JP2023019935A - Communication processing device and communication processing program - Google Patents

Abstract

To make it possible to easily verify whether a target URL is the URL of a phishing site.SOLUTION: A communication processing device 10 extracts and stores URL information contained in a received email to a user terminal 20, generates pseudo personal information which cannot be authenticated on a legitimate site, notifies a verification target site specified based on the URL information of the pseudo personal information, and determines whether the verification target site is a phishing site, based on an authentication result related to the pseudo personal information returned from the verification target site.SELECTED DRAWING: Figure 1

Description

The present invention relates to communication processing technology for verifying whether or not a target URL is a URL of a phishing site that illegally exploits personal information.

In recent years, e-mails (hereinafter referred to as e-mails) such as password change and purchase completion notices are sent to users to lure users to phishing sites disguised as legitimate financial institutions or shopping sites, etc., where credit card information is stolen. There have been many reports of so-called phishing scams, in which personal information such as , IDs, passwords, addresses, and telephone numbers are defrauded. It is important to verify whether the URL described in the email is the URL of the phishing site and prevent access to the phishing site.

Conventionally, as a technology to verify whether the target URL to be accessed by the user is the URL of a phishing site, the target URL is compared with a URL list in which the URLs of known phishing sites are registered, and the target URL is found in the URL list. A technique has been proposed to determine that the target URL is the URL of a phishing site when the target URL is included in the URL (see, for example, Patent Literature 1, etc.).

Japanese Patent Application Laid-Open No. 2021-033421

In the conventional technology, the target URL is verified based on the URL list in which the URLs of known phishing sites are registered. Access can be prevented in advance.

However, since the URL of a phishing site is frequently changed in order to avoid tracking, access to the target URL cannot be prevented unless the target URL is registered as a phishing site in the URL list. was there.

For this reason, in the conventional technology, a web access log containing the types and sizes of resources used to configure the web page of the phishing site in the browser is acquired and registered in a blacklist, and web access to the site of the target URL is performed. Whether or not the target URL is the URL of the phishing site is verified based on whether or not the log is included in the web access log of the blacklist.

However, according to such technology, not only is the processing load required for verification processing large, but there is also the problem that it is difficult to determine new phishing sites with different web page configurations or phishing sites whose configurations have been changed. there were.

The present invention is intended to solve such problems, and an object thereof is to provide communication processing technology capable of easily verifying whether or not a target URL is the URL of a phishing site.

In order to achieve such an object, a communication processing apparatus according to the present invention includes a storage unit configured to extract and store URL information included in a received mail to a user terminal, and a valid site for authentication. generates pseudo-personal information that cannot be obtained, accesses the verification target site specified based on the URL information, notifies the pseudo-personal information, and authenticates the pseudo-personal information returned from the verification target site. and a control unit configured to determine whether the site to be verified is a phishing site based on the above.

In one configuration example of the communication processing apparatus according to the present invention, the control unit stores, in the storage unit, valid personal information to be notified to the verification target site transmitted from the user terminal. By changing part or all of the information, pseudo-personal information that cannot be authenticated on a legitimate site is generated, a connection destination URL is extracted from the access request sent from the user terminal, and the connection destination URL and When the matching URL information is registered in the storage unit, the site specified based on the connection destination URL is specified as the verification target site.

Further, in one configuration example of the communication processing device according to the present invention, when the control unit determines that the verification target site is a phishing site, the control unit notifies the user terminal that the connection destination site of the access request is A notification is sent requesting user confirmation of whether or not the site is a phishing site, and based on the result of user confirmation returned from the user terminal, it is determined whether or not the site to be verified is a phishing site. It is configured.

In order to achieve such an object, a communication processing program according to the present invention provides a computer with the steps of extracting and storing URL information contained in a received mail to a user terminal, generating pseudo-personal information that does not exist, accessing a site to be verified based on the URL information, notifying the site of the pseudo-personal information, and based on the authentication result of the pseudo-personal information returned from the site to be verified; , and determining whether the site to be verified is a phishing site.

According to the present invention, it is possible to easily verify whether or not the target URL is the URL of the phishing site by simple processing.

FIG. 1 is a block diagram showing the configuration of a communication processing device. FIG. 2 is an explanatory diagram showing a configuration example of verification information. FIG. 3 is a sequence diagram illustrating an example of the operation of the communication processing device; FIG. 4 is a sequence diagram showing another example of the operation of the communication processing device.

Next, one embodiment of the present invention will be described with reference to the drawings.
[Communication processing device]
First, a communication processing device 10 according to the present embodiment will be described with reference to FIG. FIG. 1 is a block diagram showing the configuration of a communication processing device.

This communication processing device 10 relay-connects a user terminal 20 such as a PC or a smart phone connected to a local area network LAN (hereinafter referred to as LAN) under its control to an arbitrary site on the communication network NW, and connects with a connection destination. It is configured to verify in advance whether an arbitrary site on the communication network NW is a phishing site that attempts to exploit personal information.

Generally, a legitimate site authenticates whether or not personal information notified from a user terminal is legitimate by referring to pre-registered legitimate personal information. On the other hand, since phishing sites do not hold valid personal information like legitimate sites, they cannot authenticate whether or not the personal information notified from the user terminal is valid. In addition, phishing sites aim to exploit personal information, and often return authentication success in order to dispel suspicion about their sites.

Therefore, if a legitimate site generates pseudo personal information that cannot be authenticated and notifies it to the verification target site, and the authentication result returned from the verification target site indicates authentication success, the verification target site is a phishing site. It is very likely that The present invention focuses on the characteristic behavior of phishing sites when such pseudo personal information is notified, and determines whether or not the site to be verified is a phishing site based on the authentication result returned from the site to be verified. is configured to verify

[Configuration of communication processing device]
Next, the configuration of the communication processing device 10 according to this embodiment will be described with reference to FIG. The communication processing device 10 is connected to a route that relays and connects user terminals 20 connected to a LAN under its control to a communication network NW such as the Internet. The communication processing device 10 may be configured separately from a network control device such as a UTM (Unified Threat Management) device or a gateway, or may be mounted in these network control devices.

As shown in FIG. 1, the communication processing device 10 includes a network side I/F 11, a LAN side I/F 12, a storage section 13, and a control section 14 as main components.

[Network side I/F]
The network side I/F 11 is configured to perform data communication with the communication network NW via the communication line L. FIG.
[LAN side I/F]
The LAN side I/F 12 is configured to perform data communication with the user terminal 20 via the LAN.

[Memory part]
The storage unit 13 is composed of a storage unit such as a semiconductor memory as a whole, and is configured to store various processing information and programs 13P used for communication processing executed by the control unit 14 .

The program 13P is a communication processing program for realizing various processing units for executing communication processing of the control unit 14 by cooperating with the CPU of the control unit 14 and causing the computer to function as a communication processing device. The program 13P is stored in advance in the storage unit 13 from an external device or recording medium (both not shown) connected to the communication processing device 10 via the communication line L or LAN.

[Verification information]
One of the main pieces of processing information stored in the storage unit 13 is verification information 13A. The verification information 13A is data including URL information to which the user terminal 20 is connected, and valid personal information notified from the user terminal 20 to the connection destination.
FIG. 2 is an explanatory diagram showing a configuration example of verification information. In the example of FIG. 2, for each ID that identifies a connection destination, URL information of the connection destination and legitimate personal information to be notified to the connection destination are registered as a set.

One of the main pieces of processing information stored in the storage unit 13 is a blacklist 13B. The blacklist 13B is list data indicating URL information of sites to which the user terminal 20 is prohibited from accessing, such as phishing sites.

[Control section]
The control unit 14 can be implemented by a computer having a CPU and its peripherals. The control unit 14 is configured to realize a processing unit that executes various processes of the communication processing device by causing the CPU and the program 13P in the storage unit 13 to work together.

The control unit 14 changes part or all of the valid personal information stored in the storage unit 13 to generate pseudo personal information that cannot be authenticated at a valid site, and stores the pseudo personal information in the storage unit 13. access the verification target site and notify the relevant pseudo personal information, and verify whether the verification target site is a phishing site based on the authentication result of the relevant pseudo personal information returned from the verification target site It is configured.

Specifically, the control unit 14 extracts URL information that guides access to the user terminal 20 from the received mail of the user terminal 20 received from the mail server 40, and registers it in the verification information 13A of the storage unit 13. . After that, the connection destination URL is extracted from the access request to the communication network NW transmitted from the user terminal 20, and it is configured to confirm whether or not the URL information matching the connection destination URL is registered in the verification information 13A. .

If URL information that matches the URL of the connection destination is registered in the verification information 13A, the control unit 14 identifies the site of the URL of the connection destination as a verification target site, and confirms the verification information transmitted from the user terminal 20. The valid personal information to be notified to the target site is stored in the verification information 13A, and by changing part or all of the valid personal information, pseudo personal information that cannot be authenticated at the valid site is generated, and the verification target site is accessed. Then, based on the authentication result of the pseudo personal information returned from the verification target site, it is verified whether or not the verification target site is a phishing site.

Here, without waiting for an access request from the user terminal 20, the control unit 14 generates pseudo-personal information that cannot be authenticated at a valid site, accesses the verification target site, and notifies the pseudo-personal information, It may be configured to verify whether or not the site to be verified is a phishing site based on the authentication result regarding the pseudo personal information returned from the site to be verified.

In this case, based on the fact that the received mail of the user terminal 20 received from the mail server 40 contains the URL information that guides the access to the user terminal 20, the site to be verified is specified, and the site to be verified is identified. may be notified of pseudo-personal information that cannot be authenticated on legitimate sites.

The control unit 14 may be configured to determine that the verification target site is a phishing site only when the authentication result regarding the pseudo personal information returned from the verification target site indicates successful authentication.

When the control unit 14 determines that the site to be verified is a phishing site, the control unit 14 notifies the user terminal 20 of a request for user confirmation as to whether or not the connection destination site of the access request is a phishing site. Based on the user confirmation result returned from the user terminal 20, whether or not the site to be verified is a phishing site may be determined.

Furthermore, when the control unit 14 determines that the verification target site is a phishing site based on the user confirmation result returned from the user terminal 20, the control unit 14 stores the connection destination URL of the verification target site in the blacklist 13B of the storage unit 13. , and the connection destination URL specified in the access request to the communication network NW transmitted from the user terminal 20 is included in the blacklist 13B, the user terminal 20 corresponding to the access request is registered in the communication network The NW may be configured to stop the relay processing.

In addition, when notifying the verification target site of the pseudo-personal information without waiting for an access request from the user terminal 20 and verifying whether the verification target site is a phishing site, the pseudo-personal information returned from the verification target site If the authentication result of the information indicates successful authentication, the verification target site may be determined to be a phishing site, and the connection destination URL of the verification target site may be registered in the blacklist 13B of the storage unit 13 .

[Operation of this embodiment]
Next, operation of the communication processing device 10 according to the present embodiment will be described with reference to FIG. FIG. 3 is a sequence diagram illustrating an example of the operation of the communication processing device; Here, a case where the user terminal 20 requests access to the phishing site 30 on the communication network NW based on the URL information included in the received mail to the user terminal 20 will be described as an example.

As shown in FIG. 3, first, when a phishing email is sent from the phishing site 30 to the user terminal 20 (step 100), the phishing email is sent from the mail server 40 to the user terminal 20 via the communication processing device 10. transferred.

The control unit 14 of the communication processing device 10 monitors received emails received by the user terminal 20 from the mail server 40, and extracts URL information included in the phishing emails in the same manner for phishing emails, verification information 13A (step 101).

After that, when there is an access request from the user terminal 20 whose connection destination is the URL information included in the phishing email (step 102), the control unit 14 extracts the connection destination URL from the access request and stores it in the storage unit 13. It is compared with the URL information registered in the verification information 13A. Here, since the URL information matching the connection destination URL is registered in the verification information 13A, the site of the connection destination URL is specified as the verification target site (step 103), and the verification target site extracted from the access request is identified. is stored in the verification information 13A (step 104). If URL information that matches the connection destination URL is not registered in the verification information 13A, a process of relaying connection of the user terminal 20 to the site of the connection destination URL is executed in response to the access request.

When the connection destination of the access request is specified as the verification target site as described above, the control unit 14 performs the following steps 111 to 115 to verify whether the verification target site is a phishing site. A verification process (step 110) is executed.

First, the control unit 14 reads out the valid personal information registered in the verification information 13A, and by changing part or all of it, generates pseudo personal information that cannot be authenticated on a valid site (step 111), accesses the site to be verified (phishing site 30) via the network side I/F 11, communication line L, and communication network NW based on the connection destination URL, and notifies pseudo personal information (step 112). The legitimate site referred to here is the original site from which successful authentication can be obtained with valid personal information.

As a result, the verification target site (phishing site 30) exploits the pseudo-personal information notified from the communication processing device 10 (step 113), and returns an authentication result indicating successful authentication without actually executing the authentication process. (Step 114). This authentication result is notified to the user terminal 20 via the communication network NW, the communication processing device 10, and the LAN.

The control unit 14 checks the authentication result returned from the verification target site, and if the authentication result indicates successful authentication, determines that the verification target site is a phishing site (step 115), and performs a series of verification processes (step 110). ). If the authentication result indicates authentication failure, the site to be verified is determined not to be a phishing site, and the series of verification processes (step 110) is terminated.

Subsequently, if the control unit 14 determines in the verification process (step 110) that the site to be verified is a phishing site, the control unit 14 determines that the connection destination site of the access request is a phishing site. Generates a confirmation request mail requesting final confirmation as to whether or not is a phishing site, and transmits it to the mail server 40 via the network side I/F 11, communication line L, and communication network NW (step 120). This confirmation request mail is sent from the mail server 40 to the user terminal 20 via the communication network NW, communication processing device 10 and LAN (step 121).

Thereafter, when the user terminal 20 notifies the user confirmation result in response to the confirmation request mail (step 122), the control unit 14 determines whether the site to be verified is a phishing site based on the user confirmation result. Confirm (step 123).

If the user confirmation result indicates that the connection destination site is a phishing site, the control unit 14 registers the connection destination URL of the verification target site in the blacklist 13B of the storage unit 13 ( Step 124), the series of relay connection processing ends.

As a result, when the connection destination URL specified in the access request to the communication network NW transmitted from the user terminal 20 is included in the blacklist, the control unit 14 controls the user terminal 20 according to the access request. and the communication network NW.

If the user confirmation result indicates that the connection destination site is not a phishing site, the control unit 14, based on the connection destination URL, via the network side I/F 11, the communication line L, and the communication network NW to access the verification target site, notify the valid authentication information registered in the verification information 13A, notify the user terminal 20 of the authentication result returned from the verification target site via the LAN from the LAN I/F 12, and perform a series of operations. end the relay connection processing of

FIG. 4 is a sequence diagram showing another example of the operation of the communication processing device. FIG. 4 is an operation sequence for notifying pseudo personal information to a verification target site without waiting for an access request from the user terminal 20, and verifying whether or not the verification target site is a phishing site.

In this case, based on the fact that the received mail of the user terminal 20 received from the mail server 40 contains URL information that guides access to the user terminal 20, the site to be verified is specified (step 203), The site to be verified is notified of pseudo-personal information that cannot be authenticated at a legitimate site (step 212).

When the authentication result of the pseudo-personal information returned from the verification target site indicates successful authentication (step 214), the verification target site is determined to be a phishing site (step 215), and the connection destination of the verification target site is determined. The URL is registered in the blacklist 13B of the storage unit 13 (step 224).

[Effects of this embodiment]
As described above, in the present embodiment, the control unit 14 of the communication processing device 10 generates pseudo personal information that cannot be authenticated at a valid site, accesses the verification target site, notifies the pseudo personal information, It is configured to verify whether or not the site to be verified is a phishing site based on the authentication result regarding the pseudo personal information returned from the site to be verified.

As a result, there is no need for verification processing with a heavy processing load, such as obtaining and comparing web access logs that include the types and sizes of resources used to construct the web page of the phishing site in the browser. It is possible to easily verify whether or not the target URL is the URL of the phishing site by an extremely simple process of accessing the site, notifying the pseudo personal information, and confirming the authentication result.

[Expansion of Embodiment]
Although the present invention has been described with reference to the embodiments, the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

DESCRIPTION OF SYMBOLS 10... Communication processing apparatus 11... Network side I/F 12... LAN side I/F 13... Storage part 13A... Verification information 13B... Black list 13P... Program 14... Control part 20... User terminal , 30... phishing site, 40... mail server, L... communication line, LAN... local area network, NW... communication network.

Claims (4)

a storage unit configured to extract and store URL information included in a received email to a user terminal;
generating pseudo-personal information that cannot be authenticated on a legitimate site, accessing a site to be verified based on the URL information, notifying the pseudo-personal information, and sending back the pseudo-personal information from the site to be verified; A communication processing device, comprising: a control unit configured to determine whether or not the site to be verified is a phishing site based on an authentication result relating to personal information. The communication processing device according to claim 1,
The control unit
The authorized personal information sent from the user terminal and notified to the site to be verified is stored in the storage unit, and part or all of the authorized personal information is changed so that authentication cannot be obtained at the authorized site. generating pseudo-personal information, extracting a connection destination URL from an access request transmitted from the user terminal; A communication processing device, wherein a site specified based on the verification target site is specified as the verification target site. In the communication processing device according to claim 2,
When the control unit determines that the verification target site is a phishing site, the control unit notifies the user terminal of a request for user confirmation as to whether or not the connection destination site of the access request is a phishing site. a communication processing apparatus configured to determine whether or not the site to be verified is a phishing site based on a user confirmation result returned from the user terminal. to the computer,
a step of extracting and storing URL information contained in an e-mail received by a user terminal; generating pseudo-personal information that cannot be authenticated on a legitimate site, and accessing a site to be verified based on the URL information; a communication processing program for executing a step of determining whether or not the site to be verified is a phishing site based on the authentication result of the pseudo personal information returned from the site to be verified, and notifying the pseudo personal information by .

Images