainly targeted at personal computers (PCs), but phishing fraud on mobile phones has also appeared. An example of a phishing scam targeting mobile phones is shown on the Tokyo Metropolitan Police Department website <URL: http://www.keishicho.metro.tokyo.jp/jiken/kenkyo/jiken.htm#170613>, for example.
“PhishWall Server”, [online], SecureBrain, [Retrieved November 4, 2005], Internet <URL: http://www.securebrain.co.jp/products/phishwall/index.html> “NProtect: Netizen”, [online], NetMove, [searched November 4, 2005], Internet <URL: http://nprotect.jp/netizen/>

  As described above, none of the conventional anti-phishing technology and software products prevent phishing fraud against mobile terminals such as mobile phones. In a portable terminal such as a cellular phone, there is extremely little information available for a user to determine whether or not it is a phishing scam because the screen size is smaller than that of a personal computer. Therefore, once a phishing scam targeting mobile devices starts to become popular, the damage is expected to be enormous.

  Further, the list managed by the products described in Non-Patent Document 1 and Non-Patent Document 2 is a white list of URLs, and whether or not the URL selected (clicked) by the user is described in the list. Therefore, it was decided whether or not to issue a warning to the user. For this reason, when a warning is issued, it is a company that is registered in the white list, but the clicked URL is not included in the list, or the warning is issued, or it is not registered in the white list in the first place. Since it is a company, it cannot be distinguished whether a warning has been issued, and there is a problem that it is incomplete as a warning to the user.

  Therefore, an object of the present invention is to solve the above-described problems of the prior art and to prevent a phishing scam to prevent damage caused by phishing scams on terminals such as mobile phones and mobile terminals, and such a method. It is an object to provide a program and a server and a terminal suitable for such a countermeasure method.

  In order to prevent a phishing scam with respect to a terminal such as a mobile phone, the present invention analyzes a mail that arrives at the terminal or is to be delivered to the terminal, and extracts a company name that the phishing mail is trying to spoof based on the analysis result By comparing it to the white list of the company site, it tries to prevent phishing scams.

  That is, the first anti-phishing method of the present invention is a anti-phishing method for preventing damage caused by a phishing scam, and the relationship calculation means analyzes the mail received at the terminal and the company name included in the mail And URLs are extracted, for each extracted URL, a company closely related to the URL is extracted from the positional relationship between the company name in the mail and the URL, and information for identifying the extracted company is output. If any URL included in the email is selected by the user, the confirmation means is selected with reference to the white list that describes the company and the URL of a legitimate site corresponding to the company. Depending on whether or not the URL is listed in the white list as the URL corresponding to the company indicated by the output information, It has a stage for verifying the validity of the response to the site, the.

  The second phishing countermeasure method of the present invention is a phishing countermeasure method for preventing damage caused by a phishing scam, and the mail server analyzes the mail to be delivered to the terminal, analyzes it and includes it in the mail. For each extracted URL, a company closely related to the URL is extracted from the positional relationship between the company name and the URL in the mail, and information for specifying the extracted company is extracted. In addition, the stage of delivering the mail to the terminal and the URL of the legitimate site corresponding to the company when the proxy server receives an access request from the terminal with the URL and the information specified Referring to the white list, the URL included in the access request is described in the white list as the URL corresponding to the company indicated by the specified information. Depending on Dolphin whether, having the steps of verifying the validity of the site corresponding to the selected URL, and. In this case, the mail server refers to the company name list holding the company name and the company ID uniquely determined for each company, extracts the company closely related to the URL, and uses the company ID as information for identifying the company. It is preferable to add it to the mail in association with the corresponding URL. In addition, when the terminal receives the mail from the mail server and when any URL included in the mail is selected by the user, the terminal identifies the selected URL and the selected URL. It is preferable to further include the step of transmitting information to be transmitted to the proxy server.

  The terminal of the present invention is a terminal having a function of receiving a mail and a function of accessing an external site, and extracts a company name and a URL included in the received mail by analyzing the received mail. For each URL, a relationship calculation means for extracting a company closely related to the URL from the positional relationship between the company name in the received mail and the URL, and outputting information specifying the extracted company, the company and its When the user selects a white list that describes the URL of a legitimate site corresponding to the company and any URL included in the received email, the selected URL is The legitimacy of the site corresponding to the selected URL is checked according to whether or not it is described in the white list as the URL corresponding to the company indicated by the output information. Has a confirmation means that, a.

  The mail server of the present invention is a mail server that delivers received mail to a terminal, analyzes the mail to be delivered to the terminal, extracts the company name and URL included in the mail, and extracts them For each URL, a relationship calculation means for extracting a company closely related to the URL from the positional relationship between the company name and the URL in the mail, and information identifying the extracted company is added to the mail and distributed to the terminal And corporate information embedding means.

  The proxy server of the present invention is a proxy server that accesses an external site on behalf of a request from a terminal, and includes a white list that describes a company and a URL of a legitimate site corresponding to the company, and a URL from the terminal. Whether or not the URL included in the access request is described in the white list as the URL corresponding to the company indicated by the specified information when the access request is received with the specified information, by referring to the white list. And confirming means for verifying the legitimacy of the site corresponding to the selected URL.

  In the present invention, since the company name is extracted and collated with the whitelist in the terminal or server, even if the terminal is a mobile phone with little information given to the user on the user interface, damage caused by phishing is surely suppressed. Can be done.

  In addition, it is possible to determine whether the company is whitelisted based on whether the company name has been extracted, so if a warning is issued, it is the company that is registered in the whitelist. However, it is possible to distinguish whether a warning is issued because the URL is not included in the list, or whether a warning is issued because the company is not registered in the white list in the first place.

  Next, a preferred embodiment of the present invention will be described with reference to the drawings.

(First embodiment)
FIG. 1 is a block diagram showing the configuration of a phishing countermeasure system according to the first embodiment of the present invention.

  The one shown in FIG. 1 is a countermeasure for phishing countermeasures in a mobile terminal. Here, a case where the mobile terminal is the mobile phone terminal 10 will be described. The mobile phone terminal 10 has a function of receiving mail 11 and is configured to be able to browse and transmit information by accessing an external website 13 via the Internet 12. Therefore, a mailer (email processing unit) 20 for processing the mail 11 and a browser 30 for accessing the website 13 to browse and transmit information are provided in the mobile phone terminal 10. The mailer 20 and the browser 30 are linked so that the browser 30 can access the URL site described in the mail 11.

  In the present embodiment, anti-phishing measures are executed in the mailer 20. Specifically, the received mail is analyzed, the company name included in the mail is determined, and the company name or URL included in the mail is checked by checking against the URL whitelist in which the URL of the legitimate site is described. Verify correctness. Therefore, the mailer 20 refers to the mail browsing unit 21 that receives the mail 11 and displays it to the user, the database 24 that holds the company name list 22 and the URL white list 23, and the company name list 22. A URL-company name relationship calculation unit 25 that calculates the relationship between the URL in the mail 11 and the company name, a white list confirmation unit 26 that verifies the validity of the URL to be connected with reference to the URL white list 23, and , Is provided.

  Next, the operation of this embodiment will be described.

  When the user browses the mail 11 received at the mobile phone terminal 10 and clicks the URL in the mail and tries to browse the information on the site indicated by the URL by the browser 30, the URL-company name relationship calculation unit 25 and the white list confirmation unit 26 are activated, and the process of countermeasures against phishing in this embodiment is started.

  The URL-company name relationship calculation unit 25 uses the company name list 22 to extract a company name and its appearance position from the mail 11 and specifies a company name closely related to the clicked URL. FIG. 2 shows a description example of the company name list 22. The company name list 12 includes an ID uniquely assigned to each company and one or a plurality of expressions indicating the company. The reason why there are a plurality of expressions indicating companies is that there can be various notations such as formal names, abbreviations, and English abbreviations when specifying a certain company. In general, the contents of the company names in the company name list 22 may be the same for different IDs (for example, because the abbreviations are the same). Then, the URL-company name relationship calculation unit 25 specifies a company name (company ID) that is closely related to the target URL (ie, clicked), for example, according to the following rules.

First, the score P (C _n ) for the company whose company ID is n for the URL is

Ask for. Here, L (U) indicates the appearance position of the target URL in the target mail, and L (C _n (k)) is the company name of the company whose company ID is n. The kth position in the mail is shown, and m is the weight of the company name appearance position relationship with respect to the target URL. According to the above formula, the score P (C _n ) increases as the URL and the company name are described closer in the mail. Further, when the subject company name is found in the subject (subject) of the mail 11, P (C _n ) with h as a constant in order to increase the score by being described in the subject. = P (C _n ) + h.

Then, sort the company ID in the score P (C _n), the higher the x-th, or score P (C _n)> y to become corporate ID the (pre-sorting), the relationship with the URL that has been the subject deep of companies Company ID. Here, x and y are predetermined constants. When a plurality of companies having a deep relationship with the target URL are found, the company ID is obtained as a company ID string.

  The white list confirmation unit 26 receives the target URL and the closely related company name (company ID string), and attempts to verify the validity using the URL white list 23. FIG. 3 shows an example of the contents of the URL white list 23. In the URL white list 23, the URL of the company website is associated with each company ID.

  The white list confirmation unit 26 corresponds to a deeply related company ID in which the target URL (ie, selected by the user) is found by the URL-company name relationship calculation unit 25 in the URL white list 23. If it is included in the range described in the URL to be processed, it is determined that the target URL is valid, and the URL is passed to the browser 30. As a result, the browser 30 accesses the site of the target URL and can acquire and view information. On the other hand, if the target URL is not included in the range described as the URL corresponding to the closely related company ID in the URL white list 23, the white list confirmation unit 26 determines that the URL is Warn users of possible phishing sites. Note that even when a company closely related to a URL is not found by the URL-company name relationship calculation unit 25, the whitelist confirmation unit 26 also asks the user when the URL is selected by the user. Warning. In this case, it is preferable that the whitelist confirmation unit 26 issues different types of warnings depending on whether a company closely related to the URL is found or not. As a result, when the warning is issued, the user is a company registered in the URL white list, but the URL is not included in the list, or the warning is issued, or in the first place, the URL white list. It is possible to determine whether a warning has been issued because the company is not registered.

  In the mobile phone terminal 10 described above, it is preferable that the company name list 22 and the URL white list 23 are downloaded from the network side regularly or at any time.

  In the first embodiment, a company name closely related to the URL is determined for the URL described in the mail. And if the email is a phishing email, clarify the name of the company that the phishing scammers have misrepresented to mislead the victim as a “relevant company name” and be a legitimate site for that company. For example, consistency with a URL white list that satisfies the condition is required. As a result, according to the present embodiment, it is possible to greatly reduce the damage of phishing scams in which companies registered in the white list are misrepresented.

(Second Embodiment)
FIG. 4 is a block diagram showing a configuration of a phishing countermeasure system according to the second embodiment of the present invention. 4 is similar to that shown in FIG. 1 in that the mobile terminal performs collation with the white list, but the collation with the white list uses the URL to access the site. This is different from the one shown in FIG. 1 in that it is performed not when trying to transmit information but when transmitting information to the site. Therefore, in the mobile phone terminal 10 shown in FIG. 4, the mailer 20 is provided with a mail browsing unit 21, a company name list 22, and a URL-company name calculation unit 25. A list confirmation unit 26 and a site browsing processing unit 27 are provided. Therefore, the database unit 24 is provided across the mailer 20 and the browser 30.

  The site browsing processing unit 27 accesses the external website 13 and executes processing of browsing and transmitting information. In particular, the site browsing processing unit 27 receives the target URL and the company ID string closely related to the URL from the URL-company name relationship calculating unit 25, and the result of the validity verification of the URL by the whitelist confirmation unit 26 The information transmission process is executed based on the above.

  Next, the operation of this embodiment will be described.

  The processes up to the URL-company name relationship calculation unit 25 are the same as those in the first embodiment. Here, the URL-company name relationship calculation unit 25 passes not only the target URL but also a company ID string closely related to the URL to the browser 30. As a result, the site browsing processing unit 27 of the browser 30 does not particularly perform processing for countermeasures against phishing while browsing the site, but the site can be accessed from the mobile phone terminal 10 using the “from” tag in the web page. When the information is transmitted, the site validity verification is performed by the white list confirmation unit 26. The site validity verification by the whitelist confirmation unit 26 is performed in the same manner as in the first embodiment.

  In this second embodiment, since the validity verification / warning is focused on the “information transmission” part of the phishing scam where important information is fraudulent, the number of warnings to the user is greatly reduced, Since the warning accuracy can be improved, the convenience for the user can be greatly improved.

(Third embodiment)
In the first and second embodiments described above, the phishing countermeasure process is executed on the mobile terminal side. In the third embodiment, the main part of the phishing countermeasure process is performed on the server side. It will be executed in. FIG. 5 is a block diagram showing a configuration of a phishing countermeasure system according to the third embodiment of the present invention.

  In this embodiment, it is assumed that the mobile phone 15 has a mail reception function and a web browsing function as a mobile terminal. The mobile phone 15 receives the mail 11 via the mail server 16 and accesses the website 13 on the Internet 12 via the proxy server 17.

  The mail server 16 is provided with a company name list 61 and a URL-company name relationship calculation unit 62 similar to the company name list and URL-company name relationship calculation unit in the first and second embodiments, and the URL- A company information embedding unit 63 that inserts the company ID extracted by the company name relation calculating unit 62 into an email and transmits the mail to the mobile phone 15 is provided. The mobile phone 15 includes a mailer 64 and a browser unit 65. The mailer 64 includes a company ID extraction unit 66 that extracts a company ID from the received mail. The proxy server 17 includes a URL white list 67 and a white list confirmation unit 68 similar to the URL white list and the white list confirmation unit in the first and second embodiments.

  Next, the operation of this embodiment will be described.

  In the mail server 16, for the mail 11 received from the outside addressed to the mobile phone 15, as in the case of the first embodiment, the URL-company name relationship calculation unit 62 determines the relationship for each URL in the mail. Seeking deep company (s). Next, the company information embedding unit 63 associates the company ID or company ID string of the company closely calculated by the URL-company name relationship calculating unit 62 with the detected URL, and sends it to the email to the mobile phone 15. Embed. For example, the company ID may be embedded in a mail header, or the mail may be stored in a part different from the main text by making the mail a multi-part mail. Note that the header name and part name (Content-Disposition) used here can be prevented from being abused by phishing scammers by deleting their header fields and parts at the time of reception for all mails. is there.

  As a description example using a header field, an arbitrarily defined field (a field starting with X-) is used in the header. For example, as shown in FIG. 6, a field such as X-URL-Corporations is defined in the mail header. A method to use can be considered. In FIG. 6, only this field is described for simplicity.

  On the other hand, when using another part in multi-part mail, a method of defining Contents-disposition such as URL-Corporations can be considered as illustrated in FIG. FIG. 7 shows only a part related to another part for the sake of simplicity.

In the case of this embodiment, it is necessary to cope with the case where the same URL appears multiple times in the same mail. When the same mail appears multiple times, for example, when there are S same URLs as URL (1) to URL (S) in a certain mail, the score P _{S of the} company whose company ID is n for each URL. _Find (C _n ). Then, for the same n, the values of URL (1) to URL (S) are added to obtain the weight of the company ID for the URL, and the sorted information is used as information attached to the mail.

  In the mail server 16, the mail to which the company ID closely related in this way is attached reaches the mobile phone 15. The user of the mobile phone 15 performs an operation such as browsing for this mail like a conventional mail. Here, the user clicks a URL in the mail and tries to access a site corresponding to the URL. Then, the company ID extraction unit 66 of the mailer 64 starts operation. If the company ID is attached to the mail, the company ID extraction unit 66 sends the URL selected by the user and the corresponding company ID string to the browser unit 65.

  The browser unit 65 retains the company ID string sent from the mailer 64, and when sending information to the site, the browser unit 65 displays the URL as the transmission destination and the retained company ID string. To make an inquiry to the proxy server 17.

  In the proxy server 17, the white list confirmation unit 68 uses the URL white list 67 to search for the URL configuration corresponding to the company ID notified from the browser unit 65, and the URL configuration that is searched from the URL white list 67 Whether the URL notified from the browser unit 65 is included. When the notified URL is included in the URL white list 67, that is, if the validity verification using the URL white list 67 is OK, information is transmitted from the proxy server 17 to the site of the notified URL. The On the other hand, if the notified URL is not included in the URL white list 67, that is, if the validity verification using the URL white list 67 is NG, the white list confirmation unit 68 notifies the mobile phone 15 of the fact. Sent and alerted to the user.

  In the third embodiment, most of the processing for countermeasures against phishing is performed on the server side (the mail server 16 and the proxy server 17). Therefore, the processing by the mobile phone 15 can be lightened. The operation response on the mobile phone 15 can be expected to increase to almost the same speed as when phishing countermeasures are not taken. In addition, there is an advantage that a part requiring maintenance as a database such as the company name list 61 and the URL white list 67 is arranged on the server side, so that it is unnecessary from a process involving a security risk of updating data in the mobile terminal. Have.

  Although the preferred embodiments of the present invention have been described above, the mobile phone terminal 10 in the first and second embodiments and the mobile phone 15 in the third embodiment can be realized by software. That is, recent mobile phones generally have a built-in microprocessor and the operation is controlled by a software program executed on the microprocessor. Therefore, by adding a part for realizing the processing in the mobile phone terminal 10 and the mobile phone 15 to the software program for controlling the mobile phone, the mobile phone terminal 10 and the mobile phone in each of such embodiments are added. It will function as the telephone 15. As a method for introducing such a program into a mobile phone, a method of writing in a nonvolatile memory at the time of shipment, a method by program download, or the like can be used.

  The mail server 16 and the proxy server 17 in the third embodiment can also be realized by causing a computer program such as a server computer to read a computer program for realizing it and executing the program. A program for realizing a mail server or a proxy server is read into a computer by a recording medium such as a magnetic tape or a CD-ROM, or via a network.

  The category of the present invention includes software programs as described herein.

  In the above, the case where the phishing scam with respect to portable terminals, such as a mobile phone, was prevented was mentioned as an example. The phishing countermeasure method of the present invention can be applied to terminals other than mobile terminals (for example, personal computers).

It is a block diagram which shows the structure of the phishing countermeasure system of the 1st Embodiment of this invention. It is a figure which shows the example of a description of a company name list. It is a figure which shows an example of URL white list. It is a block diagram which shows the structure of the anti-phishing system of the 2nd Embodiment of this invention. It is a block diagram which shows the structure of the phishing countermeasure system of the 3rd Embodiment of this invention. It is a figure which shows an example of the description of a header field. It is a figure which shows an example of the description in another part.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Mobile phone terminal 11 Mail 12 Internet 13 Website 15 Mobile phone 16 Mail server 17 Proxy server 20, 64 Mailer 21 Mail browsing part 22, 61 Company name list 23, 67 URL white list 24 Database 25, 62 URL-company name relation Calculation unit 26, 68 White list confirmation unit 27 Site browsing processing unit 30 Browser 63 Company information embedding unit 65 Browser unit 66 Company ID extraction unit

Claims (10)

A phishing countermeasure method to prevent damage caused by phishing scams,
The relationship calculation means analyzes the email received at the terminal and extracts the company name and URL included in the email, and for each extracted URL, from the positional relationship between the company name and the URL in the email, Extracting a company closely related to the URL, and outputting information identifying the extracted company;
When any URL included in the e-mail is selected by the user, the confirmation means refers to the white list that describes the company and the URL of a legitimate site corresponding to the company, and the selected means is selected. Verifying the legitimacy of the site corresponding to the selected URL according to whether the URL is listed in the whitelist as a URL corresponding to the company indicated by the output information;
Anti-phishing method. A phishing countermeasure method to prevent damage caused by phishing scams,
The mail server analyzes the mail to be delivered to the terminal, analyzes and extracts the company name and URL included in the mail, and for each extracted URL, the company name and the URL in the mail Extracting a company closely related to the URL from the positional relationship, adding information specifying the extracted company, and delivering the mail to the terminal;
When the proxy server accepts an access request with the URL and the specified information from the terminal, the proxy server refers to the white list that describes the company and the URL of a legitimate site corresponding to the company. Verifying the legitimacy of the site corresponding to the selected URL according to whether the URL included in the request is listed in the whitelist as a URL corresponding to the company indicated by the specified information; ,
A phishing countermeasure method.   The mail server refers to a company name list holding a company name and a company ID uniquely determined for each company, extracts a company closely related to the URL, and uses the company ID as information for identifying the company. The phishing countermeasure method according to claim 2, wherein the method is added to the mail in association with a corresponding URL. The terminal receiving the mail from the mail server;
When any URL included in the mail is selected by the user, the terminal transmits the selected URL and the specified information corresponding to the selected URL to the proxy server. When,
The phishing countermeasure method according to claim 2 or 3, further comprising: A terminal having a function of receiving mail and a function of accessing an external site,
The received mail is analyzed to extract the company name and URL included in the received mail, and for each extracted URL, the URL is determined based on the positional relationship between the company name and the URL in the received mail. A relationship calculating means for extracting a deeply related company and outputting information for identifying the extracted company;
A whitelist listing the company and the URL of the legitimate site corresponding to that company,
When any URL included in the received mail is selected by the user, the selected URL is referred to as the URL corresponding to the company indicated by the output information with reference to the white list. Checking means for verifying the legitimacy of the site corresponding to the selected URL according to whether it is listed in the white list;
A terminal having A mail server that delivers received emails to the device,
Analyzing the mail to be delivered to the terminal, analyzing and extracting the company name and URL included in the mail, and for each extracted URL, from the positional relationship between the company name and the URL in the mail, A relationship calculating means for extracting a company closely related to the URL;
Company information embedding means for adding information identifying the extracted company to the mail and distributing it to the terminal;
Having a mail server. It is a proxy server that accesses external sites on behalf of requests from terminals,
A whitelist listing the company and the URL of the legitimate site corresponding to that company,
When an access request is received from the terminal with the URL and the specified information, the URL included in the access request is referred to as the URL corresponding to the company indicated by the specified information with reference to the white list. Checking means for verifying the legitimacy of the site corresponding to the selected URL according to whether it is listed in the white list;
Having a proxy server. A computer having a function of receiving mail and a function of accessing an external site;
The received mail is analyzed to extract the company name and URL included in the received mail, and for each extracted URL, the URL is determined based on the positional relationship between the company name and the URL in the received mail. A relationship calculating means for extracting a deeply related company and outputting information for identifying the extracted company;
A storage means for storing a whitelist describing a company and a URL of a legitimate site corresponding to the company;
When any URL included in the received mail is selected by the user, the selected URL is referred to as the URL corresponding to the company indicated by the output information with reference to the white list. Confirmation means for verifying the legitimacy of the site corresponding to the selected URL, depending on whether it is listed in the white list;
Program to function as. Computer
Analyzing the mail to be delivered to the terminal, analyzing and extracting the company name and URL included in the mail, and for each extracted URL, from the positional relationship between the company name and the URL in the mail, A relationship calculation means for extracting companies closely related to the URL;
Company information embedding means for adding the information specifying the extracted company to the mail and distributing it to the terminal;
Program to function as. A computer that can be connected to an external site via a network
A storage means for storing a whitelist describing a company and a URL of a legitimate site corresponding to the company;
When an access request is received with a URL and the information to be specified from a terminal, the URL included in the access request is referred to as the URL corresponding to the company indicated by the information to be specified with reference to the white list. Confirming means for verifying the legitimacy of the site corresponding to the selected URL according to whether it is described in the white list, and mediating access to the legitimate site from the terminal;
Program to function as.

Images