KR20090001505A - Phishing prevention method for analyze out domain pattern and media that can record computer program sources for method thereof - Google Patents

Abstract

A method and a program for preventing phishing by detecting a domain pattern for blocking leakage of personal information of a user, and a computer-readable recording medium storing a program thereof are provided to prevent leakage of personal information with warning by extracting a sub domain or directory from a website address through an email and a web browser, and checking whether the domain pattern is found from the sub domain or directory. A web request is received from a user(S110). A sub domain and a sub directory are extracted from a website address of a URL(Uniform Resource Locator) window(S120). It is checked whether a domain pattern is found in the sub domain or directory(S130). A previous step is performed again by replacing the domain pattern with '.'(S150). It is checked whether a registered keyword is found in the sub domain or directory(S160).

Description

Phishing prevention method for analyze out domain pattern and media that can record computer program sources for method approximately}

1 is a flowchart illustrating a phishing prevention step through domain pattern detection according to an embodiment of the present invention.

2 is a diagram illustrating a subdomain and a subdirectory extraction of an Internet address according to an embodiment of the present invention.

3 is a diagram illustrating domain pattern detection of a subdomain and a subdirectory of FIG. 2.

4 is a view showing a phishing warning phrase display in the case of a phishing web site according to an embodiment of the present invention.

* Description of the symbols for the main parts of the drawings *

200: Phishing warning text 210: Forced connection button

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for preventing phishing through domain pattern detection and a computer readable recording medium having a prevention program recorded therein. More particularly, when a user attempts to access a specific website through an e-mail or a web browser. Extracts subdomains and subdirectories from the address of the website you want to connect to and checks if there is a wholesaler pattern in the subdomain or subdirectory to determine if it is a phishing website, and if a phishing website or phishing website exists, The present invention relates to a computer-readable recording medium in which a phishing prevention method and a prevention program are recorded by detecting a domain pattern, which can prevent a user from leaking important information in advance.

For commerce on the Internet, PC users enter and provide information such as account names, passwords, and credit card numbers on the website. The malicious purpose is that the user does not carefully check the site to which the information is provided. Phishing has been repulsed recently, in which a person with an e-mail sent to a user by impersonating a reliable site such as a financial institution or a public institution to provide personal information.

Phishing, also known as carding or spoofing, is an illegal method that is commonly used to steal recipients' personal information by sending an e-mail to an unspecified number of people. By organizing an e-mail address or mail message in a similar way to a well-known and prominent site, it creates a mistake for the recipient, and if the recipient goes to an illegal site to which the link is linked, and enters his or her personal information, it is illegally used. To obtain.

Until now, phishing has been mainly focused on the use of similar urls among URL spoofings. For example, if the real domain is www.kbstar.com or www.kbsta.com or www.kbstar-ebanking.com, this makes it plausible to fish users. In this case, however, the problem is that it is easy to find out who the domain registrant is after phishing is discovered, and it has become a method that hackers do not use frequently in recent years.

Recently, many methods have been used to attack third-party servers, create subdirectories there, and trick users through the names of subdirectories. Basically, a domain is a combination of a top-level domain (eg, '.com', '.com') that represents an organization's type or classification of a country and a second-level domain, a specific administrative entity immediately before the top-level domain. Say that.

For example, if your domain is www.naver.com, '.com' is your top-level domain, 'naver' is your second-level domain, and 'www' is your subdomain. The same is true for http://mail.naver.com. You can create any number of subdomain names before the domain. For example, if you click on a map in Yahoo's 'There' service, you will see http://www.gugi.yahoo.com/map/. Up to Yahoo.com is the name registered in the domain, or an external DNS (domain name server), and kr and gugi are subdomains that answer from DNS within the Yahoo server.

If we assume that abc.com is a relatively unsecured university or small business site, and that a hacker attacked the abc.com's DNS, the hacker could create the subdomain or subdirectory of his choice after the DNS attack.

For example, a hacker created a subdomain called www.kbstar.com.security.ebanking.test.transfer.money. We then set the IP address for that subdomain to be the hacker's. In this case, the pages in www.abc.com and abc.com all have IP of 111.111.111.101, but www.kbstar.com.security.ebanking.test.transfer.money.abc.com is prepared by hacker 111.111.111.102 You will be informed of the page.

The hacker now informs the targets of their link via mail or bulletin board, and the user clicks on it. Then, the URL address window will look like www.kbstar.com.security.ebanking.test.transfer.money.abc.com. A typical user will only see www.kbstar.com and think that it is a real Kookmin bank site. Of course, there is a premise that the page is designed in the same way as Kookmin Bank. However, if you look closely, kbstar.com/ is not like this. It ends with a dot character, such as '.' That means subdomain. In this way, hackers can use abc.com to phish.

The present invention is to solve the problem of the user information leakage by the phishing according to the prior art described above. That is, an object of the present invention is to extract subdomains and subdirectories from a web site address to be accessed when a user attempts to access a specific web site through an e-mail and a web browser, and there is a wholesale pattern in the subdomain or subdirectory. How to prevent phishing through domain pattern detection, which checks whether a phishing website is a phishing website, and proactively warns you if there is a phishing website or a possible phishing website. And a computer readable recording medium having recorded thereon a prevention program.

As a technical idea for achieving the above object, the present invention includes a first step of extracting a subdomain and a subdirectory from a web site address in a URL address window when a user makes a web request; A second step of respectively checking whether a domain pattern exists in the subdomain or subdirectory; A third step of performing the second step again by replacing the dot character with '.' If there is a connection character such as '-' or '_' in the subdomain or subdirectory; And a fourth step of respectively checking whether there is a keyword registered in advance in the subdomain or subdirectory. If any one of the second to fourth steps is applicable, a phishing warning message is displayed and the link site is rejected. The present invention provides a phishing prevention method through domain pattern detection.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a flowchart illustrating a phishing prevention step through domain pattern detection according to an embodiment of the present invention.

First, when a user enters an address on an Internet web site or clicks a link included in an e-mail message to make a web request (S110), the user checks the web site address in the URL address window and checks the web address. Subdomains and subdirectories except for the topmost domain and the second level domain at the end are extracted (S120).

The subdirectory refers to all addresses after the slash based on the first slash '/' in front of the website address, and the subdomain refers to the top-level domain and the second-level domain based on the second slash of the website address. Step All addresses in front of the domain. For example, if you have an internet address of www.kbstar.com.security.ebanking.test.transfer.money.abc.com/input.id.pw.hacker, '.com' is the top-level domain, and 'abc' is It is a two-level domain, 'www.kbstar.com.security.ebanking.test.transfer.money' is a subdomain, and 'input.id.pw.hacker' is a subdirectory.

Accordingly, if the subdomain and the subdirectory are extracted from the address of www.kbstar.com.security.ebanking.test.transfer.money.abc.com/input.id.pw.hacker, the www.kbstar.com. with a subdomain called security.ebanking.test.transfer.money

 A subdirectory called input.id.pw.hacker is extracted.

Subsequently, it is checked whether there is a domain pattern in the subdomain and the subdirectory (S130). Here, the domain pattern refers to a top-level domain representing a classification of an institution such as '.com', '.co.kr', '.go.kr', or '.net' or a classification of a country of affiliation. If a domain pattern exists in the subdomain or subdirectory as shown in FIG. 3, it is determined as a phishing site, and if it is determined as a phishing site, the phishing warning text 200 is displayed as shown in FIG. 4 and the connection to the link site is rejected (S170). ). However, at this time, even though it is determined that the phishing site is a link site for the user to see that the normal link button 210 is additionally displayed, when the user clicks the forced link button 210 (S180) to call the web browser to the link site Connect and display a web page (S190).

Subsequently, if there is a connection character such as '-' or '_' in the subdomain or subdirectory (S140), it is replaced with a dot character that is '.' (S150) and then the domain pattern is checked again (S130). Some of the real phishing examples are www.kbstar-com-test-abc.com. If you have common sense, it's easy to see that www-kbstar-com is not a domain, but it's also the case for users with little knowledge. In this case, replace a link character such as '-' or '_' with a dot character that is '.'. In this case, www-kbstar-com_security is converted to www.kbstar.com.security like this, so you can check whether there is a domain pattern again.

Subsequently, it is checked whether a keyword registered in advance exists in a subdomain or a subdirectory (S160). Existing phishing protection methods were registered by checking domain names, but similar domains were blocked because they were not phishing homepages. For example, if www.jcb.co.jp is opened, a warning message is displayed when similar domains such as www.e_jcb.co.jp and www.ijcb.co.kr are opened. However, if you are a Star.com customer, you will receive a warning when kbstar.com opens, even though the site is not phishing. The present invention analyzes subdomains or subdirectories, not domain names, and checks whether there is a high-phishing keyword registered beforehand to prevent phishing.

In fact, about 130 phishing incidents are filed every month by the Korea Information Security Agency (Kisa), most of which are pages that pretend to be online games, and most of them are cart riders and maple stories. In this case, it's mainly www.maplestrory.com.input.id.pw.hacker.com.

Therefore, register a keyword highly likely to be phished in advance to check whether the keyword exists in a subdomain or subdirectory. As a result of the check, if the keyword exists in the subdomain or subdirectory, the user highlights the keyword so that the user can recognize it, and displays a phishing warning phrase to the user to prevent phishing (S170). The keyword automatically downloads and upgrades the latest phishing keyword information every time the Internet is accessed, thereby preventing phishing with the latest information.

The present invention described above is not limited to the above-described embodiments and the accompanying drawings, and various substitutions, modifications, and changes are possible in the art without departing from the technical spirit of the present invention. It will be clear to those of ordinary knowledge.

As described above, the computer-readable recording medium in which the phishing prevention method and the prevention program through the domain pattern detection according to the present invention is recorded is a web to be accessed when a user attempts to access a specific website through an email and a web browser. Extracts subdomains and subdirectories from site addresses to determine if there is a wholesaler pattern in the subdomain or subdirectory, to determine if it is a phishing website, and to alert users in advance if a phishing website or potential phishing website exists By preventing the accident there is an effect that can prevent various kinds of Internet accidents, including financial accidents that can occur and thereby prevent the leakage of personal information of the user.

Claims (7)

In the anti-phishing method through domain pattern detection, A first step of extracting subdomains and subdirectories from a web site address in a URL address window when a user makes a web request; A second step of respectively checking whether a domain pattern exists in the subdomain or subdirectory; A third step of performing the second step again by replacing the dot character with '.' If there is a connection character such as '-' or '_' in the subdomain or subdirectory; A fourth step of respectively checking whether a keyword registered in advance in the subdomain or subdirectory exists; If any one of the second to fourth step consisting of the phishing warning phrases and phishing prevention method through the domain pattern detection, characterized in that for rejecting the link site link. The method of claim 1, The anti-phishing method through the domain pattern detection, Phishing prevention method through domain pattern detection, characterized in that by additionally displaying a forced link button to force the user to connect to the link site when the forced link button is clicked and display a web page. The method of claim 1, The first step of extracting the subdomain and the subdirectory, respectively, The subdirectory extracts all addresses after the first slash based on the first slash '/' in front of the website address, The subdomain is a phishing prevention method using a subdomain phishing point, wherein all addresses in front of the second domain are extracted based on the top-level domain and the second-level domain at the back of the website address. The method of claim 1, The second step of checking whether the domain pattern exists, Through domain pattern detection, characterized by checking whether there is a top-level domain that represents the classification of an organization including '.com', '.com', 'go.kr', or '.net' How to avoid phishing. The method of claim 1, The third step of checking whether there is a keyword registered in advance, Method for preventing phishing by domain pattern detection, if the keyword exists, highlight the keyword so that the user can recognize. The method according to claim 1, wherein The keyword registered in the dictionary, A phishing prevention method through domain pattern detection, characterized in that the latest phishing potential keyword is automatically downloaded by automatically downloading a phishing potential keyword every time the Internet is connected. A recording medium storing a computer program source for a phishing prevention method by detecting a domain pattern according to any one of claims 1 to 6.

Images