JP4545540B2 - Access prevention device - Google Patents

Description

  This invention detects an unauthorized site impersonating a legitimate site of a communication network and warns of the danger of access, thereby preventing an unauthorized act such as fraud performed by the unauthorized site in advance. The present invention relates to an access prevention method and an access prevention program.

  In recent years, fraud called Phishing on the Internet has increased rapidly. Phishing means an act of guiding a user to a site that appears to be a website of an actual company and stealing it by inputting a credit card number or the like.

  For example, a typical Phishing technique is to send an e-mail pretending to be from a well-known company to a victim and lead to a fake site. The email has the sender's name (From) as the name of the company, and the text says "If you do not enter your personal information by accessing the link below, your account will expire." . A user who misunderstands the link destination described in the email as that of a well-known company will enter the credit card number and the password of the service into a fake site.

As means for preventing access to such a dangerous site, there is currently a method of restricting access using an access disapproval list. In this method, a list of sites not permitted to access is prepared in advance, and access to the sites is prohibited when the user tries to access the sites. As a variation, there is a method of holding an access permission list and allowing access only to sites included in the list.
JP 2004-159159 A

  However, from the viewpoint of prevention of Phishing, it is easy for Phishers to build a site with an arbitrary name, so if it is on the disallowed list, it will immediately build a site with a different name. It is possible. Therefore, in order to cope with this, it is necessary to continuously update the access disapproval list, and there is a problem that it does not function as a means for preventing Phishing fraud. In addition, since access restriction based on the access permission list inhibits free browsing of the Web, it is difficult to apply it only in an environment where there is no problem even if the usage of the Web is strictly limited.

  Therefore, when a user accesses a link at risk of inducing a Phishing scam, an object is to prevent the user from being damaged by the Phishing scam by detecting it and giving a warning in advance. In addition, the information on the owner (company) of the currently accessed site is always displayed, and the user can always check whether he / she is accessing his / her intended site, thereby further damaging the Phishing scam. The purpose is to reduce the risk of meeting.

  An access prevention apparatus includes a site information storage unit that stores site information of a communication network, an input unit that inputs information of a site accessed via the communication network, and site information and site information storage unit that are input by the input unit Is provided with a determination unit that determines the association with the information on the site stored by the computer using a predetermined algorithm, and an output unit that outputs a warning based on the determination result of the determination unit.

  According to the present invention, when the determination unit determines that the site accessed via the communication network input from the input unit and the site information of the communication network stored in the site information storage unit are related, the output unit By outputting the warning, it is possible to prevent an illegal act such as a Phishing scam performed by an unauthorized site.

Embodiment 1 FIG.
In the first embodiment, it is determined whether or not the URL (Uniform Resource Locator) of a site accessed via a communication network is similar to the URL of a famous site, and it is determined that the accessing site is not a famous site In this case, an embodiment for warning the user of this will be described. A “site” is a device (server) that provides information via a communication network represented by the Internet, or an information providing base where the devices (servers) gather.

FIG. 1 is a diagram showing the configuration of the terminal 101 and the connection with the database 107 in the first embodiment.
In addition to the browser 102 and the network access unit 105, the terminal 101 includes a forgery determination unit 103 and a famous site information storage unit 104.

  In the first embodiment, the terminal 101 corresponds to the access prevention device described in the claims, the impersonation determination unit 103 corresponds to the determination unit, and the famous site information storage unit 104 corresponds to the site information storage unit. The browser 102 realizes an input unit by inputting data from a keyboard, for example, and realizes an output unit by displaying data on a display.

  The browser 102 inputs information on a site accessed via the communication network, and outputs a warning based on a determination result made by the camouflage determination unit 103 (described later). The browser 102 is operated by a user and provides a user interface for browsing Web (World Wide Web) content on a communication network and an e-mail described in HTML (Hyper Text Markup Language).

  The famous site information storage unit 104 stores information on sites of the communication network. Here, the URL of a famous site is assumed as “site information”.

  The camouflage determination unit 103 determines the association between information on sites accessed via the communication network input from the browser 102 and information on famous sites stored in the famous site information storage unit 104 using a predetermined algorithm. Specifically, it is determined whether or not the site to which the browser 102 tries to access is a site disguised as a famous site.

  The network access unit 105 provides a function for communicating with a Web server or database in accordance with a request from the browser 102.

  The terminal 101 can access the database 107 via the communication network 106. The database 107 stores the name of the organization that operates the site of the communication network, and responds to the inquiry from the terminal 101 using the URL or the like with the name of the organization that operates the site specified from the URL.

Next, the operation of terminal 101 in the first embodiment will be described.
The famous site information storage unit 104 of the terminal 101 stores the URL as site information, the browser 102 inputs the URL as site information, and the impersonation determination unit 103 stores the URL input by the browser 102 and the famous site information. When the browser 102 determines whether the URL stored in the unit 104 is similar, and the browser 102 determines that the impersonation determination unit 103 is similar, the browser 102 outputs a warning.

The operation will be specifically described. FIG. 2 is a flowchart for explaining the operation in the first embodiment.
The browser 102 of the terminal 101 accepts a page access request by selecting a link destination by the user 100 (step S201). The browser 102 inputs the URL for accessing the selected page to the impersonation determination unit 103, and requests to determine whether the URL is similar to that of a famous site (step S202). The camouflage determination unit 103 compares the host name portion in the input URL with the host names of known famous sites stored in the famous site information storage unit 104, and calculates their similarity. As a result, except when a perfect match is found, when the similarity exceeds a certain threshold, it is determined that there is a possibility of impersonation, and the determination result is returned to the browser 102 (step S203). Based on the determination result received from the camouflage determination unit 103, the browser 102 displays a warning that the access destination may be a fake site pretending to be a famous site, and asks the user whether or not to continue access. Confirm (step S204).

  An example of a screen for confirmation by the user is shown in FIG. When the user accepts the access by clicking the “OK” button on the confirmation screen (step S205), the browser 102 accesses the site of the communication network through the network access unit 105 as before, and the Web content is displayed. Obtain and display to the user (step S206).

Next, a method for calculating the similarity in the camouflage determination unit 103 will be described with reference to FIGS.
The camouflage determination unit 103 includes a matrix that gives a similarity for each character as shown in FIG. In this matrix, the similarity between the same characters is set to 1, and the similarity between different characters is set to 0. However, characters that are easily misunderstood by the user, such as “1 (1)” and “I (eye)”, “0 (zero)”, and “O (O)”, depend on the ease of misperception. A similarity is assigned in the range of 0-1.

A method of calculating the similarity between character strings will be described with reference to FIG.
Suppose that the URL of a famous site is “DOGS” and the URL of the site to be accessed is “D0S”.

  As shown in FIG. 5, the camouflage determination unit 103 sets the number of characters (4) of “DOGS” that is the URL of the famous site as the horizontal direction and the number of characters (3) of “D0S” as the access destination URL as the vertical direction. A grid-like directed graph is generated, and edges are also generated on the diagonal line from the upper left to the lower right of each grid.

  Next, a score is assigned to each side of the graph. The degree of similarity when a horizontal character and a vertical character are compared is assigned to the diagonally drawn graph. A value of 0 or less is assigned to each graph stretched in the horizontal direction and the vertical direction. The assigned value is called a Gap penalty. In FIG. 5, -0.1 is assigned as the gap penalty.

  Of the paths from the upper left corner to the lower right corner of the graph in which a score is assigned to each side, the route having the maximum score is calculated, and the value obtained by dividing the score by the number of characters of the famous site is similar to the access destination URL. Degree. The above is the method for calculating the similarity between character strings.

  The impersonation determination unit 103 uses this method between the host name of the site accessed via the communication network input from the browser 102 and the host name of each famous site stored in the famous site information storage unit 104. If the maximum similarity exceeds a certain threshold, except when they completely match, the site accessed via the communication network is determined to be impersonated, and the browser 102 warns. Is output.

  Note that the browser 102 ignores the warning even if it outputs a warning, and stores the site for which the user has approved access to the site so that it can be accessed again. It is also possible not to output a warning to the user.

  According to the first embodiment, the terminal 101 determines that the site accessed via the communication network input from the browser 102 and the information on the site of the communication network stored in the famous site information storage unit 104 are associated with the impersonation determination unit 103. If it is determined, the browser 102 outputs a warning, thereby preventing an illegal act such as a Phishing scam performed by an unauthorized site.

  According to the first embodiment, when the URL of the site accessed via the communication network input from the browser 102 is similar to the URL of the famous site stored in the famous site information storage unit 104, the URL is transmitted via the communication network. By judging that the accessing site is camouflaged as a famous site and outputting a warning from the browser 102, access to the camouflaged site can be avoided and illegal acts such as Phishing fraud can be prevented in advance. it can.

  According to the first embodiment, even when a warning is received, a site accessed by ignoring the warning can be accessed again without receiving the warning, and the warning is received one by one. Annoyance can be eliminated.

  According to the first embodiment, by detecting access to a URL similar to a famous site that is a characteristic of the site for Phishing purpose, it is possible to effectively access the Phishing site without updating the access disapproval list. Can be prevented.

  In the first embodiment, the case where the access prevention device is realized by a terminal has been described. However, the present invention is not limited to a terminal, and may be any one of a personal computer, a mobile phone, a PDA (Personal Digital Assistance), and a proxy server. It can also be realized.

Embodiment 2. FIG.
In the second embodiment, the URL of the site accessed via the communication network is used to calculate the similarity between the site accessed via the communication network and the famous site, instead of the entire host name of the URL used in the first embodiment. An embodiment using the domain name described in the above and a character string of a URL of a famous site or a part thereof will be described.

FIG. 6 is a diagram showing the configuration of the terminal 101 and the connection with the database 107 in the second embodiment.
The configuration of the terminal in the second embodiment is the same as that in the first embodiment. The function of each unit is the same as that of the first embodiment except that the camouflage determination unit 103 performs communication via the network access unit 105.

  Also in the second embodiment, the terminal 101 corresponds to the access prevention device described in the claims, the impersonation determination unit 103 corresponds to the determination unit, and the famous site information storage unit 104 corresponds to the site information storage unit. The browser 102 realizes an input unit by inputting data from a keyboard, for example, and realizes an output unit by displaying data on a display.

Next, the operation of terminal 101 in the second embodiment will be described.
The famous site information storage unit 104 of the terminal 101 stores at least a part of the character string used in the URL as the site information, and the browser 102 inputs the URL in which the domain name is described as the site information, and determines forgery. The unit 103 determines whether the domain name described in the URL input by the browser 102 is similar to at least a part of the character string used in the URL stored in the famous site information storage unit 104. Outputs a warning when it is determined that the camouflage determination unit 103 is similar.

  The famous site information storage unit 104 of the terminal 1 stores the name of the organization that operates the site of the communication network as site information, the browser 102 inputs a URL as the site information, and the impersonation determination unit 103 The name of the organization that manages the site specified by the URL input from the browser 102 is acquired from the database 107 that stores the name of the organization that manages the site of the site, and the name of the organization and the famous site information storage unit acquired from the database 107 are acquired. The browser 102 determines whether or not the name of the organization stored in the browser 104 matches, and the browser 102 outputs a warning when the camouflage determination unit 103 determines that they do not match.

  The operation will be specifically described. FIG. 7 is a flowchart for explaining the operation in the second embodiment.

Steps S801 and S802 are the same as steps S201 and S202 in the first embodiment. The impersonation determination unit 103 that has received the inquiry determines whether or not the input URL is similar to the URL of a famous site. When it is determined that the URL is similar, the impersonation determination unit 103 exists on the Internet via the network access unit 105. The database 107 is inquired of the name of the organization that operates the site specified from the URL by using, for example, the WHOIS command of Linux (“Linux” is a registered trademark) (step S803). The camouflage determination unit 103 acquires the name of the organization from the database 107, and confirms whether the acquired name of the organization matches the name of the organization that operates the famous site stored in the famous site information storage unit 104 (step S804). ). If they match, the browser responds with no fear of impersonation, and if they do not match, it responds with the fear of impersonation to the browser (step S805). The browser 102 warns the user when there is a risk of impersonation (step S806). Subsequent steps S807 and S808 are the same as steps S205 and S206 of the first embodiment.

  Next, a similar determination method in the second embodiment will be described. In the first embodiment, when determining the similarity of URLs, the entire host names of URLs are compared. However, in the second embodiment, instead of comparing the entire host name of the URL, the host name is divided into domains, each divided domain is compared with a character string characterizing the URL of a famous site, and similarity is determined. .

  For example, as shown in FIG. 8, the URL of a site for determining the presence / absence of impersonation is http: // www. dec. def. com / and a character string that characterizes the URL of a famous site is def, and comparison is made between def and the URL of the site URL for determining the presence or absence of impersonation, www, dec, def, and com.

  Here, in the character string characterizing the URL, for example, the URL of a certain company site is http: // www. abc-xyz. co. jp), abc-xyz among them corresponds.

  For the determination of similarity between character strings, the same method of calculating the similarity as in the first embodiment is used. However, in the second embodiment, since the determination may be based on a more gradual similarity, the gap penalty is set to 0, The range of URLs that are regarded as impersonation has been expanded.

  If it is determined that the URLs are similar as a result of the comparison, as described above, for example, the name of the organization that operates the site specified from the URL is acquired using the WHOIS command, and the camouflage determination unit 103 receives the famous site information. The name is compared with the name of the organization that operates the famous site stored in the storage unit 104. At this time, in order to cope with the case where a Japanese corporation and an overseas corporation operate sites with different domains, register the names of multiple organizations as the names of the organizations that operate one famous site specified by the URL. Is possible. Therefore, a table as shown in FIG. 9 is stored in the famous site information storage unit in the second embodiment.

  According to the second embodiment, even if it is not necessary to compare all URLs of sites accessed via the communication network with all URLs of famous sites stored in the famous site information storage unit 104, those portions are passed through. By comparing, it can be determined whether a site accessed via the communication network is disguised as a famous site.

  According to Embodiment 2, using the URL of a site accessed via a communication network, the name of the organization that operates the site is stored and managed as the name of the organization that operates the site of the communication network. A site accessed via a communication network by inquiring a database of a third party and comparing the name of the obtained organization with the name of the organization that operates the famous site stored in the famous site information storage unit 104 It is possible to confirm whether the URL is a URL of a famous site. Further, by performing this confirmation together with the determination of impersonation using the above-described URL or a part thereof, the determination of impersonation of a famous site accessed through a communication network may be made more reliable. it can.

  According to the second embodiment, even a Phishing site that is different from a famous site can be detected except for a character string as a key.

Embodiment 3 FIG.
In the first embodiment and the second embodiment, the impersonation determination is performed in the terminal equipped with the browser. However, in the third embodiment, the impersonation determination unit and the famous site are connected to the proxy server through which web access is performed from the terminal. An embodiment will be described in which an information storage unit is arranged and the determination of impersonation is performed based on a request from a terminal in a proxy server connected to the terminal via a communication network.

FIG. 10 is a diagram showing the configuration of the proxy server 1104 and the connection with the terminal 1101 in the third embodiment.
The proxy server 1104 is connected to a terminal 1101 operated by a user via a communication network 1103.

  The proxy server 1104 includes an impersonation determination unit 1105, a famous site information storage unit 1107, and a web proxy server (Web Proxy Server) unit 1106. The functions of the camouflage determination unit 1105 and the famous site information storage unit 1107 are the same as those in the first embodiment. The web proxy server unit 1106 is a part that implements the function of the proxy server 1104 as a proxy server, and includes transmission / reception via the communication network 1103.

  In the third embodiment, the proxy server 1104 corresponds to the access prevention device described in the claims, the impersonation determination unit 1105 corresponds to the determination unit, and the famous site information storage unit 1107 corresponds to the site information storage unit. Also, the web proxy server unit 1106 implements an input unit and an output unit via a communication network.

Next, the operation of the proxy server 1104 in the third embodiment will be described.
The famous site information storage unit 1107 of the proxy server 1104 stores the URL as the site information, and the web proxy server unit 1106 receives the URL as the site information from the terminal 1101 and the parameters input from the form or generated by the script language. When the determination unit determines that the input URL and the URL stored in the famous site information storage unit 1107 are similar, the web proxy server unit 1106 generates an input from a form or a script language A warning described in HTML is output that includes the parameters that are not displayed on the screen.

  When the web proxy server unit 1106 of the proxy server 1104 inputs information that approves access to a site that ignores the warning from the terminal, the impersonation determination unit 1105 displays the URL input by the web proxy server unit 1106 and a famous site It is not determined whether the URL stored in the information storage unit 1107 is similar.

  The browser 1102 of the terminal 1101 transmits a request URL described in HTTP to the proxy server 1104 according to the settings in the browser in order to access the Web site by the operation of the user 1100. The web proxy server unit 1106 of the proxy server 1104 receives the request URL from the terminal 1101 and sends it to the impersonation determination unit 1105. The camouflage determination unit 1105 determines whether the URL is camouflaged on a famous site by the method described in the first embodiment. When it is determined that there is a possibility of impersonation, the result is transmitted to the web proxy server unit 1106. The web proxy server unit 1106 generates a proxy error page for requesting confirmation from the user 1100 and transmits it to the browser 1102 of the terminal 1101.

  In the proxy error page, for example, the contents shown in FIG. 11 are described in HTML. The request URL is described in the action attribute of the proxy error page form, and the parameter information transmitted from the terminal 1101 together with the URL request is described as an HTML hidden element 1204 in the tag of the proxy error page form. ing.

  A screen 1201 as shown in FIG. 11 is displayed on the browser 1102 according to the content described in HTML on the proxy error page. When the user presses the displayed [OK] button, a URL request is again sent to the proxy server. However, this time, a parameter described in HTML is added to the proxy error page transmitted from the terminal by the proxy server ("--- PHISHING_WARNING_CONFIRM ---- = 1" (part 1203) in FIG. 11). The

  If the web proxy server unit 1106 of the proxy server 1104 receives the request URL to which this parameter is added, the request is transmitted to the Web server specified by the URL without being sent to the impersonation determination unit 1105. At that time, the parameters previously added to the proxy error page by the proxy server are automatically removed.

  In the third embodiment, Phishing is detected collectively by the proxy server 1104, but it is also possible to realize the function of the proxy server at the user terminal and determine impersonation there.

  According to the third embodiment, it is not necessary to provide each terminal with a function for determining a camouflaged site, and the determination of camouflage can be collectively executed by a proxy server.

  According to the third embodiment, even if a warning is received from the proxy server 1104, the user can recognize the information and approve the access, thereby accessing the site without executing the determination of impersonation by the proxy server. can do.

  According to the third embodiment, by performing impersonation determination by the proxy server 1104, the users of the terminals 1101 connected to the LAN in the organization can be collectively protected from the Phishing scam. Furthermore, it is possible to cope with Phishing fraud without changing the existing browser of the terminal 1101.

Embodiment 4 FIG.
In the fourth embodiment, by clicking on the display of the link destination displayed on the browser and the display of the link destination, it is determined whether or not the site that is actually accessed matches, and thus an illegal site is obtained. An embodiment for preventing such access will be described.

The configuration of terminal 101 in the fourth embodiment is the same as that in the first embodiment. Next, the operation will be described.
The browser 102 inputs the URL of the link destination as site information, and the forgery determination unit 103 receives the link destination URL input by the browser 102 and the link destination URL input by the browser 102 via the communication network. The browser 102 determines whether or not the URL of the site to be accessed matches, and the browser 102 outputs a warning when the impersonation determination unit 103 determines that they do not match.

The operation in the fourth embodiment will be described with reference to the flowchart shown in FIG.
Step S301 is the same as step S201 in the first embodiment. The browser 102 sends the URL of the site accessed via the communication network 106 to the impersonation determination unit 103, requests access, and character string information displayed on the anchor or button that triggered the access to the URL (Label) is also sent to determine whether or not they match (Step S302). The impersonation determination unit 103 determines whether the URL and the URL of the actual access destination match if the URL is described in the label, and if the URL is different, a response that there is a possibility of impersonation Is returned to the browser 102 (step S303). Steps S304 to S306 are the same as steps S204 to S206.

  According to the fourth embodiment, it is possible to prevent access to an unauthorized site by displaying a URL different from the actual access destination on the browser and tricking the user who viewed the display.

  According to the fourth embodiment, it is possible to detect a Phishing technique that allows access to a site different from the displayed link.

Embodiment 5 FIG.
In the fifth embodiment, the URL of the site accessed via the communication network is displayed on the browser, and the name of the organization that operates the site that is always accessed along with the URL is displayed so that the user can always access his / her own site. An embodiment in which it is possible to confirm whether or not a certain site is a target site will be described.

The configuration of terminal 101 in the fifth embodiment is the same as that in the first embodiment. Next, the operation will be described.
The impersonation determination unit 103 acquires the name of the organization that operates the site specified by the URL input from the browser 102 from the database 107 that stores the name of the organization that operates the site of the communication network. The name of the organization acquired by the unit 103 is output.

The operation in the fifth embodiment will be described with reference to the flowchart shown in FIG.
Step S401 is the same as step S201 in the first embodiment. The browser 102 requests the name of the organization that operates the site together with the URL of the site that requests access to the impersonation determination unit 103 (step S402). The impersonation determination unit 103 inquires of the database 107 of the name of the organization that operates the site specified by the URL via the network access unit 105 using, for example, a WHOIS command (step S403). The database 107 returns the name of the organization to the impersonation determining unit 103 (step S404), and the impersonation determining unit 103 returns the name of the organization obtained from the database 107 to the browser 102 (step S405). The browser 102 displays the name of the organization that operates the accessed site obtained by the answer to the user (step S406).

  FIG. 14 shows an example in which the URL of the site requesting access and the name of the organization obtained from the database 107 are displayed on the browser 102 according to the fifth embodiment.

  According to the fifth embodiment, the name of the organization that operates the site can be displayed together with the URL of the site to be accessed, and the user can access the site while confirming the access destination. .

  According to the fifth embodiment, the user can always confirm whether or not the site he / she is accessing is actually from a company he / she wants to access.

Embodiment 6 FIG.
In the sixth embodiment, when an input form forged by e-mail is transmitted, the e-mail is sent to an unauthorized site by comparing the e-mail transmission source and destination. An embodiment to prevent will be described.

FIG. 15 shows the configuration of terminal 1401 and the connection with database 1405 in the sixth embodiment.
The terminal 1401 includes an e-mail client with an HTML display function (hereinafter abbreviated as an e-mail client) 1402, a network access unit 1404, and a camouflage determination unit 1403.

  The e-mail client 1402 can send and receive and display e-mails and can display information described in HTML. Note that the functions of the network access unit 1404 and the camouflage determination unit 1403 are the same as those in the first embodiment.

  In the sixth embodiment, the terminal 1401 corresponds to the access prevention device described in the claims, and the impersonation determination unit 1403 corresponds to the determination unit. The e-mail client 1402 implements an input unit by writing e-mail from a keyboard, for example, and implements an output unit by displaying the e-mail on a display.

Next, the operation in the sixth embodiment will be described.
The browser 102 inputs the source address and destination address of the e-mail as site information, and the forgery determination unit 103 reads the name of the organization that operates the site on the communication network from the database 107. The name of the organization that operates the site specified by the input source address of the input e-mail and the name of the organization that operates the site specified by the destination address of the e-mail input by the browser 102 were acquired. The browser 102 determines whether the name of the organization that operates the site specified by the e-mail transmission source address matches the name of the organization that operates the site specified by the e-mail transmission destination address. If the camouflage determination unit 103 determines that they do not match, a warning is output.

The operation in the sixth embodiment will be specifically described with reference to the flowchart shown in FIG.
The e-mail client 1402 inputs information such as a password for the form displayed in the e-mail from the user 1400 (step S501). When the e-mail client 1402 tries to send an e-mail to a Web site, the e-mail client 1402 sends the e-mail transmission source address and the form transmission destination address (URL) to the impersonation determination unit 1403 (step S502). Forgery determination unit 1403 uses the WHOIS command, for example, to determine the source address and destination address from the source address and destination address received via the network access unit, as in the second embodiment. The database 1405 is inquired of the name of the organization that operates the site (S503). The camouflage determination unit 1403 acquires the names of the organizations that operate the site of the e-mail transmission source address and the site of the transmission destination address from the database (step S504), and compares them. As a result, if the names do not match, the e-mail client responds that the e-mail may have been sent for the purpose of tricking the user (step S505). The email client 1402 displays a warning to the user 1400 (step S506).

  According to the sixth embodiment, a false source email address different from the destination email address is displayed, and information leakage due to sending an email to a camouflaged site without knowing is prevented. Can do.

The embodiment has been described above.
In addition to the above, a terminal or browser (including a mailer that can display HTML mail) including a famous site information storage unit and a camouflage determination unit can be realized as an embodiment. A browser having a function of displaying a warning screen when a user accesses a site similar to a famous site can be realized. After a warning is displayed, a browser having a function of performing Web access as usual without displaying a warning when a site approved by the user is accessed again can be realized. When it is determined that the URLs are similar, an impersonation determination unit having a function of confirming the owner (company) of the site by making an inquiry to the database can be realized. It is possible to realize a camouflage determination unit that compares a character string that is a keyword of a famous site URL with a character string that represents each domain of the URL to be accessed. A famous site information storage unit that stores a character string representing the URL of a famous site and the name of a company that owns the site can be realized. A proxy server having an impersonation determination unit can be realized.

  Further, as the contents of the Web page generated when the warning is issued, a parameter to be transmitted by the original access can be described in an <input hidden> tag. Further, a parameter (FIG. 12-1203) can be added to the original URL to determine that the user has approved access.

A camouflage determination unit that issues a camouflage warning when a URL displayed as a link is different from a URL that is actually accessed when the link is selected can be realized.
It is possible to realize a browser that acquires owner information of a Web page being browsed by WHOIS and always displays it on the screen. Checks and compares the domain name part of the email address of the sender and the organization holding the destination URL of the form in the email with WHOIS. A mail client with an HTML display function can be realized.

  As for the access prevention device, the site information storage unit stores a URL (Uniform Resource Locator) as the site information, and the input unit is generated by the URL and the parameters input from the form and the script language as the site information. When the determination unit determines that the URL input by the input unit and the URL stored by the site information storage unit are similar, the output unit receives the parameter and script input from the form. A warning described in HTML including parameters generated by a language in a format not displayed on the screen may be output.

As described above, the access prevention device which is the terminal or the proxy server described in the first to sixth embodiments can be realized by a computer. FIG. 16 is a diagram illustrating a hardware configuration when the access prevention device that is a terminal or a proxy server in the first to sixth embodiments is realized by a computer.
In FIG. 17, the access prevention apparatus includes a CPU (Central Processing Unit) 911 that executes a program. The CPU 911 includes a ROM (Read Only Memory) 913, a RAM (Random Access Memory) 914, a communication board 915, a display device 901, a keyboard (K / B) 902, a mouse 903, and an FDD (Flexible Disk Drive) 904 via a bus 912. , A magnetic disk device 920, a CDD (Compact Disk Drive) 905, a printer device 906, and a scanner device 907.

  The RAM 914 is an example of a volatile memory. The ROM 913, the FDD 904, the CDD 905, the magnetic disk device 920, and the optical disk device are examples of nonvolatile memories. These are examples of a storage device or a storage unit.

  The communication board 915 is connected to a FAX machine, a telephone, a LAN, and the like. The communication board 915, the K / B 902, the FDD 904, the scanner device 907, and the like are examples of an input unit. Further, the communication board 915, the display device 901, and the like are examples of an output unit.

  Here, the communication board 915 is not limited to the LAN, and may be directly connected to the Internet or a WAN (Wide Area Network) such as ISDN. When directly connected to the Internet or a WAN such as ISDN, the access prevention device is connected to the Internet or a WAN such as ISDN, and the web server is unnecessary.

  The magnetic disk device 920 stores an operating system (OS) 921, a window system 922, a program group 923, and a file group 924. The program group 923 is executed by the CPU 911, the OS 921, and the window system 922.

  The program group 923 stores a program for executing a function described as “˜unit” in the description of the first to sixth embodiments. The program is read and executed by the CPU 911.

  The arrows in the flowcharts described in the description of the first to sixth embodiments described above mainly indicate data input / output. For the data input / output, data is stored in a magnetic disk device 920, an FD (Flexible Disk). ), An optical disc, a CD (Compact Disk), an MD (Mini Disk), a DVD (Digital Versatile Disk), and the like. Alternatively, it is transmitted through a signal line or other transmission medium.

  What is described as “˜unit” in the description of the first to sixth embodiments described above may be realized by firmware stored in the ROM 913. Alternatively, it may be implemented by software alone, hardware alone, a combination of software and hardware, or a combination of firmware.

  The programs for carrying out the first to sixth embodiments described above are a magnetic disk device 920, an FD (Flexible Disk), an optical disk, a CD (Compact Disk), an MD (Mini Disk), and a DVD (Digital Versatile Disk). It may be stored using a recording apparatus using other recording media such as.

It is a figure which shows the structure of the terminal in Embodiment 1, and the connection with a database. 3 is a flowchart for explaining an operation in the first embodiment. 6 is a diagram illustrating an example of a screen for confirmation by a user in Embodiment 1. FIG. 6 is a diagram for describing a similarity calculation method in a camouflage determination unit according to Embodiment 1. FIG. 6 is a diagram for describing a similarity calculation method in a camouflage determination unit according to Embodiment 1. FIG. It is a figure which shows the structure of the terminal in Embodiment 2, and the connection with a database. 10 is a flowchart for explaining an operation in the second embodiment. It is a figure which shows the example of the character string which characterizes URL of the famous site which compares in Embodiment 2, and the domain of URL of the site which determines the presence or absence of impersonation. It is a figure which shows the example of being able to register the name of a some organization as a name of the organization which manages one famous site specified by URL in Embodiment 2. FIG. It is a figure which shows the structure of the proxy server in Embodiment 3, and the connection with a terminal. FIG. 20 is a diagram illustrating a description example in HTML on a proxy error page in the third embodiment. 10 is a flowchart for illustrating an operation in the fourth embodiment. 10 is a flowchart for illustrating an operation in the fifth embodiment. FIG. 20 is a diagram showing an example in which a URL of a site requesting access and an organization name obtained from a database are displayed on a browser in the fifth embodiment. It is a figure which shows the structure of the terminal in Embodiment 6, and the connection with a database. 18 is a flowchart for explaining an operation in the sixth embodiment. FIG. 10 is a diagram illustrating a hardware configuration when an access prevention apparatus that is a terminal or a proxy server in the first to sixth embodiments is realized by a computer.

Explanation of symbols

  100 user, 101 terminal (access prevention device), 102 browser (input unit / output unit), 103 impersonation determination unit (determination unit), 104 famous site information storage unit (site information storage unit), 105 network access unit, 106 communication Network, 107 database, 1100 user, 1101 terminal, 1102 browser, 1103 communication network, 1104 proxy server (access prevention device), 1105 impersonation determination unit (determination unit), 1106 web proxy server unit (input unit / output unit), 1107 Famous site information storage unit (site information storage unit), 1400 users, 1401 terminal (access prevention device), 1402 E-mail client with HTML display function (input unit / output unit), 1403 Impersonation determination unit (determination unit), 1404 Network access unit, 1405 database, 901 display device, 902 keyboard (K / B), 903 mouse, 904 FDD, 905 CDD, 906 printer device, 907 scanner device, 911 CPU, 912 bus, 913 ROM, 914 RAM, 915 communication Board, 920 magnetic disk device, 921 OS, 922 window system, 923 program group, 924 file group.

Claims (2)

A site information storage unit for storing a regular URL (Uniform Resource Locator) composed of a plurality of characters as information on a regular site of a communication network;
An input unit for inputting a comparison target URL composed of a plurality of characters as information on a site accessed by a user via a communication network;
The similarity value of the character in the row and the character in the column is such that the similarity value representing the similarity increases as the similarity between the character in the row and the character in the column increases as each character of the plurality of characters is arranged in a row and a column. Is a determination unit including a matrix for storing in advance as a matrix element,
A regular URL composed of a plurality of characters is input from the site information storage unit, and it is determined whether or not the regular URL composed of a plurality of characters input matches a comparison target URL composed of a plurality of characters input by the input unit. and, if it is determined that the compared URL regular URL does not match, the URL from among the similarity values stored as elements of a matrix to the matrix, a comparison target URL the regular URL of the input unit inputs The similarity value between the plurality of characters is acquired, the similarity between the regular URL and the comparison target URL is calculated based on the acquired similarity value between the plurality of characters, and the calculated normal URL and the comparison target URL When it is determined whether the similarity exceeds a predetermined threshold and it is determined that the calculated similarity exceeds a predetermined threshold, the comparison target URL does not completely match the regular URL A determining section for outputting a determination result indicating a high similarity to regular URL of the comparison URL,
An access prevention apparatus comprising: an output unit that generates and outputs warning information that warns the determination result when the determination unit outputs the determination result. The determination unit
A grid graph having a plurality of grids in which the horizontal direction is the number of characters of the regular URL and the vertical direction is the number of characters of the comparison target URL is generated, the upper left corner of the generated grid graph is the start point, and the lower right corner is the end point. Assigning each character of the regular URL in the horizontal direction of the graph, assigning each character of the URL to be compared in the vertical direction of the grid graph,
For each grid of all grids in the grid graph, a horizontal path is generated in the horizontal direction from the upper left of the grid, a value of 0 or less is set for the generated horizontal path, and from the upper left of the grid generates a vertical path in a vertical direction, resulting set to 0 following values for the vertical path, to generate a diagonal path from the upper left of the grid to the lower right, is stored as an element of the matrix to the matrix similarity values Obtaining a similarity value between a horizontal character and a vertical character of the grid, and setting the obtained similarity value for the diagonal path,
After generating a horizontal path, a vertical path, and a diagonal path for all grids, an end point is generated from the starting point of the grid graph via one or more of a horizontal path, a vertical path, and a diagonal path. A route that leads to the route, and a route that maximizes the sum total of the values set for any one or more of the horizontal route, the vertical route, and the diagonal route,
2. The access prevention apparatus according to claim 1, wherein a quotient is obtained by dividing the total value of the obtained route routes by the number of characters of the regular URL, and the obtained quotient is set as a similarity between the regular URL and the comparison target URL.

Images