TWI595373B - Method and system for identifying suspected phishing websites - Google Patents

Description

Method and system for identifying suspected phishing websites

The invention relates to the field of computer technology, and in particular to a method and system for identifying a suspected counterfeit website.

With the development of network technology, instant messaging (IM) tools have gradually become an important tool for users to conduct online transactions / e-commerce. There are some illegal websites. By setting the name of the website to be very close to the regular website, the user's trust is deceived and the interests of the user are harmed.

At present, the industry usually has the following consensus: a phishing website means that the name of the website address is very similar to a formal commercial website, and the website is intended to harm the user's interests.

List of phishing websites: Lists the list of known addresses that are determined to be phishing websites. Websites in such lists are often obtained through user complaints or manual screening, and the websites in such lists have generally harmed the interests of users.

List of websites to be protected: Lists the regular websites that need to be protected. Generally, such websites that need to be protected are websites that appear frequently in online transactions or e-commerce, such as Taobao, Alibaba, Alipay, etc. It is also the easiest website to be counterfeited.

The existing identification technology provides a query identification of a known regular website or a phishing website in the form of a database, that is, a regular website and/or a phishing website is identified by querying a list of websites to be protected and/or a list of phishing websites. Although the existing identification technology can identify the counterfeit website, the criminals can continue to defraud by reapplying for the new website address. Moreover, the existing identification technology needs to update the database after receiving the report or the incident. It is impossible to identify the early stage and the risk warning. That is to say, the existing identification is actually an exact match, that is, after the website address is stored in the database, the identification can be performed, otherwise the identification cannot be performed.

Embodiments of the present invention provide a method and system for identifying a suspected phishing website to achieve pre-identification and reduce the probability of accessing a counterfeit website.

The invention discloses a method for identifying a suspected phishing website, comprising: obtaining, by the device, a website address to be identified; determining, according to the website address to be identified, that the website does not belong to a regular website to be protected and is not a phishing website, applying the to-be-identified The website address is matched with the suspected phishing website rule by a second regular expression. If the matching is successful, the address of the website to be identified is determined to be a suspected phishing website.

The step of obtaining the website address to be identified by the device includes: matching any string and/or text obtained by the device according to the feature of the uniform resource locator URL, using a preset first regular expression, and matching The website address to be identified is obtained in the result; or, if any string and/or text obtained by the device already carries the uniform resource locator information, the website address to be identified is directly obtained from the string and/or text.

The step of applying the to-be-identified website address and the suspected phishing website rule to perform the second regular expression matching includes:

01) extracting host uniform resource locator information from the obtained website address to be identified;

02) determining whether there is an interference character in the unified resource locator information of the host, if yes, performing step 03), if not, using the extracted host uniform resource locator information as a keyword to be compared, and then Perform step 04);

03) deleting the extracted interference character in the extracted unified resource locator information, and deleting the host uniform resource locator information after the interference character is used as the keyword to be compared;

04) Perform the second regular expression matching on the keyword to be compared and the suspected phishing website rule.

The interference character includes one of an underline, a minus sign, a space, and a dot, or any combination thereof.

Wherein, according to the website address, the steps of determining that the website does not belong to a regular website to be protected and not a counterfeit website include:

Determining whether the address of the website to be identified is in the preset list of websites to be protected. If not, the obtained website address to be identified does not belong to the regular website to be protected; and determining whether the website address to be identified is in the preset phishing website In the list, if it does not exist, the obtained website address to be identified is not a phishing website.

The device is a client device or a server on the network side.

The client device includes an instant communication tool and a mobile terminal.

The method further includes: the device notifying the user of the determination result.

The invention also discloses an apparatus for identifying a suspected phishing website, comprising: a website address obtaining unit, configured to obtain a website address to be identified; and a website address processing unit, configured to determine the website address according to the website address to be identified The website does not belong to the regular website to be protected and is not a phishing website, and after the second regular expression is successfully matched by the website address to be identified and the suspected phishing website rule, the address of the website to be identified is determined to be a suspected phishing website.

The website address obtaining unit includes: a first website obtaining unit, configured to match any string and/or text obtained by the device according to a feature of the uniform resource locator URL, using a preset first regular expression. Obtaining a website address to be identified from the matching result; the second website obtaining unit is configured to directly from the string and/or when any string obtained by the device and/or the text itself has the uniform resource locator information Or text to get the address of the website to be identified.

The website address processing unit includes: a formal website determining unit, configured to determine that the website address to be identified is not in the preset list of websites to be protected, and determine that the website address to be identified does not belong to a regular website to be protected. The phishing website determining unit is configured to determine that the website address to be identified is not in the preset phishing website list, and determine that the website address to be identified is not a phishing website; the suspect website determining unit is used for the website address to be identified After the second regular expression is successfully matched with the suspected phishing website rule, it is determined that the website address to be identified is a suspected phishing website.

The suspected website determining unit includes: an extracting unit, configured to extract host uniform resource locator information from the obtained website address to be identified; and a keyword acquiring unit, configured to extract the extracted character when there is no interference character The host uniform resource locator information is used as the keyword to be compared. When there is an interference character, the extracted interference character in the host uniform resource locator information is deleted, and the host unified resource after the interference character is deleted. The locator information is used as a keyword to be compared; the matching unit is configured to determine that the website address to be identified is a suspected phishing website after the keyword to be compared and the suspected phishing website rule are successfully matched by the second regular expression.

The interference character includes one of an underline, a minus sign, a space, and a dot, or any combination thereof.

The device is located at the user equipment or the network side device.

The device further includes: a prompting device, configured to notify the user of the determination result.

The method and device for identifying a suspected phishing website provided by the above embodiments of the present invention can identify a suspected phishing website before the user suffers the loss, achieve the purpose of prior identification, reduce the probability of accessing the phishing website, and perform risk warning in advance. The possible losses are minimized.

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The present invention first explains some concepts: a suspected phishing website: the naming of the website address is the same as the "phishing website", but it has not been determined whether the website will harm the interests of the user, such as www.taopao.com, the website has not yet been determined Whether it is harmful to the interests of Taobao (www.taobao.com) users, it cannot be identified as a counterfeit website, but it can be defined as a suspected counterfeit website. Although the suspected counterfeit website does not necessarily damage the user's interests, it needs Early warning is provided to reduce the probability of users accessing counterfeit websites and maximize the benefits of users.

FIG. 1 is a flowchart of a method for identifying a suspected phishing website according to an embodiment of the present invention. The embodiment of the present invention may be performed on the user terminal side or on the network side, and specifically includes:

Step 101: Obtain a website address to be identified; here, the method for obtaining a website address is not limited. For example, the website address may be obtained during the process of applying an instant messaging (IM) software chat, or in the user's personalized signature. Obtaining the website address, etc., regardless of the website address obtained by which method is used, can be considered as the website address to be identified here.

It can be understood that the website address to be identified can be obtained through one or more application scenarios. The specific application scenario may be: for the field of instant communication technology: the website address to be identified may be obtained through an instant communication tool, and the specific scenarios include but are not limited to The following are:

Scenario 1: When a user applies an instant messaging tool (including a one-to-one chat, a multi-person chat room, a group, etc.), when the user receives the instant message, the URL address link can be obtained from the instant message content;

Scenario 2: When the user clicks on the contact list, group member list, or other form of contact list in the instant messaging tool, the URL address link can be obtained from the status bar field or the signature area of the contact;

Scenario 3: When a user logs in to the communication software and receives an offline message (a message received when the user is not logged in), the URL address link can be obtained from the offline message;

Scenario 4: Generally, the instant messaging suite software contains floating information, and the floating information generally appears as a window floating in the lower right corner of the system taskbar area, and the user can obtain the URL address link from the floating window content.

For the field of browser technology, including but not limited to the following application scenarios: the user clicks on any clickable element in the form of a hyperlinked picture, text, video, etc., and obtains the URL address from the point of the clickable element. link.

The embodiment of the present invention can be performed on the user terminal side or on the network side. Therefore, the specific implementation manner of obtaining the website address to be identified may be obtained on the user side or the server side. Any string and/or text that arrives is filtered according to the characteristics of the Uniform Resource Locator (URL, Uniform Resource Locator), and the URL is obtained from the matching result by the preset first regular expression. The URL is the address of the website to be identified, so no matter how the scene changes, as long as any string and/or text is matched by a preset regular expression, the URL can be obtained.

It should be noted that there is an exception: in the field of browsers, clickable elements (such as pictures, texts, etc.) already have URL information themselves, so that it is no longer necessary to perform regular expression matching recognition, which can be directly obtained. The URL of the website to which the element points.

It will be appreciated that for convenience of description, the regular expression used herein to obtain the URL address from the resulting string and/or text is referred to as the first regular expression.

Step 102: Determine, according to the website address to be identified, whether the website is a regular website and a phishing website to be protected. If not, execute step 103, and if yes, end.

The specific judgment process is: determining whether the website address to be identified is in the preset list of websites to be protected, and if not, the obtained website address to be identified does not belong to the regular website to be protected; determining whether the website address to be identified is If the default phishing website list does not exist, the obtained website address to be identified is not a phishing website.

The above two judgments have no order, that is, it can be judged whether it is in the preset list of websites to be protected, or whether it is first in the list of preset phishing websites.

It can be understood that if the website address to be identified is in the preset list of websites to be protected, or in the list of preset phishing websites, it can be determined that the website address to be identified is a regular website or a phishing website, so that The nature of the website to be identified can be determined, and thus, it can be directly ended without further follow-up operations.

Step 103: Apply a second regular expression matching to the website address to be identified and the suspected phishing website rule. If the matching is successful, determine that the address of the website to be identified is a suspected phishing website, otherwise determine that the website address to be identified is a non-suspicion phishing website. .

Here, the regular expression for matching a suspected phishing website is referred to as a second regular expression.

Moreover, after the device obtains the determination result, the user may be prompted, and the specific prompting manner may adopt any one of the following:

Method 1: Use a graphical way to prompt the user. For example, if it is determined to be a regular website to be protected, draw “√” next to the website URL; if it is determined to be a counterfeit website or a suspected counterfeit website, draw next to the website URL. “×”; if it is determined to be a non-suspicious phishing website, draw “?” next to the website URL.

Method 2: prompting the user in a text manner, for example, if it is determined to be a regular website to be protected, the user is prompted to “clickable”, otherwise, the user is prompted to be “unsafe” or “may be unsafe”.

The above is an example of the terminal side to explain how to inform the user of the judgment result. For the network side, it is similar to the terminal side. The difference is that the determined result is first transmitted to the terminal side, and then the terminal side prompts the user. .

The following is a detailed description of how to apply the website address to be identified and the suspected phishing website rule to perform a second regular expression matching. Referring to FIG. 2, the method for applying the website address to be identified and the suspected phishing website rule is used according to an embodiment of the present invention. The flow chart of the arithmetic matching includes:

Step 201: Extract host uniform resource locator (hosturl) information from the obtained website address to be identified; for example, if the obtained website address is Protocol://hosturl/pathurl, delete the path information in the website address. , the first code of the agreement, etc., only the hosturl information is extracted.

Step 202: Determine whether there is an interference character in the hosturl information. If yes, execute step 203. Otherwise, perform step 204.

The above-mentioned interference character is a commonly used interference means for imitating a website address, and may specifically include: various separation symbols such as a dash (_), a minus sign (-), a space, a dot (.), etc., in the implementation process, The interference character can be one or any combination of the above.

In step 203, the interference character in the extracted hosturl information is deleted, and the hosturl information after the interference character is deleted is used as the keyword to be compared; then step 205 is performed.

Step 204: The extracted hosturl information is used as a keyword to be compared, and then step 205 is performed.

Step 205: Perform the second regular expression matching on the keyword to be compared and the suspected phishing website rule.

The Uniform Resource Locator (URL), also known as the web address, is the address of a standard resource on the Internet. It has now been compiled by the World Wide Web Consortium as the Internet standard RFC1738. A URL is an identification method used to fully describe the address of web pages and other resources on the Internet. Every web page on the Internet has a unique name identifier, usually called a URL address. This address can be a local disk, or a computer on a local area network, and more on the Internet. Site. Simply put, a URL is a web address, commonly known as a "URL."

Suspected phishing website rules are described by regular expressions for important keywords in the host name and their common variants. The above keywords refer to words or combinations of hostsurl that can represent websites, such as taobao, alibaba, yahoo, ebay, etc. can be called keywords. The design of the suspected phishing website rules is not very versatile. Instead, it treats the regular websites listed in the list of protected websites. By manually writing the regular expressions one by one, a simple and effective matching method for keywords is adopted. This forms a regular expression for suspected counterfeit website rules.

The above common variants include but are not limited to the following manifestations:

1, based on the difficulty of identification, such as the English letter O and the Arabic numeral 0, is often easily overlooked on the computer display, such as changing taobao.com篡 to taba0. com, note that the second is 0 instead of the letter o;

2. Omit some consonants in English characters that do not affect reading. For example, www.taobao.com, tampering with www.taoba.com.

3. Increase the split symbol, for example, change www.taobao.com to www.tao-bao.com.

An example of a suspected phishing website rule is given below, in which case a suspected phishing website for the address of Alibaba and its affiliate websites is sought.

It should be noted that since the hosturl as input has ensured that there is no interference character (the step of deleting the interference character before the regular expression matching is performed), the regular expression indicating the suspected phishing website rule is no longer considered. these questions.

The execution body of the above embodiment of the present invention may be a user terminal or a server on the network side. The user terminal may be an instant communication tool or a mobile terminal.

The method for identifying a suspected phishing website provided by the above embodiment of the present invention can identify a suspected phishing website before the user suffers the loss, achieve the purpose of prior identification, and notify the user of the recognition result, thereby reducing the probability of accessing the phishing website. Embodiments of the present invention provide risk warnings in advance to minimize possible losses.

The present invention also provides an apparatus for identifying a suspected phishing website. Referring to FIG. 3, the website address obtaining unit 301 and the website address processing unit 302 are configured to obtain the website address to be identified. Address; here, there is no restriction on the way to obtain the address of the website, no matter which way the website address is obtained, it can be regarded as the website address to be identified here.

Here, there is no restriction on the way to obtain the website address, for example, the website address can be obtained in the process of applying instant messaging (IM) software chat, or the website address can be obtained in the user's personalized signature, etc., regardless of the application. The website address obtained by the method can be regarded as the website address to be identified here. The specific application scenario is the same as the foregoing, and is not described here.

The website address processing unit 302 is configured to determine, according to the website address to be identified, that the website does not belong to a regular website to be protected and is not a phishing website, and apply the website address to be identified and the suspected phishing website rule to perform a second After the regular expression is successfully matched, it is determined that the address of the website to be identified is a suspected phishing website.

Furthermore, the above apparatus may further include: prompting means for notifying the user of the determination result. If the device is located on the terminal side, the prompting device may directly present the determination result to the user; if the device is located on the network side, the prompting device may notify the terminal of the determination result and display it to the user by the terminal.

4 is a structural diagram of a website address processing unit according to an embodiment of the present invention, which may include: a regular website determining unit 3021, a counterfeit website determining unit 3022, and a suspected website determining unit 3023, wherein the regular website determining unit 3021, After determining that the website address to be identified is not in the preset list of websites to be protected, determining that the website address to be identified does not belong to a regular website to be protected; the counterfeit website determining unit 3022 is configured to determine the website to be identified. After the address is not in the preset phishing website list, it is determined that the website address to be identified is not a phishing website; the suspect website determining unit 3023 is configured to perform the second regular expression matching on the website address to be identified and the suspected phishing website rule. After that, it is determined that the address of the website to be identified is a suspected phishing website.

FIG. 5 is a structural diagram of a suspected website determining unit according to an embodiment of the present invention, which may include: an extracting unit 30231, a keyword obtaining unit 30232, and a matching unit 30233, wherein the extracting unit 30231 is configured to obtain the obtained Identify the website address to extract the host uniform resource locator information; specifically, you can extract the hosturl information by deleting the path information and the agreement first code in the website address.

The keyword obtaining unit 30232 is configured to: when the interference character is not present, use the extracted host uniform resource locator information as a keyword to be compared, and when the interference character exists, the proposed host uniform resource locator The interference character in the information is deleted, and the host uniform resource locator information after the interference character is deleted is used as the keyword to be compared; the above-mentioned interference character is a common interference means used to imitate the website address, and may specifically include: various separations. The symbols are as follows (_), minus (-), spaces, dots (.), etc., and during the implementation, the interference characters may be one or any combination of the above.

The matching unit 30233 is configured to determine that the website address to be identified is a suspected phishing website after the keyword to be compared and the suspected phishing website rule are successfully matched by the second regular expression.

FIG. 6 is a structural diagram of a website address obtaining unit according to an embodiment of the present invention, which may include: a first website obtaining unit 3011 and a second website obtaining unit 3012, wherein the first website obtaining unit 3011 is configured to Any string and/or text obtained by the device is matched according to the feature of the Uniform Resource Locator URL, using a preset first regular expression, and the website address to be identified is obtained from the matching result; the second URL obtaining unit 3012, The website address to be identified is obtained directly from the string and/or text when any string and/or text obtained by the device already carries the uniform resource locator information.

The device for identifying a suspected phishing website provided by the foregoing embodiment of the present invention may be located on the user terminal side or on the network side, that is, the device may be located at the user terminal or the server on the network side. The user terminal can be either an instant messaging tool or a mobile terminal.

The device for identifying a suspected phishing website provided by the foregoing embodiment of the present invention can identify a suspected phishing website before the user suffers the loss, and achieves the purpose of prior identification. The present invention notifies the user of the recognition result, thereby reducing the probability of accessing the phishing website. Risk warnings were made in advance to minimize possible losses.

For convenience of description, the various parts of the above apparatus are separately described by functions into various units. Of course, the functions of each unit can be implemented in the same or multiple software or hardware in the practice of the present invention.

It is to be understood that the term "comprises", "comprising" or any other variations thereof is intended to encompass a non-exclusive inclusion, such that a process, method, article, or device that comprises a It also includes other elements that are not explicitly listed, or elements that are inherent to such a process, method, item, or device. An element defined by the phrase "comprising a ..." does not exclude the presence of additional equivalent elements in the process, method, item, or device that comprises the element.

A person skilled in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by a program to instruct the related hardware, and the program can be stored in a computer readable storage medium, where the storage is referred to herein. Media, such as: ROM / RAM, disk, CD, etc.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention. Any modifications, equivalents, improvements, etc. made within the spirit and scope of the invention are intended to be included within the scope of the invention.

301. . . Website address acquisition unit

302. . . Website address processing unit

3021. . . Formal website decision unit

3022. . . Counterfeit website decision unit

3023. . . Suspected website decision unit

30231. . . Extraction unit

30232. . . Keyword acquisition unit

30233. . . Matching unit

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only Some of the embodiments of the invention may be obtained by those of ordinary skill in the art in view of the drawings without departing from the scope of the invention.

1 is a flow chart of a method for identifying a suspected counterfeit website according to an embodiment of the present invention;

2 is a flowchart of a regular expression matching of a website address to be identified and a suspected phishing website rule according to an embodiment of the present invention;

3 is a structural diagram of an apparatus for identifying a suspected phishing website according to an embodiment of the present invention;

4 is a structural diagram of a website address processing unit according to an embodiment of the present invention;

FIG. 5 is a structural diagram of a suspected website determining unit according to an embodiment of the present invention; FIG.

FIG. 6 is a structural diagram of a website address obtaining unit according to an embodiment of the present invention.

Claims (13)

A method for identifying a suspected phishing website, comprising: obtaining a website address to be identified; determining, according to the website address to be identified, that the website does not belong to a regular website to be protected and is not a phishing website, applying the to-be-identified The website address and the suspected phishing website rule perform a second regular expression matching. If the matching is successful, the website address to be identified is determined to be a suspected phishing website, wherein the website address to be identified and the suspected phishing website rule are applied for the second The regular expression matching includes determining whether there is an interference character. The method of claim 1, wherein the step of obtaining the website address to be identified comprises: using any of the obtained strings and/or texts according to the characteristics of the uniform resource locator URL, using a preset first The regular expression is matched to obtain the website address to be identified from the matching result; or, if any string and/or text obtained has the uniform resource locator information, directly from the string and/or text Get the address of the website to be identified. The method of claim 1, wherein the step of applying the to-be-identified website address and the suspected phishing website rule to perform the second regular expression matching comprises: 01) extracting the host from the obtained website address to be identified Uniform resource locator information; 02) determine whether there is interference in the unified resource locator information of the host If the character is present, step 03) is performed. If not, the extracted host uniform resource locator information is used as the keyword to be compared, and then step 04) is executed; 03) unifying the extracted host The interference character deletion in the resource locator information deletes the host uniform resource locator information after the interference character as the keyword to be compared; 04) performs the second regular operation on the keyword to be compared and the suspected phishing website rule. Matching. The method of claim 3, wherein the interference character comprises: one of an underline, a minus sign, a space, a dot, or any combination. The method of claim 1, wherein determining, according to the website address, that the website does not belong to a regular website to be protected and is not a phishing website comprises: determining whether the website address to be identified is in a preset list of websites to be protected If the information does not exist, the obtained website address to be identified does not belong to the regular website to be protected; whether the website address to be identified is in the preset list of phishing websites, and if not, the obtained website address to be identified Not a fake website. The method of claim 1, wherein the method further comprises: notifying the user of the result of the determination. An apparatus for identifying a suspected phishing website, comprising: a website address obtaining unit, configured to obtain a website address to be identified; a website address processing unit, configured to determine, according to the website address to be identified, that the website does not belong to a regular website to be protected and is not a counterfeit website, and apply the to-be-identified website address and the suspected counterfeit website rule to perform a second regularity After the successful matching of the computing formula, determining that the address of the website to be identified is a suspected phishing website, wherein applying the to-be-identified website address and the suspected phishing website rule to perform the second regular expression matching includes determining whether there is an interference character. The device of claim 7, wherein the website address obtaining unit comprises: a first website obtaining unit, configured to use any string and/or text obtained by the device according to the characteristics of the uniform resource locator URL. The first regular expression is pre-set to match, and the website address to be identified is obtained from the matching result; the second URL obtaining unit is used to obtain a uniform resource locator for any string and/or text obtained by the device itself. For information, the website address to be identified is obtained directly from the string and/or text. The device of claim 7, wherein the website address processing unit comprises: a formal website determining unit, configured to determine that the website address to be identified is not in a preset list of websites to be protected, and determine the to-be-identified The website address is not a regular website to be protected; the phishing website determining unit is configured to determine that the website address to be identified is not in the list of the default phishing websites, and determine that the website address to be identified is not a phishing website; The suspected website determining unit is configured to determine that the website address to be identified is a suspected phishing website after the second regular expression is successfully matched between the to-be-identified website address and the suspected phishing website rule. The device of claim 9, wherein the suspected website determining unit comprises: an extracting unit, configured to extract host uniform resource locator information from the obtained website address to be identified; and a keyword obtaining unit, configured to When there is no interference character, the extracted host uniform resource locator information is used as a keyword to be compared, and when the interference character exists, the extracted interference character in the host uniform resource locator information is deleted. The host uniform resource locator information after the interference character is deleted is used as the keyword to be compared; the matching unit is configured to determine that the second regular expression is successfully matched after the keyword to be compared and the suspected phishing website rule are successfully matched. The identified website address is a suspected phishing website. The device of claim 10, wherein the interference character comprises: one of an underline, a minus sign, a space, a dot, or any combination. The device of claim 7, wherein the device is located at a client device or a network side device. The device of claim 7, wherein the device further comprises: prompting means for notifying the user of the result of the determination.