KR101473671B1 - Method and apparatus for detection of phishing site by image comparison - Google Patents

Abstract

The present invention relates to a method and apparatus for detecting a phishing site by image comparison. According to an embodiment of the present invention, a method for detecting a phishing site comprises the steps of: loading phishing detection standard information for detecting a phishing site; extracting information on images to be compared from a site to be detected based on the phishing detection standard information; comparing the extracted information on images to be compared with information on reference images of a protection site included in the phishing detection standard information; and warning of the result of the phishing site detection when the site to be detected is determined as a suspicious phishing site depending on the result of the comparison. Therefore, a phishing site may be detected and access thereto may be prevented without cooperation with a host managing a site to be detected, and access to a phishing site may be detected or prevented even by independent processing of a communication terminal device using a site to be detected.

Description

[0001] METHOD AND APPARATUS FOR DETECTION OF PHISHING SITE BY IMAGE COMPARISON [

The present invention relates to a phishing site detection method and apparatus. More particularly, the present invention relates to an apparatus and a method for detecting a phishing site through image comparison in which a phishing site is identified and alerted based on image information extracted from a site to be detected.

Recently, the spread of communication terminal devices that perform smartphone functions by applying mobile operating systems such as Android, i-OS (Operating System) and Windows mobile has been activated.

In the communication terminal apparatus using the mobile operating system, various application programs are executed based on the corresponding mobile operating system to provide various information processing services to the user.

A communication terminal device to which a mobile operating system is applied is provided with a browser as an application program and executes the corresponding browser and accesses the Internet web site based on the URL to provide information of various web sites to the user.

A communication terminal device using such a mobile operating system often tries to access a communication based on a URL that is entered when executing an application program to receive a text message, receive a multimedia message, receive an e-mail, or perform a content transaction.

However, since the communication connection based on the received URL does not confirm the harmfulness of the connection destination site, it may happen that the communication connection is intact to the harmful site such as the phishing site, the indecent site at home and abroad, and the gambling site.

Especially, access to phishing sites leads to financial crime. For example, when the text message contains URL information that leads to access to a phishing site disguised as a financial institution, the communication terminal apparatus can be easily connected to the phishing site in accordance with the URL information. In accordance with the guidance of the phishing site, Financial crime occurs.

According to a conventional method for preventing access to a phishing site, personalized multimedia data combining an auditory melody and a visual image is transmitted to a normal site, thereby preventing a phishing site from imitating personalized multimedia data of a normal site, Allows phishing sites to be distinguished from normal sites.

However, in the related art, a site management server or the like, which operates a normal site, must receive and reproduce personalized multimedia data. That is, there has been a problem that the connection of the phishing site can be prevented only through cooperation with the subject who operates the normal site. Therefore, the connection of the phishing site can not be detected or prevented by the single processing of the communication terminal apparatus using the site.

Korean Registered Patent Publication No. 1,134,115, registered on March 30, 2012.

According to the embodiment of the present invention, a phishing site is identified and alerted according to image information extracted from the site to be detected, so that the phishing site can be detected or the connection can be prevented even if there is no cooperation with a principal operating the site to be detected.

The problems to be solved by the present invention are not limited to those mentioned above, and another problem to be solved can be clearly understood by those skilled in the art from the following description.

According to an aspect of the present invention, a method for detecting a phishing site through image comparison includes loading phishing detection criteria information for detecting a phishing site, comparing the phishing detection criterion information with the comparison target image information Comparing the extracted comparison image information with reference image information of a protection site included in the phishing detection criterion information, determining that the detection target site is a phishing concern site And alerting the phishing site detection result.

The method includes the steps of: acquiring connection location information of a site requested to be connected; loading a pre-stored detection reference site list; determining the detection target site based on a result of comparing the connection location information and the detection reference site list The method comprising the steps of:

The phishing detection reference information may further include comparison method information between the reference image information and the comparison image information.

The phishing detection reference information may include reference image information of the protection site and image extraction range information for extracting the comparison target image information. In addition, the plurality of protection sites may include the respective phishing detection reference information, can do.

The phishing detection reference information may include a similarity reference value for identifying the phishing site, and the extracting step may be repeatedly performed within an image extraction range based on the image extraction range information, Extracting the image information, and comparing the plurality of comparison object image information with the reference image information according to the comparison method information, thereby calculating an error value over a plurality of times.

The warning step may identify the phishing site of concern based on the comparison result between the smallest error value among the calculated error values and the similarity reference value.

In addition, the reference image information of the protection site can be extracted and collected in advance when the plurality of pages constituting the protection site are sequentially displayed on the same screen.

According to another aspect of the present invention, there is provided an apparatus for detecting a phishing site through image comparison, comprising: detection information providing means for providing phishing detection reference information for detection of a phishing site; An image comparison unit for extracting target image information and comparing the extracted comparison image information with reference image information of a protection site included in the phishing detection reference information; And a phishing alarm unit that alerts the result of the phishing site detection if it is determined to be a site.

Here, an object discrimination unit for acquiring connection position information of a site requested to be connected, loading a pre-stored detection reference site list, and determining the detection target site according to a result of comparing the connection position information and the detection reference site list .

The phishing detection reference information may further include comparison method information between the reference image information and the comparison image information.

The phishing detection reference information may include reference image information of the protection site and image extraction range information for extracting the comparison target image information. In addition, the plurality of protection sites may include the respective phishing detection reference information, can do.

The phishing detection reference information may include a similarity reference value for identifying the phishing site, and the image comparison unit may repeatedly perform the extraction of the comparison target image within the image extraction range based on the image extraction range information Extracting a plurality of comparison object image information, and comparing the plurality of comparison object image information and the reference image information according to the comparison method information, thereby calculating an error value over a plurality of times.

In addition, the phishing warning unit can identify the phishing concern site according to a result of comparison between the smallest error value among the calculated error values and the similarity reference value.

In addition, the reference image information of the protection site can be extracted and collected in advance when the plurality of pages constituting the protection site are sequentially displayed on the same screen.

According to the embodiment of the present invention, a phishing site is identified and alerted according to image information extracted from the site to be detected, so that phishing sites can be detected or connection can be prevented even if there is no cooperation with a principal operating the site to be detected .

Therefore, there is an effect that the connection of the phishing site can be detected or prevented even by a single processing of the communication terminal apparatus using the detection target site.

1 is a network configuration diagram of a phishing site access prevention system to which a phishing site detection apparatus according to an embodiment of the present invention is applied.
2 is a detailed block diagram of a phishing site detection apparatus according to an embodiment of the present invention.
3 is a flowchart illustrating a method of detecting a phishing site according to an embodiment of the present invention.
4A to 4D are exemplary views of a connection screen for explaining a process of extracting reference image information from a protection site.
FIG. 5 is a block diagram of a connection screen in which sections for comparing images are distinguished by a method of detecting a phishing site according to an embodiment of the present invention. FIG.
FIG. 6 is a graph illustrating a process of comparing an error, which is a result of image comparison, with a reference value of similarity when a phishing site is detected according to the method of detecting a phishing site according to an embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention and the manner of achieving them will become apparent with reference to the embodiments described in detail below with reference to the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. To fully disclose the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims. Like reference numerals refer to like elements throughout the specification.

In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. The following terms are defined in consideration of the functions in the embodiments of the present invention, which may vary depending on the intention of the user, the intention or the custom of the operator. Therefore, the definition should be based on the contents throughout this specification.

1 is a network configuration diagram of a phishing site access prevention system to which a phishing site detection apparatus according to an embodiment of the present invention is applied.

As shown in the figure, the phishing site access prevention system includes a communication terminal device 10, a communication network 20, site operation servers 31 and 33, a phishing site detection server 200, and the like, on which the phishing site detection device 100 is installed .

The communication terminal device 10 is a smart device on which a mobile operating system such as Android, i-OS, and Windows mobile is installed and can access various sites through the communication network 20. [ For example, a smart phone, a tablet PC, or the like.

The site management servers 31 and 33 are entities operating a site capable of providing various information and images to the communication terminal apparatus 10 connected via the communication network 20. [ When the site servers 31 and 33 are maliciously operated, a phishing site disguised as a financial institution may be operated to induce the connection of the communication terminal apparatus 10. [ Here, # 1 and #N are listed in the site management servers 31 and 33, which indicates that a plurality of site management servers other than the two shown can be operated.

The phishing site detection device 100 identifies and alerts the user of the site of phishing concern according to the result of comparison between the comparison image information extracted from the detection site operated by the site operation servers 31 and 33 and the reference image information. The detailed components of the phishing site detection apparatus 100 will be described with reference to FIG.

The phishing site detection server 200 detects a phishing site from among the sites operated by the site operation servers 31 and 33 or other site operation servers, And provides the collected reference image information to the phishing site detection apparatus 100 mounted on the communication terminal apparatus 10. [

2 is a detailed block diagram of a phishing site detection apparatus according to an embodiment of the present invention.

The phishing site detection apparatus 100 includes a detection information providing unit 110, an object determining unit 120, an image comparing unit 130, a phishing alarm unit 140, and the like.

The detection information providing unit 110 provides phishing detection reference information for detecting a phishing site.

The object determining unit 120 obtains connection location information of a site requested to be connected, loads a pre-stored detection reference site list, and determines a detection target site according to a result of comparing the connection location information and the detection reference site list.

The image comparison unit 130 extracts the comparison object image information from the detection target site based on the phishing detection reference information, compares the extracted comparison image information with the reference image information of the protection site included in the phishing detection reference information, Lt; / RTI >

Here, the plurality of protection sites each have individual phishing detection reference information, the phishing detection reference information includes image extraction range information for extracting comparison image information of the detection target site, a comparison method of reference image information and comparison image information Information, a similarity standard value for discrimination of phishing concern sites, and the like. Accordingly, the image comparing unit 130 may calculate the error by comparing the reference image information and the comparison image information according to the comparison scheme information included in the phishing detection reference information.

In addition, the image comparing unit 130 may extract a plurality of comparison object image information by repeatedly extracting the comparison object image within the image extraction range based on the image extraction range information included in the phishing detection reference information, The plurality of comparison object image information and the reference image information may be compared according to the comparison method information included in the detection reference information, and the error value may be calculated over a plurality of times.

The phishing warning unit 140 alerts the phishing site detection result if the detection target site is determined as a site of concern for phishing based on the result of the image comparison by the image comparison unit 130. [ The phishing warning unit 140 can identify a site of concern about phishing according to the result of comparison between the error calculated by the image comparing unit 130 and the similarity reference value included in the phishing detection reference information. The phishing alarm unit 140 can identify a site of concern about phishing according to the result of comparison between the smallest error value and the similarity reference value among the error values calculated by the image comparison unit 130.

3 is a flowchart illustrating a method of detecting a phishing site according to an embodiment of the present invention.

As described above, the method of detecting a phishing site of the present invention collects reference image information of a protection site to be protected from phishing behavior and generates reference image information, image extraction range information for extracting comparison image information of the detection target site, (S301, S303) storing phishing detection reference information including comparison method information of image information and comparison image information, a similarity reference value for discrimination of a phishing concern site, and the like.

(S305 to S313) of obtaining connection location information of a site requested to be connected, loading a pre-stored detection reference site list, and determining a detection target site according to a result of comparing the connection location information and the detection reference site list, .

(S315) of loading phishing detection reference information for detecting a phishing site, extracting comparison image information from the detection target site based on the phishing detection reference information (S317), comparing the extracted information from the detection target site And comparing the target image information with the reference image information of the protection site included in the phishing detection reference information (S319).

The method further includes the step (S321 to S325) of alerting the detection result of the phishing site if the detection target site is determined to be a site of phishing concern according to the result of the comparison of the comparison image information and the reference image information.

The method of detecting a phishing site according to an embodiment of the present invention can be fully understood from the following description with reference to Figs.

Hereinafter, a process of detecting and alarming a site of phishing concern in the phishing site access prevention system according to an embodiment of the present invention will be described in detail with reference to FIG. 1 to FIG.

First, the phishing site detection server 200 collects reference image information of a protection site to be protected from phishing. To this end, the phishing site detection server 200 accesses a site to be protected from phishing behavior among the sites operated by the site operation servers 31 and 33 or other site operation servers, and accesses a plurality of pages . Then, the superimposed image information included in each page is extracted from the images included in the viewed pages, and the extracted superimposed image information is collected as reference image information of the corresponding site (S301).

Referring to Figs. 4A to 4D, when " http://shop.ahnlab.com " is a protection site, the main page of Fig. 4A is first browsed and the sub pages of Figs. 4B and 4C are sequentially browsed. When sequentially displaying the plurality of pages on the same screen, FIG. 4D, which is superimposed image information, is collected as reference image information of the corresponding protection site. Typically, most sites contain image information such as logos and the like in a position that does not change for each page, and the phishing site borrows the image as it is and makes the users mistaken as a normal site. Accordingly, in the embodiment of the present invention, the reference image information of the protection site is collected and utilized for detecting the site of concern about the phishing.

The phishing site detection server 200 collects the reference image information of the protection site and provides the same to the communication terminal apparatus 10 and the detection information providing unit 110 of the phishing site detection apparatus 100 installed in the communication terminal apparatus 10 Stores the phishing detection reference information including the reference image information (S303).

Here, the phishing detection reference information stored by the detection information providing unit 110 further includes image extraction range information of the detection target site, image comparison scheme information, a similarity reference value for discrimination of a phishing concern site, and the like. The individual pieces of information included in the phishing detection reference information will be described below in the appropriate places.

The phishing site detection apparatus 100 may operate in a standalone manner in which phishing detection information is not provided from the phishing site detection server 200 and the detection reference information is stored in advance .

When the phishing site detection apparatus 100 starts the phishing site detection (S305) and the site connection is attempted by the communication terminal apparatus 10 (S307), the object discrimination unit 120 of the phishing site detection apparatus 100 (S309), loads a pre-stored detection reference site list (S311), and determines a detection target site based on a result of comparing the connection location information and the detection reference site list (S313 ).

Here, the detection reference site list may include connection site information of a normal site or a phishing site. For example, it is not necessary to determine again whether the site is identified as a normal site or a phishing site by the already performed phishing site detection process. That is, the object determining unit 120 can determine only the site having the connection location information not included in the detection reference site list as the detection target site. Here, the connection location information may use URL information or IP address information corresponding thereto.

When the target discriminating unit 120 discriminates the site to be detected, the image comparing unit 130 of the phishing site detecting apparatus 100 loads the phishing detection criterion information from the detection information providing unit 110 at step S315.

Subsequently, the image comparing unit 130 extracts comparison target image information having the same size as the reference image information at a predetermined position on the screen of the detection target site according to the image extraction range information included in the phishing detection reference information (S317) The comparison target image information extracted from the detection target site is compared with the reference image information to calculate an error (S319). This image information extraction and error calculation process is repeatedly performed within the image extraction range included in the phishing detection reference information. For example, an error can be calculated by comparing the image extraction position with the reference image information while changing the image extraction position in units of a set number of pixels. The image comparator 130 provides the phishing alarm unit 140 with the smallest error value among the error values calculated several times.

At this time, since the image comparing unit 130 extracts image information for image comparison from a specific segment of the connection screen based on the image extraction range information included in the phishing detection reference information, The error calculation process can be completed more quickly. For example, if the screen segment 401 is included in the phishing detection reference information as the image extraction range information among the plurality of screen segments 401 to 406 constituting the connection screen 400 illustrated in FIG. 5, Extracts the comparison object image information only for the screen segment 401 of the connection screen 400 without extracting the comparison object image information on the entire connection screen 400. [ Accordingly, the image information extraction and comparison process can be finished within a shorter time by relatively fewer calculation processes as compared with extracting the image information with respect to the entire connection screen 400.

In addition, the comparison method information included in the phishing detection reference information is used when the image comparing unit 130 compares the comparison target image information extracted from the detection target site with the reference image information. For example, the image comparing unit 130 compares the images by comparing the color difference values of the pixel units on the basis of the comparison scheme information included in the phishing detection reference information, and compares the histograms representing the color distributions of the horizontal axis and the vertical axis (S321). ≪ / RTI >

Here, in order to shorten the image comparison time, the image comparator 130 first calculates an error with respect to the reference image information by changing the image extraction position in units of predetermined pixels, and when the error value is greater than a preset value It is also possible to calculate the error with respect to the reference image information while changing the image extraction position in units of one pixel only in the low region.

Next, the phishing warning unit 140 of the phishing site detection apparatus 100 determines whether the detection target site is a phishing site, based on the result of the image comparison by the image comparison unit 130. [ Here, the phishing alarm unit 140 can identify a site of concern about phishing according to the result of comparison between the minimum error value calculated by the image comparison unit 130 and the similarity reference value included in the phishing detection reference information.

For example, as shown in the graph of FIG. 6, the minimum error value calculated according to the image comparison of the A site, the B site, and the C site as the detection target sites is compared with the predetermined similarity reference value to the phishing detection reference information, A site having an error value can be identified as a site of phishing concern (S323).

In addition, the phishing alarm unit 140 outputs the detection result of the phishing site through a screen or sound to alert the user or the communication terminal apparatus 10 to output the result of the detection of the phishing site. Accordingly, it is possible to prevent the communication terminal apparatus 10 from accessing the phishing site (S325).

1 to 3, when the phishing site detection server 200 collects reference image information for the protection site and provides the collected image information to the communication terminal apparatus 10, the phishing site detection apparatus 100 detects a site And the alarm is detected. In addition, when the phishing site detection device 100 obtains the connection location information of the detection target site to be accessed by the communication terminal device 10 and provides the information to the phishing site detection server 200, the phishing site detection server 200 It is also possible to provide the communication terminal apparatus 10 with a result of the determination after the phishing site is identified with respect to the site to be detected.

Each block of the accompanying block diagrams and combinations of steps of the flowchart may be performed by computer program instructions. These computer program instructions may be loaded into a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus so that the instructions, which may be executed by a processor of a computer or other programmable data processing apparatus, And means for performing the functions described in each step are created. These computer program instructions may also be stored in a computer usable or computer readable memory capable of directing a computer or other programmable data processing apparatus to implement the functionality in a particular manner so that the computer usable or computer readable memory It is also possible for the instructions stored in the block diagram to produce a manufacturing item containing instruction means for performing the functions described in each block or flowchart of the block diagram. Computer program instructions may also be stored on a computer or other programmable data processing equipment so that a series of operating steps may be performed on a computer or other programmable data processing equipment to create a computer- It is also possible that the instructions that perform the processing equipment provide the steps for executing the functions described in each block of the block diagram and at each step of the flowchart.

Also, each block or each step may represent a module, segment, or portion of code that includes one or more executable instructions for executing the specified logical function (s). It should also be noted that in some alternative embodiments, the functions mentioned in the blocks or steps may occur out of order. For example, two blocks or steps shown in succession may in fact be performed substantially concurrently, or the blocks or steps may sometimes be performed in reverse order according to the corresponding function.

The foregoing description is merely illustrative of the technical idea of the present invention and various changes and modifications may be made by those skilled in the art without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are intended to illustrate rather than limit the scope of the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The scope of protection of the present invention should be construed according to the following claims, and all technical ideas within the scope of equivalents should be construed as falling within the scope of the present invention.

100: Phishing site detection device
110: Detection information providing service
120: object discrimination unit
130:
140: Phishing alarm

Claims (14)

Loading phishing detection criteria information for detection of a phishing site,
Extracting comparison target image information from a detection target site based on the phishing detection reference information,
Comparing the extracted comparison image information with reference image information of a protection site included in the phishing detection reference information,
If the detection site is determined to be a site of concern for phishing according to a result of the comparison,
A method for detecting a phishing site through image comparison comprising:
The method according to claim 1,
Acquiring connection location information of a site requested to be accessed;
Loading a pre-stored detection criteria site list,
Determining a site to be detected based on a result of comparing the connection location information and the detection reference site list
The method comprising the steps of:
The method according to claim 1,
Wherein the phishing detection reference information further includes comparison method information between the reference image information and the comparison object image information
How to detect phishing sites through image comparison.
The method of claim 3,
Wherein the plurality of protection sites have respective phishing detection reference information,
Wherein the phishing detection reference information includes reference image information of the protection site and image extraction range information for extracting the comparison target image information
How to detect phishing sites through image comparison.
5. The method of claim 4,
Wherein the phishing detection reference information includes a similarity reference value for discriminating the phishing concern site,
Wherein the extracting step repeatedly performs the extraction within the image extraction range based on the image extraction range information to extract a plurality of the comparison object image information,
Wherein the comparison step compares the plurality of comparison object image information and the reference image information according to the comparison method information to calculate an error value over a plurality of times
How to detect phishing sites through image comparison.
6. The method of claim 5,
The alarming step determines the phishing site of concern based on the comparison result between the smallest error value among the calculated error values and the similarity reference value
How to detect phishing sites through image comparison.
The method according to claim 1,
The reference image information of the protection site is extracted and collected in advance when the plurality of pages constituting the protection site are sequentially displayed on the same screen
How to detect phishing sites through image comparison.
A detection information providing unit for providing phishing detection reference information for detecting a phishing site,
An image comparison unit for extracting the comparison object image information from the detection target site based on the phishing detection reference information and comparing the extracted comparison image information with the reference image information of the protection site included in the phishing detection reference information,
A phishing warning unit for informing the result of the detection of the phishing site if the detection target site is determined as a site of concern about phishing according to a result of the comparison;
The phishing site detection device comprising:
9. The method of claim 8,
An object determination unit for obtaining the connection location information of the site requested to be connected, loading the pre-stored detection reference site list, and determining the detection target site according to a result of comparing the connection location information and the detection reference site list,
The phishing site detection device further comprising:
9. The method of claim 8,
Wherein the phishing detection reference information further includes comparison method information between the reference image information and the comparison object image information
Phishing site detection through image comparison.
11. The method of claim 10,
Wherein the plurality of protection sites have respective phishing detection reference information,
Wherein the phishing detection reference information includes reference image information of the protection site and image extraction range information for extracting the comparison target image information
Phishing site detection through image comparison.
12. The method of claim 11,
Wherein the phishing detection reference information includes a similarity reference value for discriminating the phishing concern site,
Wherein the image comparison unit repeatedly extracts the comparison object image within an image extraction range by the image extraction range information to extract a plurality of the comparison object image information, The image information is compared with the reference image information to calculate an error value several times
Phishing site detection through image comparison.
13. The method of claim 12,
The phishing warning unit discriminates the phishing site of concern based on a result of comparison between the smallest error value among the calculated error values and the similarity reference value
Phishing site detection through image comparison.
9. The method of claim 8,
The reference image information of the protection site is extracted and collected in advance when the plurality of pages constituting the protection site are sequentially displayed on the same screen
Phishing site detection through image comparison.

Images