KR100693842B1 - Fishing-preventing method and computer-readable recording medium where computer program for preventing phishing is recorded - Google Patents

Abstract

A method for preventing phishing and a computer-readable recording medium storing a phishing prevention program are provided to conveniently prevent leakage of personal information through the phishing by determining whether or not a linked site is an illegal phishing site when a receiver tries to connect to the linked site by clicking a link included in an email. In case that a request for connecting to the link included in the email is received, words are recognized and extracted from contents of the email(210). Normal URLs(Uniform Resource Locator) having misunderstanding probability are extracted based on the extracted words(215). A list of the extracted URLs is displayed to the user(220). The list selected from the displayed normal URL list is received from the user(225). The selected URL list is compared with the URLs of the link included in the email(230).

Description

Fishing-Preventing Method and Computer-Readable Recording Medium Where Computer Program for Preventing Phishing is Recorded}

1 is a diagram for explaining the concept of phishing;

2 is a flow chart of a phishing prevention process performed by the anti-phishing program according to the present invention.

3 is a conceptual diagram of an environment for performing a phishing prevention method according to the present invention.

4 and 5 are a flow chart of a phishing prevention method according to another embodiment of the present invention.

The present invention relates to a computer-readable recording medium having a phishing protection method and a phishing protection program recorded thereon.

Phishing, also known as carding or spoofing, is an illegal method that is commonly used to send e-mail to an unspecified number of people to extract the recipient's personal information. By constructing an e-mail address or the format of a mail message similar to that of a well-known prominent site, it causes the recipient to be mistaken, and if the recipient goes to an illegal site to which the recipient is linked and enters his or her personal information, To obtain personal information.

1 illustrates a diagram for explaining such phishing, and an e-mail message 10 includes sender information 11, an e-mail body 12, and a link 15. The sender information 11 usually contains information similar to the e-mail address of a well-known site. In the drawing illustrated in FIG. 1, the part of the sender's e-mail address except for the ID is "ebey.com", and an example of using an address similar to the world-famous "ebay.com" is illustrated. However, these domain names can be sent by the sender by changing to the famous domain, e.g. "ebay.com". The actual e-mail address can be concealed at a glance by having only the sender's name displayed as "eBay Customer Support." The e-mail body 12 is usually marked with text that allows the recipient to enter personal information. For example, the phrase "You need to update your personal information in order to receive new value-added services. Please click the link below and enter your personal information."

The link 15 includes link information for linking phishing sites. The e-mail sent by eBay misleads and clicks the link 12 to immediately display the page 12 of the phishing site, and the personal information field 25 is provided on the page 12 of the phishing site. Recipients who are already mistaken for e-mail sent by eBay, a prominent site, will be informed to the phishing site without any doubt by entering their personal information into the personal information input box 25.

Recently, financial information and personal information of individuals have been leaked through such phishing sites, and this information is illegally used to cause damages. Various attempts have been made to prevent this. One way to do this is to install a toolbar in a web browser, and when toolbar users around the world report phishing, record the phishing information in a toolbar provider's database so that other users can no longer use the phishing site. There are ways to prevent phishing damage. However, this method was limited to phishing only after someone reported phishing, and there are several toolbar providers that provide toolbars. If the phishing information is not shared, the user of the toolbar installed in his web browser is notified. There was a natural limit to the damage that could be prevented by only one phishing site.

Another method for preventing phishing is the method disclosed in US Patent Application Publication 2005 / 0086161A1. In this method, a suspicious attempt is made to obtain financial data after building a database that stores invalid financial data in a bank or financial institution, creating a bait website that discloses the stored invalid financial data. It discloses a method of disclosing this invalid financial data to a person who conducts the transaction and if it detects that he or she is attempting a financial transaction using the disclosed financial data. However, although the phishing prevention method can prevent phishing indirectly through the above-described methods, there are still limitations in terms of the efficiency of phishing prevention, and there are inconveniences in that a financial institution must have a system.

As another anti-phishing technique, an anti-spam filtering technique of e-mail disclosed in US Pat. No. 6,732,157 is disclosed. However, spam filtering still has the disadvantage of unfairly filtering even the e-mails that should be received. The spam filtering function still has inconvenience for users. Still confused, there is a problem that there is a risk of entering personal information into a phishing site.

Other anti-phishing methods currently in use include: www.microsoft.com/mscorp/twc/privacy/spamsenderid.mspx, http://antispam.yahoo.com/domainkeys, www.wholesecurity. com, etc., this method has a limitation in that a phishing attack is still possible if the mail server needs to be changed and a phishing attacker sends a disguised message according to the method proposed above.

And in http://cups.cs.cmu.edu/soups/2005/2005proceedings/p77-dhamija.pdf, the user will be asked to select a background image that is difficult to deceive by web server and only enter a password if the background image is shown. An anti-phishing method is disclosed. However, even with this method, there is a limit on the number of background images that can be effectively distinguished by the user, which is not suitable for many websites.

www.mfn.org/~herzbea/Papers/ecommerce/trusted credential area.pdf includes a web browser that authenticates the web server with an SSL certificate and allows the user to recognize the web server through the logo of the website combined with the SSL certificate. A method is disclosed. However, this method is not applicable when SSL is not used, and there is a limit to the greater risk if the certification authority sets the relationship between the specific logo and the certificate subject differently.

It is an object of the present invention to solve such problems of the prior art and to provide a computer readable recording medium on which an anti-phishing program is recorded, which effectively and safely prevents phishing, and which does not cause inconvenience to a user, and a method for preventing such phishing.

According to the present invention, a method for preventing phishing through e-mail includes: (1) extracting a recognized word from contents of the e-mail when a link connection request included in the e-mail is present; Extracting a normal URL that is likely to be misleading based on the extracted recognition word, (3) displaying a list of the extracted normal UELs, and (4) a user among the displayed list of normal UELs Receiving a list selected by the user; and (5) comparing the received selection list with the URL of the link included in the e-mail.

According to the present invention, by extracting the recognition word included in the e-mail and extracting the normal UAL based on this and providing this list to the e-mail recipient, it is possible to remind the recipients, once again phishing mail Phishing can be prevented by being able to check whether or not it is. In other words, by comparing the URLs selected by the recipient among the regular URLs and the URLs of the links included in the actual e-mail, if they are different, the phishing can be effectively prevented by classifying them as e-mails with phishing suspicion.

Such a phishing method is performed by a computer program, and the present invention also relates to a computer readable recording medium having such a program recorded thereon.

The extracting of the normal URL may be performed using a web search application program interface (API) using the extracted recognition word. In other words, the recognition word is entered into a search site, for example, www.google.com or www.naver.com, to extract a normal URL. In other words, when the recognition word is entered into the search portal site, the sites displayed as the search results are well-known to the top, and the normal UALs of the well-known sites can be extracted.

According to a preferred embodiment of the present invention, the anti-phishing method further includes the step of recording the recognition word and the selection URL in the database if the selection URL is identical to the URL of the selection URL. In other words, if the link UAL included in the link is normal, it is recorded in the database so that the phishing prevention process is not performed when linking again in the future, so that it is not troublesome.

According to a preferred embodiment of the present invention, the extracting of the recognition word may include extracting at least one of a hypertext included in the e-mail, a high frequency string, and a sender domain of the e-mail. . In general phishing mails, recognition information is extracted using hypertext, a string that frequently appears in an e-mail message, and a string that causes the recipient to be misunderstood in the domain of the e-mail sender.

On the other hand, the database is preferably composed of a tuple (tuple). This makes it possible to find the normal UAL without configuring the recognition word and the link UAL or the selection UAL as a tuple without having to operate the search engine again when an e-mail containing the same recognition word is received again.

According to another embodiment of the present invention, the phishing prevention method includes the steps of: (1) extracting a recognition word for an e-mail including a link URL (URL) when receiving the e-mail, and (2) the extracted Extracting a normal URL that is likely to be mistaken based on a recognized word, (3) comparing the extracted normal URL with a link URL, and (4) if there is no normal URL that matches the link URL Classifying the e-mail as suspicious e-mail, and (5) generating a predetermined output to warn that the e-mail is suspicious if there is a link connection request included in the e-mail classified as suspicious e-mail. It may also include.

According to this embodiment, since the phishing e-mail is classified in advance in the e-mail receiving step, the user does not have to go through the phishing e-mail detection process every time the user clicks the link, thereby reducing the user's inconvenience.

Hereinafter, with reference to the accompanying drawings will be described in detail a preferred embodiment of the present invention.

3 shows an example of an environment in which a phishing prevention method according to the present invention is performed. As shown, this environment includes a phishing attack detection module 100, a mail client 300, a recognition database (URL) 150, and a user 350.

Conceptually, the phishing attack detection module 100 is located between the mail client 300 and the link site 20, even if the recipient clicks the link 15 included in the e-mail 10. Do not connect and go through a predetermined phishing detection process to be described later. Phishing attack detection module 100 may be included in the mail client 300 in the form of an add-on (add-on), it may take the form of a separate program linked to the mail client (300).

The recognition UAL database 150 is a place where normal UAL information determined as a normal site is recorded, as will be described later. The information recorded in the normal UEL is recognized as a normal link site when an e-mail comes later and the recipient clicks the link, so the phishing attack detection module 100 provides the user 350 with a list of possible UELs, and the user 350 Among them, the UAL selected by the user is provided to the evacuation attack detection module 100.

2 is a flowchart illustrating a phishing mail detection process according to the present invention according to the present invention.

In step 200, the user 350 who receives the e-mail clicks the link 15 included in the e-mail message 10 to determine whether there is a link site access request. If there is no link connection request, the phishing prevention method according to the present invention is not performed. If there is a link site connection request by clicking on the link 15, the process proceeds to step 205 to determine whether it is a normal link site recorded in the database 150. Previously, the UAL, which is determined to be a normal UAL while undergoing a phishing prevention process according to the present invention, is recorded in the recognition UAL database 150. If the UAL is recorded as such, the step 270 is immediately performed without going through a phishing detection process according to the present invention. ), The web browser is invoked and the page of the link site 20 is displayed.

If the UEL is not recorded in the recognition UEL database 150, the process proceeds to step 210. In step 210, the recognition word is extracted from the e-mail message 10. Recognition word extraction is performed using the recognition word extraction function. By recognition word is meant a word that the recipient from the e-mail message 10 would misunderstand as a "normal" e-mail. Since phishing mail is presumed to be an e-mail sent from a well-known website, the hypertext included in the body 12 of the e-mail message 10, the words frequently appearing in the body 12, and the sender information ( 11) etc., it is possible to extract a character string that the user 350 may misunderstand. The inventors of the present invention consider that it is advantageous to extract the recognition word based on the hypertext among them, but it is possible to use a variety of algorithms for extracting the recognition word, and such an algorithm "self" has the features of the present invention. It is not granted.

For convenience of explanation, hereinafter, it will be described assuming the following situation. The site that the phishing e-mailer wants to misunderstand is "www.ebay.com", and the phishing site that is accessed when the user clicks the link 15 of the phishing e-mail 10 is "www.ebey.com." Assume

It is assumed that the e-mail message 10 includes www.ebay.com as a hypertext, and the text 12 is interspersed with the string "ebay".

In this situation, the recognition word extracted in step 210 becomes "ebay".

Next, the process proceeds to step 215 to extract a normal UAL that is likely to be mistaken based on the extracted recognition word "ebay". The process of extracting the normal UAL may be performed using a web search application program interface (API) using the extracted recognition word “ebay”. However, this normal UEL extraction method can be variously implemented by those skilled in the art after reading the present specification.

When the normal UAL is extracted based on the recognition word “ebay” extracted in step 210, www.ebay.com, www.ebay.co.uk, www.ebay.ca, and the like are extracted. In step 220, the normal UAL list is displayed and provided to the user 350. When the list of normal UELs is displayed, the user 350 selects the normal UELs which he believes to be recognized.

The phishing attack detection module 100 that receives the recognition UAL selected by the user 350 compares the input recognition UEL with the UAL included in the link 15 of the e-mail message 10. If the e-mail message 10 was sent by a phishing attacker, the URL included in the link 15 would be the URL of the phishing site.

In step 235, the phishing attack detection module 100 determines whether the recognition URLs received from the user 350 and the link URLs are the same, and if they are determined to be the same, the link URLs included in the link 15 are phishing. If it is determined that it is not a site, a web browser is called to link to the link site 20 and display the link site 20 page (step 240). The recognition word is recorded in the recognition UAL database 150, and the phishing detection process ends. The database for recording the recognition words and the link URL and / or the selection URL is preferably configured as a tuple.

If it is determined in step 235 that the link URL and the input input selected by the user are not the same, the flow proceeds to step 250 to display a phishing warning text and refuse to connect to the link site 20. In step 255, a user forced connection option button is displayed. This is to allow the user 350 to forcibly connect to the link site when the link site is considered normal despite the above process. If there is a user forced connection command in step 260, a web browser is called to connect to the link site 20 and display a web page. However, the user forced connection process is not essential to the present invention.

4 and 5 show flowcharts of a phishing detection process according to another embodiment of the present invention. In this embodiment, the phishing e-mail is classified in advance when the e-mail is received, and the phishing e-mail does not need to be performed every time the user 350 clicks the link 15 included in the e-mail message. It is about how to detect phishing only for suspected mail.

Upon receiving the e-mail (step 400), the phishing attack detection module 100 determines whether the link message is included in the e-mail message (step 405). It determines that there is little possibility and terminates, and performs phishing suspicious e-mail classification process only on e-mail messages that contain link URL.

In step 410, it is determined whether the link URL is the URL stored in the recognition URL database 150. If the existing link is found to be a normal URL, and is recorded in the database 150, the reception procedure is terminated.

If the e-mail is not recorded in the recognition UEL database 150, the recognition word is extracted from the e-mail message. (Step 415) The method of extracting the recognition word is similar to that described above with reference to FIG. . Based on the extracted recognition word, a normal UAL that is likely to be mistaken is extracted in step 420, and the extracted normal UEL and the link UEL are compared in step 425. In step 430, it is determined whether any of the normal UALs match the link UELs. If it is found that there is no normal UAL that matches the link UEL, the process proceeds to step 445 to store the normal UEL and the link UEL. The normal URL and the link URL are preferably recorded in association with the corresponding e-mail message. On the other hand, if it is found that there is a normal UAL matching the link UAL, the link UAL and the recognition word is recorded in the recognition UAL database 150 and the process ends.

In the e-mail message receiving step, the phishing suspicious e-mail is classified in this manner, thereby reducing the user's inconvenience.

After the phishing suspicious e-mail is classified through the process of FIG. 4, a flowchart of a case in which the user actually opens the e-mail message and moves to the link site is shown in FIG. 5.

If there is a link connection request of the e-mail message (step 500), it is determined in step 505 whether the e-mail has been classified as a phishing suspicious e-mail. If it is not the phishing suspicious e-mail, the flow advances to step 540 to invoke a web browser to link the link site. In this way, the link site may be directly connected, and before the step 540, the link site is connected only when the link is recorded in the recognition UAL database 150 by determining whether the link is the URL recorded in the recognition UAL database 150. You can also make sure you're missing out on phishing classification.

If it is determined in step 505 that the e-mail classified as suspicious phishing e-mail, in step 510 a warning message warning that the phishing suspicious e-mail is displayed, and the connection to the link site is rejected. However, in step 515 it is desirable to have a device that displays a forced connection option button to allow the user to force a connection. If it is determined in step 520 that there is a forced connection, the flow advances to step 525 to forcibly connect the link site and display a web page.

The antiphishing method according to the present invention described above can be performed by a computer program, and a computer readable recording medium on which such a computer program is recorded is included in the scope of the present invention.

Although the preferred embodiments of the present invention have been described above with reference to the accompanying drawings, the scope of the present invention is defined by the appended claims and should not be construed as limited to the accompanying drawings and / or the embodiments described above. In addition, improvements, changes, and / or modifications apparent to those skilled in the art of the invention described in the claims are included in the scope of the present invention.

According to the present invention, when a recipient clicks on a link included in an e-mail message and attempts to connect to the link site, it is possible to determine whether the link site is an illegal phishing site, and thus, it is convenient to leak personal information through phishing. The effect is prevented.

Claims (8)

Claims [1] A computer readable recording medium having recorded thereon a program for performing a method of preventing phishing through e-mail. The phishing prevention method, Extracting a recognized word from contents of the e-mail when a link connection request included in the e-mail is requested; Extracting a normal URL that is likely to be mistaken based on the extracted recognition word; Displaying a list of the extracted normal UELs; Receiving a list selected by the user from the list of normal UALs displayed above; Comparing the received selection of the URL list and the URL of the link included in the e-mail, A computer-readable recording medium having recorded thereon a program for performing phishing prevention method through e-mail. The method according to claim 1, The extracting of the normal UAL is performed by using a web search application program interface (API) using the extracted recognition word. A computer-readable recording medium having recorded thereon a program for performing phishing prevention method through e-mail. The method according to claim 1 or 2, If the selection of the selection URL and the link of the URL is the same, further comprising the step of recording the selection URL and the recognition word in the database, A computer-readable recording medium having recorded thereon a program for performing phishing prevention method through e-mail. The method according to claim 1 or 2, Extracting a recognition word is a step of extracting at least one of the hypertext included in the e-mail, a high frequency string, and the sender domain of the e-mail. A computer-readable recording medium having recorded thereon a program for performing phishing prevention method through e-mail. The method according to claim 3, The database consists of tuples, A computer-readable recording medium having recorded thereon a program for performing phishing prevention method through e-mail. In a method for preventing phishing through e-mail, The phishing prevention method, Extracting a recognized word from contents of the e-mail when a link connection request included in the e-mail is requested; Extracting a normal URL that is likely to be mistaken based on the extracted recognition word; Displaying a list of the extracted normal UELs; Receiving a list selected by the user from the list of normal UALs displayed above; Comparing the received selection of the URL list and the URL of the link included in the e-mail, How to prevent phishing via e-mail. Claims [1] A computer readable recording medium having recorded thereon a program for performing a method of preventing phishing through e-mail. The phishing prevention method, Extracting a recognition word for an e-mail including a link URL when receiving the e-mail; Extracting a normal URL that is likely to be mistaken based on the extracted recognition word; Comparing the extracted normal UAl and the link UEL; If no regular URLs match the link URL, classify the email as suspect phishing emails; Generating a predetermined output warning of a suspected phishing e-mail when a link connection request included in the e-mail classified as suspicious e-mail is included. A computer-readable recording medium having recorded thereon a program for performing phishing prevention method through e-mail. In the anti-phishing method through e-mail, Extracting a recognition word for an e-mail including a link URL when receiving the e-mail; Extracting a normal URL that is likely to be mistaken based on the extracted recognition word; Comparing the extracted normal UAl and the link UEL; If no regular URLs match the link URL, classify the email as suspect phishing emails; Generating a predetermined output warning of a suspected phishing e-mail when a link connection request included in the e-mail classified as suspicious e-mail is included. How to prevent phishing by email.

Images