TR202008876A1 - CYBER ATTACK DETECTION METHOD - Google Patents

Abstract

Invention, by using phishing websites created for fraud in the internet environment, user name, password, etc. belonging to the customers of the institution that owns the website. It is about a method that enables the detection of cyber attackers who steal information.

Description

DESCRIPTION TECHNICAL FIELD By using phishing websites created for fraud on the internet, Username, password, etc. belonging to the customers of the website owner institution. cyber stealing information It relates to a method that enables attackers to be detected.

The invention 'prescribes the information of cyber attackers operating especially in the field of finance. It relates to a method that enables identification with flagged data and a fake website.

In today's cyber world, attackers can use phishing websites they create. It takes the information of users and inflicts material and moral damage on them. cyber attackers Copying the websites of the institutions serving their customers and using different domain names. using the same content. The attackers only use the code of the website. The information entered in the user entries by making changes in the section is not the service provider. helps them orient themselves. Thus, they fake the users of the institution they target. log in to the website and use the username and password combinations they use to log in. aims to steal. Cyber attackers are real with the username, password information they have obtained. logs into the institution's website and accesses the user account. If institution If there is a second verification method when entering the website, the attacker acts quickly, instantaneously transmit the user information obtained through the fake website to the real institution internet site. can access the site. Thus, the second confirmation message from the institution is sent to the user and The user enters this message on the fake website and as a result forwards it to the attacker.

If the attacker gains full access to the user account, with the second authentication information they have obtained. will have. The attacks carried out with the phishing technique described, especially financial online banking, etc. offered to customers by their institutions. targeting the services It provides access to users' bank accounts and in this way, users have a great economically damaged. It is determined that a website is phishing in the current technique. If it is done, action is taken to close the website, but for the detection of the attacker. No action can be taken by institutions. This is the attacker's attack it continues to do so. In addition, cyber attackers money account numbers used to steal tangible assets only user complaints As a result, it can be learned and blocked. User complaint to the institution until it is reached, the money account is usable by the attacker. Available to detect attacker information in cyber attacks carried out by phishing technique. There is no developed system for it. Therefore, phishing websites It brings with it the situation that the financial loss experienced through it cannot be prevented.

It has been developed for the detection of frauds carried out on the internet in the current technique. systems are available. TR2017/01866 provides users with e-mail, SMS, Against phishing messages from channels such as instant messaging applications, phishing A system that provides attack detection and prevention mechanism is mentioned. System It does not contain a solution that allows the attacker's information to be detected.

As a result, the above-mentioned problems that cannot be solved in the light of the current technique are related to the technical made it necessary to make an innovation in the field.

BRIEF DESCRIPTION OF THE INVENTION The present invention is intended to eliminate the above mentioned disadvantages and to introduce new technologies into the relevant technical field. It is about the cyber attacker detection method to bring advantages.

The main purpose of the invention is to attack the attacker in cyber attacks carried out by phishing method. is to develop a method that enables identification.

Another object of the invention is to detect cyber attackers by detecting attacker information. a system that ensures the prevention and / or recovery of financial losses of the remaining users. method development.

Another aim of the invention is to provide a deterrent method for cyber attackers.

In the preferred embodiment of the invention, those operating in the financial sector and The focus is on fake websites used for the purpose. fake by attackers Information obtained through the phishing website and legitimate corporate finance sites User accounts are accessed via transferred to their accounts. Our invention is to obtain the information of the attackers and to provide a more secure internet environment to people by forwarding it to the authorities aims.

All the above-mentioned purposes that will emerge from the detailed description below. The present invention is a legal entity established to serve customers. through fake websites that imitate the corporate website for fraudulent purposes Obtaining attacker information in cyber attacks carried out by phishing method. It is a cyber attacker detection method that provides Accordingly, the method; fake internet created by cyber attacker for fraudulent purposes logging into the website with marked user data, by the cyber attacker of the marked data entered into the said fake website. A corporate internet that provides legal services by being taken for fraudulent purposes entering the site, Analyze the entered information that the data entered on the corporate website is marked data. Detection of the attacker by detection by a firewall unit, enterprise mentioned by the detected attacker's firewall unit to the fake website that obtains the attacker information by imitating the website direction, the information of the attacker entering the fake website and/or the fake internet Transmitting the information entered on the website to the relevant security units The embodiment of the present invention and the best use of its advantages with additional elements In order to be understood, it should be evaluated together with the figures explained below.

BRIEF DESCRIPTION OF THE FIGURES Figure 1 shows an example of a system where the method of our invention is applied. gives.

REFERENCE NUMBERS fake website Corporate website firewall unit Imitation website 8: Offensive DETAILED DESCRIPTION OF THIS ITEM In this detailed description, the innovation that is the subject of the invention is only intended for a better understanding of the subject. It is explained with examples that will not have any limiting effect.

Figure-1 gives an image of a system in which the method that is the subject of our invention is applied.

Our invention is a legal corporate website established to serve customers. (2) by phishing through fake websites (1) that imitate for fraudulent purposes cyber attacks that enable the obtaining of attacker (S) information in cyber attacks. offensive detection method. In the preferred application of our invention, in the financial sector The focus is on fraudulent websites (1). Our invention is offensive (S) to the fake website (4) that imitates the corporate website (2) to obtain the information uses the routing method. A username and password marked first created by the attacker (S) by a security expert (U) of the combination The process becomes active by entering the fake website (1). Intruder marked (S) will see the username-password combination as a hooked user data, and will enter the corporate website (2). Security on the corporate website (2) A firewall unit (3) that performs the control of the user information that wants to log in Detecting the attacker (S) information by detecting that it is checked and logging the attacker (S) session It will transfer it to the imitative website (4) that provides it. Imitation website (4) security experts (U) designed exactly the same as the corporate website (2) in appearance. however, it is an imitation environment in terms of content, user and account information. Offensive (S) when he accesses the fake website (4), he says that he has accessed the user account he stole and that everything offensive (S) moves security experts (U) while he thinks it's alright for him is followed by. lP address as soon as the attacker logs into the impersonation website (4), Access information such as country location is delivered to security experts (U). Again when the attacker tries to send money from the logged in account to their bank account will have forwarded its own account information to the security experts (U). As a result, security experts (U) obtained both access and bank account information of the attacker (S) will be. When the data obtained is transmitted to the necessary authorities via the fake website (4) Since the accounts of the attackers (S) are canceled, things will be difficult and the attackers (8) It will facilitate the process of being caught by the security forces.

Claims (1)

REQUESTS It is a cyber attacker detection method that enables to obtain attacker (S) information in cyber attacks carried out by phishing method through fake websites (1) that imitate a legal corporate website (2) established for the purpose of serving customers, and its feature is; o Login to the fake website created by the cyber attacker (8) for fraudulent purposes (1) with the marked user data, - detecting the attacker (2) by determining that the data entered on the corporate website (2) is flagged data by a firewall unit (3) that analyzes the entered information, - detecting the attacker (2) by the firewall unit (3) of the detected attacker (8) redirecting the website (2) to the fake website (4) that obtains the attacker (S) information by imitating it, . It includes the steps of transmitting the information of the attacker (S) entering the fake website (4) and/or the information entered by the attacker (S) into the fake website (4) to the relevant security units. It is a cyber attacker detection method in accordance with Claim-1. Its feature is; The user data marked to the fake website (1) created by the cyber attacker (8) for fraudulent purposes is username and password data. It is a cyber attacker detection method in accordance with claim-1, and its feature is; It includes the process of transmitting the IP information and/or country location information of the attacker (8) entering the fake website (4) and/or the account information entered by the attacker (S) into the fake website (4) to the relevant security units.