WO2007072320A2 - Method for evaluating and accessing a network address - Google Patents

Method for evaluating and accessing a network address Download PDF

Info

Publication number
WO2007072320A2
WO2007072320A2 PCT/IB2006/054801 IB2006054801W WO2007072320A2 WO 2007072320 A2 WO2007072320 A2 WO 2007072320A2 IB 2006054801 W IB2006054801 W IB 2006054801W WO 2007072320 A2 WO2007072320 A2 WO 2007072320A2
Authority
WO
WIPO (PCT)
Prior art keywords
network address
derivatives
trust level
received network
generated
Prior art date
Application number
PCT/IB2006/054801
Other languages
French (fr)
Other versions
WO2007072320A3 (en
Inventor
Chris P Vanden Berghe
Tadeusz J. Pietraszek
Original Assignee
International Business Machines Corporation
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by International Business Machines Corporation filed Critical International Business Machines Corporation
Priority to CN2006800479749A priority Critical patent/CN101341717B/en
Priority to AT06842475T priority patent/ATE470306T1/en
Priority to EP06842475A priority patent/EP1964364B1/en
Priority to US12/158,773 priority patent/US8201259B2/en
Priority to DE602006014726T priority patent/DE602006014726D1/en
Priority to JP2008546740A priority patent/JP4596556B2/en
Publication of WO2007072320A2 publication Critical patent/WO2007072320A2/en
Publication of WO2007072320A3 publication Critical patent/WO2007072320A3/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/30—Managing network names, e.g. use of aliases or nicknames
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1483—Countermeasures against malicious traffic service impersonation, e.g. phishing, pharming or web spoofing

Definitions

  • the present invention is related to a method, a computer program and a computer system for evaluating and accessing a network address. Furthermore, the invention is related to a method for deploying computing infrastructure and a method for performing an analysis of the network communication traffic of a business entity.
  • a network address can be any address that is suitable for locating a resource in a network.
  • the message will typically be an unsolicited email containing a fictive story urging the user to disclose sensitive information, e.g. to validate its bank account or credit card information.
  • This message contains a link that appears trustworthy, i.e., appears to point to a trustworthy website, but will in fact point to an attacker-controlled website.
  • Techniques commonly used in obfuscating URLs include:
  • HTML Hyper Text Markup Language
  • IDN international domain names
  • similar or even identical looking characters e.g., Russian 'a' instead of standard (Latin) 'a'
  • DNS Domain Name System
  • Another type of phishing-attack is to run a website with an URL that deviates from the URL of a trusted website only by a common typing error.
  • the attacker effectively impersonates a bank or other institutions and tricks the victim into disclosing sensitive information.
  • a known method to prevent phishing attacks is to use blacklists created from user reports and identified phishing e-mails.
  • Another known method to prevent phishing attacks is to display additional information about a website, e.g. its hosting location, since when it has been registered and a rank of a page.
  • the last group of known methods to prevent phishing attacks is based on e-mail filtering using e.g. Bayesian filters which filter suspicious e-mail messages or reformat them in a way that discloses their malicious intent.
  • Bayesian filters which filter suspicious e-mail messages or reformat them in a way that discloses their malicious intent.
  • the disadvantage of such techniques is that they are only effective against phishing that is disseminated by using e-mails.
  • the present invention is directed to methods, a computer program and a computer system as defined in independent claims. Further embodiments of the invention are provided in the appended dependent claims.
  • This method allows the evaluation of the trustworthiness of network addresses in an efficient, reliable and flexible way.
  • the method can detect untrustworthy network addresses automatically, i.e. independent from any user interaction. Furthermore, it allows the automatic detection of untrustworthy network addresses which are not known for being untrustworthy yet.
  • a method for accessing a network address comprising the steps of:
  • This method allows a secure accessing of network addresses in an efficient, reliable and flexible way.
  • the method can detect automatically that a requested network address is not trustworthy and provide appropriate countermeasures. Furthermore, it allows the automatic detection of untrustworthy network addresses which are not known for being untrustworthy yet.
  • the received, accessed or requested network address is the address of a web site or web page respectively.
  • the received, accessed or requested network address is a Uniform Resource Identifier (URI), in particular a Uniform Resource Locator (URL).
  • URIs and URLs are standardized elements for addressing resources in the Internet.
  • the generated derivatives should be in some way similar to the network address that has been received or accessed and is targeted for evaluation.
  • the similarity can be e.g. optical, structural or editorial.
  • the derivatives are generated by means of at least two different methods. This further improves the security and reliability of the method. The more methods are used, the more derivatives can be generated.
  • derivatives which are optically similar to the received network address are generated by means of Optical Character Recognition (OCR).
  • OCR Optical Character Recognition
  • OCR can be performed by several well established methods which analyze and recognize the characters of a scanned text. By applying these methods and/or adapted methods on the received network address, one or more network addresses which are optically similar to the received network address can be derived.
  • OCR optical character recognition
  • derivatives which are structurally similar to the received network address are generated by means of adding and/or removing and/or replacing prefixes, postfixes, punctuation marks and/or other common network address elements.
  • Common prefixes are e.g. "my”, or “e-”
  • common postfixes are e.g. “online”, "24” and common punctuation marks are e.g. dashes.
  • derivatives which are editorially similar to the received network address are generated by means of compensating for typing errors.
  • top level domains As more and more top level domains are created, the change of the top level domain is a promising target of phishing attacks.
  • a phishing attack might be performed by using the top level domains .eu or .org or any other top level domain that is not used by the owner of the trusted website.
  • the trust level assignment is based on at least a first property and a second property of the generated derivatives and the received network address.
  • the trust level is assigned by means of a combination of at least two of the following properties of the received network address and the derivatives: the validity of the received network address and the derivatives, the rank of the received network address and the derivatives, the host location of the received network address and the derivatives, the creation date of the received network address and the derivatives, the character set of the received network address and the derivatives, belonging to a whitelist with trusted network addresses and/or belonging to a blacklist with untrusted network addresses.
  • the rank or page rank is a family of algorithms for assigning numerical weightings to hyperlinked documents or web pages, indexed by a search engine (PageRank is a trademark of Google Inc.).
  • PageRank is a trademark of Google Inc.
  • the host location is another possible criteria for assigning a trust level. The more trustworthy the host location, the higher the assigned trust level.
  • Another possible property for assigning a trust level is the creation date of the domain. In general, domains which are rather old, are considered to be relatively trustworthy, while recently created domains are considered to be relatively untrustworthy. This is based on the fact that fraudulent websites are often only provided for a short period of time.
  • the creation date of the domain is only one out of at least two criteria.
  • the assigned trust level of a newly created website can be relatively high if the other properties get a high rating.
  • the character set of the domain is another possible property.
  • character sets that are different from the native character set could be given a different trust level.
  • Another property could be if the network address belongs to a whitelist with trusted network addresses or a blacklist with untrusted network addresses.
  • a first weighing coefficient is assigned to the first property and a second weighing coefficient is assigned to the second property and wherein the trust level assignment is based on a weighed combination of the first and the second property by means of the first and the second weighing coefficient.
  • the first and the second property and all other used properties can be given a different weighing coefficient and hence a different influence on the trust level.
  • the weighing coefficients can be adjusted over time and adapted according to the experience with the relevance of the different properties.
  • the response is based on the difference between the trust level of the received network address and the trust level of the derivatives. This further enhances the reliability of the method. It allows taking into account the individual situation of each case.
  • the response is based on the relative trust level of the received network address, i.e. the trust level of the received network address is evaluated in relation to the trust level of the generated derivatives.
  • the response comprises the received network address or the content of the received network address respectively, if the difference between the trust level of the received network address and the trust level of the derivatives is greater than a predetermined threshold level or the response indicates that the received network address is untrustworthy, if the difference between the trust level of the received network address and the trust level of the derivatives is smaller than or equal to the predetermined threshold level.
  • the response would comprise the received network address or the content of the received network address, e.g. a requested webpage. If the received network address is not trustworthy, the trust level of the received network address will be relatively low compared to the trust level of the generated derivatives. In this case, the response would indicate that the received network address is untrustworthy. This can be done in several ways. One possibility would be to warn the user or the system administrator or the source of the evaluation request. Another possibility would be to suggest alternative network addresses that have a higher trust level. A further option would be to just block a received or requested network address or to issue automatically the network address which the user most likely intended to request.
  • the method is performed within a proxy server, within a browser or within a Domain Name System (DNS) server of a computer system. If the method is performed within a proxy server, all user requests for a webpage will be evaluated. If the webpage is not trustworthy, the proxy server will issue an appropriate response, e.g. a warning message indicating a phishing attack. This is transparent for the user and can be centrally administered.
  • DNS Domain Name System
  • Implementing the method within a DNS server can protect users by checking for phishing or other attacks at the moment the domain request is performed. In case of a phishing attack, a message "domain non-existent" can be returned or the user can be redirected to a page that warns the user and/ or suggests alternatives.
  • a method for deploying computing infrastructure comprising integrating computer readable code into a computer system, wherein the code in combination with the computer system is capable of performing the following:
  • This method allows to improve the security of computer systems in a reliable and efficient way. This method is particularly suited for service providers who offer information technology services.
  • a method for performing an analysis of the network communication traffic of a business entity comprising the steps of:
  • This method allows business entities or service providers to analyse security risks of business entities.
  • Computer systems of business entities are more and more linked and interconnected with external networks, in particular with the Internet. This poses a serious threat on the data security. Doing an analysis of the network communication traffic with external networks such as the internet may reveal security risks and dangers. Once dangerous or untrustworthy network addresses have been detected, they can be put on a blacklist and the employees can be warned.
  • FIG. 1 shows a schematic illustration of a computer system according to an embodiment of the present invention.
  • FIG. 2 shows a schematic illustration of a general flow chart of a method according to an embodiment of the present invention.
  • FIG. 3 shows a schematic illustration of a specific flow chart of a method according to an embodiment of the present invention.
  • Fig. 1 shows a person P, who uses a computer 2.
  • the computer 2 executes as computer program a browser 3.
  • the browser 3 comprises evaluation software that evaluates if requested network addresses are trustworthy.
  • the evaluation software might be implemented as separate software tool as well.
  • the computer 2 and the browser 3 are connectable for application-dependent interactions to a network 4.
  • the network 4 can represent e.g. the Internet.
  • the computer 2 can exchange information with other network users and data via the network 4 and by means of the browser 3.
  • Fig. 1 shows as further network users a bank 5, a first business entity 6, a second business entity 7 and a malicious entity 8.
  • the bank 5, the first business entity 6 and the second business entity 7 are trustworthy users of the network 4.
  • the bank 5, the first business entity 6, the second business entity 7 and the malicious entity 8 have each an individual network or internet address, e.g. a URL.
  • the person P has to enter this individual network address into his computer and can then communicate via the network 4 by means of the browser 3 with the respective network user.
  • Fig. 2 shows a schematic illustration of a general flow chart of a method according to an embodiment of the invention.
  • the method can be performed e.g. as software program that runs on the computer 2 of Fig. 1.
  • the person P wants to request a specific webpage.
  • the person P enters as network address 50 the Uniform Resource Locator (URL) of this webpage into the browser 3 of the computer 2.
  • the browser 3 starts the evaluation software which receives and evaluates the trustworthiness of the requested URL 50.
  • the security software generates in step 20 derivatives 60 of the requested URL 50.
  • the generated derivatives 60 are a set of network addresses, i.e. in this example a set of URLs, which are derived from the requested URL 50 and are similar to the requested URL 50.
  • the similarity can be e.g. optical, editorial or structural.
  • Optical similar network addresses can be constructed by performing Optical Character Recognition (OCR) on the requested network address (URL) 50.
  • OCR Optical Character Recognition
  • Structural similar network addresses can be generated by adding and/or removing and/or replacing common pre- and postfixes, punctuation marks and/or other common network address elements.
  • Editorial similar network addresses can be generated by means of compensating for common typing errors.
  • derivatives 60 can be generated by means of changing the top level domain.
  • One goal of this step 20 is to create a set of derivatives 60 of which one is the network address which the user intended to request, in case this is not the requested network address itself.
  • a trust level is assigned to the requested network address 50 and to the generated derivatives 60.
  • the trust level assignment is preferably based on at least a first property and a second property of the generated derivatives 60 and the requested network address 50.
  • properties could be the validity, the page rank, the host location, the creation date, and/or the character set of the requested network address 50 and the derivatives 60.
  • properties it could be checked if the requested network address 50 and the derivatives 60 belong to a whitelist with trusted network addresses and/or to a blacklist with untrusted network addresses.
  • the properties of the network addresses 50 and the derivatives 60 are given different relevance by means of weighing coefficients.
  • the trust level assignment is then based on a weighed combination of the used properties of the network addresses. As an example, if the requested network address 50 or one of the derivatives 60 belongs to a blacklist, this will have a very high impact on the trust level, i.e. the trust level will be generally zero. As another example, the creation date of the requested network address 50 or the derivatives 60 will have a relatively low weighing factor and hence have lower influence on the assigned trust level.
  • the trust level of the derivatives 60 is compared with the trust level of the requested network address 50 and a response is issued based on this comparison. If the requested network address 50 is trustworthy, the trust level of the requested network address 50 will be relatively high compared to the trust level of the generated derivatives 60. In this case, the response could comprise the requested network address 50, i.e. the requested webpage. If the requested network address 50 is not trustworthy, the trust level of the requested network address 50 will be relatively low compared to the trust level of the generated derivatives 60. In this case, the response could indicate that the requested network address 50 is untrustworthy. This can be done in several ways. One possibility would be to warn the person P. Another possibility would be to suggest alternative network addresses that have a higher trust level. A further option would be to just block the requested network address 50 or to issue automatically the network address which the user most likely intended to request.
  • Fig. 3 shows a schematic illustration of a specific flow chart of a method according to an embodiment of the invention.
  • the person P requests in step 10 as network address 50 the URL http://www.mybank-online.com.
  • This URL belongs to a fraudulent webpage of the malicious entity 8 of Fig. 1.
  • the malicious entity 8 wants to get sensitive information, such as credit card information, account numbers, account names and passwords, from the person P.
  • sensitive information such as credit card information, account numbers, account names and passwords
  • step 20 the evaluation software of the browser 3 generates a set of similar derivatives 60 comprising as an example the URLs http://www.mybakn-online.com, http://www.my-bank-online.com, http://www.mybank-online.org, http://www.mybank.com, http://www.mybank.co.uk etc.
  • step 30 different trust levels are assigned to the generated derivatives 60 and the requested network address (URL) 50:
  • step 40 the trust level of the derivatives 60 is compared with the trust level of the requested network address 50.
  • the trust level "10" of the requested URL http://www.mybank-oniine.com is relatively low compared to the trust level "30" of the generated derivative http://www.mybank.com.
  • the present invention can be realized in hardware, software, or a combination of hardware and software. Any kind of computer system - or other apparatus adapted for carrying out the method described herein - is suited.
  • a typical combination of hardware and software could be a general purpose computer system with a computer program that, when being loaded and executed, controls the computer system such that it carries out the methods described herein.
  • the present invention can also be embedded in a computer program product, which comprises all the features enabling the implementation of the methods described herein, and which - when loaded in a computer system - is able to carry out these methods.
  • Computer program means or computer program in the present context mean any expression, in any language, code or notation, of a set of instructions intended to cause a system having an information processing capability to perform a particular function either directly or after either or both of the following a) conversion to another language, code or notation; b) reproduction in a different material form.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)
  • Information Transfer Between Computers (AREA)
  • Small-Scale Networks (AREA)

Abstract

The invention relates to a method for evaluating or accessing a network address, comprising the steps of: receiving a network address (50); generating derivatives (60) of the received network address (50); assigning a trust level to the generated derivatives (60) and the received network address (50); comparing the trust levels of the derivatives (60) with the trust level of the received network address (50); and issuing a response based on the comparison.

Description

METHOD FOR EVALUATING AND ACCESSING A NETWORK ADDRESS
TECHNICAL FIELD
The present invention is related to a method, a computer program and a computer system for evaluating and accessing a network address. Furthermore, the invention is related to a method for deploying computing infrastructure and a method for performing an analysis of the network communication traffic of a business entity. A network address can be any address that is suitable for locating a resource in a network.
BACKGROUND OF THE INVENTION
The Internet and other networks have changed the way people do business by providing instant global presence to businesses. At the same time the Internet has also given rise to new forms of criminality, which benefit from the Internet in much the same way as regular businesses do. One of the most common forms of Internet fraud is "phishing", a social engineering attack in which an attacker tricks the user into disclosing sensitive information, such as credit card information, account numbers, account names, passwords, etc. Phishing attacks pose a serious threat to e-commerce.
One common type of phishing attack consists of three parts:
- a message that urges the user to visit an attacker-controlled website,
- a Uniform Resource Locator (URL) that looks similar to a trusted one, and
- a website that imitates that layout of the trusted website.
The message will typically be an unsolicited email containing a fictive story urging the user to disclose sensitive information, e.g. to validate its bank account or credit card information. This message contains a link that appears trustworthy, i.e., appears to point to a trustworthy website, but will in fact point to an attacker-controlled website. Techniques commonly used in obfuscating URLs include:
- a combination of javascript and Hyper Text Markup Language (HTML),
- obfuscated URL syntax (e.g. http://user:password@host/webpage),
- URL rendering errors (e.g. invalid xOO rendering),
- international domain names (IDN) containing similar or even identical looking characters (e.g., Russian 'a' instead of standard (Latin) 'a'), and
- similar Domain Name System (DNS) names (e.g. http://www.mybank-online.com, http://www.mybank.com, http://www.my6ank.com or http://www.mybank.co.uk instead of http://www.mybank.com).
Another type of phishing-attack is to run a website with an URL that deviates from the URL of a trusted website only by a common typing error.
In the attacker-controlled website, the attacker effectively impersonates a bank or other institutions and tricks the victim into disclosing sensitive information.
A known method to prevent phishing attacks is to use blacklists created from user reports and identified phishing e-mails.
The disadvantage of this method is that it is only effective against known phishing attacks.
Another known method to prevent phishing attacks is to display additional information about a website, e.g. its hosting location, since when it has been registered and a rank of a page.
The disadvantage of such a method is that they may overwhelm the user with the amount of information and may cause false positives with less popular websites.
The last group of known methods to prevent phishing attacks is based on e-mail filtering using e.g. Bayesian filters which filter suspicious e-mail messages or reformat them in a way that discloses their malicious intent. The disadvantage of such techniques is that they are only effective against phishing that is disseminated by using e-mails.
It is an object of the invention to provide improved solutions for internet and network security.
SUMMARY AND ADVANTAGES OF THE INVENTION
The present invention is directed to methods, a computer program and a computer system as defined in independent claims. Further embodiments of the invention are provided in the appended dependent claims.
According to one aspect of the present invention, there is presented a method for evaluating a network address, comprising the steps of:
- receiving a network address;
- generating derivatives of the received network address;
- assigning a trust level to the generated derivatives and the received network address;
- comparing the trust levels of the derivatives with the trust level of the received network address; and
- issuing a response based on the comparison.
This method allows the evaluation of the trustworthiness of network addresses in an efficient, reliable and flexible way. The method can detect untrustworthy network addresses automatically, i.e. independent from any user interaction. Furthermore, it allows the automatic detection of untrustworthy network addresses which are not known for being untrustworthy yet. According to another aspect of the present invention, there is presented a method for accessing a network address, comprising the steps of:
- requesting a network address,
- generating derivatives of the requested network address,
- assigning a trust level to the generated derivatives and the requested network address,
- comparing the trust levels of the derivatives with the trust level of the requested network address and
- issuing a response based on the comparison.
This method allows a secure accessing of network addresses in an efficient, reliable and flexible way. The method can detect automatically that a requested network address is not trustworthy and provide appropriate countermeasures. Furthermore, it allows the automatic detection of untrustworthy network addresses which are not known for being untrustworthy yet.
According to an embodiment of the invention the received, accessed or requested network address is the address of a web site or web page respectively. The application of the method according to this aspect of the invention for evaluation of the trustworthiness of webpages can enhance the internet security significantly. In particular it is an efficient and reliable method against phishing attacks.
According to a further embodiment of the invention the received, accessed or requested network address is a Uniform Resource Identifier (URI), in particular a Uniform Resource Locator (URL). URIs and URLs are standardized elements for addressing resources in the Internet.
The generated derivatives should be in some way similar to the network address that has been received or accessed and is targeted for evaluation. The similarity can be e.g. optical, structural or editorial. According to an embodiment of the invention, the derivatives are generated by means of at least two different methods. This further improves the security and reliability of the method. The more methods are used, the more derivatives can be generated.
According to a further embodiment of the invention derivatives which are optically similar to the received network address are generated by means of Optical Character Recognition (OCR).
OCR can be performed by several well established methods which analyze and recognize the characters of a scanned text. By applying these methods and/or adapted methods on the received network address, one or more network addresses which are optically similar to the received network address can be derived.
Another possibility instead of OCR is to create a database with characters that might look similar to a user. Such a solution can work faster, but is less general.
According to a further embodiment of the invention derivatives which are structurally similar to the received network address are generated by means of adding and/or removing and/or replacing prefixes, postfixes, punctuation marks and/or other common network address elements.
Common prefixes are e.g. "my", or "e-", common postfixes are e.g. "online", "24" and common punctuation marks are e.g. dashes.
According to a further embodiment of the invention derivatives which are editorially similar to the received network address are generated by means of compensating for typing errors.
For this embodiment several known methods which perform compensating of common typing errors can be used. This is in particular efficient against phishing attacks that use URLs that differ from a trustworthy URL only by a common typing error. According to a further embodiment of the invention derivatives are generated by means of changing the top level domain.
As more and more top level domains are created, the change of the top level domain is a promising target of phishing attacks. As an example, if a trusted website for the top level domains .de and .com exist, a phishing attack might be performed by using the top level domains .eu or .org or any other top level domain that is not used by the owner of the trusted website.
According to a further embodiment of the invention the trust level assignment is based on at least a first property and a second property of the generated derivatives and the received network address.
This enhances the reliability of the method, as the trust level is not only dependent from one property of the network address.
According to a further embodiment of the invention the trust level is assigned by means of a combination of at least two of the following properties of the received network address and the derivatives: the validity of the received network address and the derivatives, the rank of the received network address and the derivatives, the host location of the received network address and the derivatives, the creation date of the received network address and the derivatives, the character set of the received network address and the derivatives, belonging to a whitelist with trusted network addresses and/or belonging to a blacklist with untrusted network addresses.
The rank or page rank, sometimes abbreviated to PR, is a family of algorithms for assigning numerical weightings to hyperlinked documents or web pages, indexed by a search engine (PageRank is a trademark of Google Inc.). In general, the higher the page rank, the higher the importance of the webpage, the more trustworthy will the webpage be considered and the higher the assigned trust level. The host location is another possible criteria for assigning a trust level. The more trustworthy the host location, the higher the assigned trust level. Another possible property for assigning a trust level is the creation date of the domain. In general, domains which are rather old, are considered to be relatively trustworthy, while recently created domains are considered to be relatively untrustworthy. This is based on the fact that fraudulent websites are often only provided for a short period of time. It should be noted that with the method according to this embodiment of the invention the creation date of the domain is only one out of at least two criteria. Hence, the assigned trust level of a newly created website can be relatively high if the other properties get a high rating. The character set of the domain is another possible property. As an example, character sets that are different from the native character set, could be given a different trust level. Another property could be if the network address belongs to a whitelist with trusted network addresses or a blacklist with untrusted network adresses.
According to a further embodiment of the invention a first weighing coefficient is assigned to the first property and a second weighing coefficient is assigned to the second property and wherein the trust level assignment is based on a weighed combination of the first and the second property by means of the first and the second weighing coefficient.
This further enhances the reliability of the method. The first and the second property and all other used properties can be given a different weighing coefficient and hence a different influence on the trust level. The weighing coefficients can be adjusted over time and adapted according to the experience with the relevance of the different properties.
According to a further embodiment of the invention the response is based on the difference between the trust level of the received network address and the trust level of the derivatives. This further enhances the reliability of the method. It allows taking into account the individual situation of each case. The response is based on the relative trust level of the received network address, i.e. the trust level of the received network address is evaluated in relation to the trust level of the generated derivatives.
According to a further embodiment of the invention the response comprises the received network address or the content of the received network address respectively, if the difference between the trust level of the received network address and the trust level of the derivatives is greater than a predetermined threshold level or the response indicates that the received network address is untrustworthy, if the difference between the trust level of the received network address and the trust level of the derivatives is smaller than or equal to the predetermined threshold level.
This is a very efficient and reliable method. If the received network address is trustworthy, the trust level of the received network address will be relatively high compared to the trust level of the generated derivatives. In this case, the response would comprise the received network address or the content of the received network address, e.g. a requested webpage. If the received network address is not trustworthy, the trust level of the received network address will be relatively low compared to the trust level of the generated derivatives. In this case, the response would indicate that the received network address is untrustworthy. This can be done in several ways. One possibility would be to warn the user or the system administrator or the source of the evaluation request. Another possibility would be to suggest alternative network addresses that have a higher trust level. A further option would be to just block a received or requested network address or to issue automatically the network address which the user most likely intended to request.
According to a further embodiment of the invention the method is performed within a proxy server, within a browser or within a Domain Name System (DNS) server of a computer system. If the method is performed within a proxy server, all user requests for a webpage will be evaluated. If the webpage is not trustworthy, the proxy server will issue an appropriate response, e.g. a warning message indicating a phishing attack. This is transparent for the user and can be centrally administered.
Implementing the method within the browser is in particular advantageous for individual users who want to enhance their system security and protect themselves against phishing attacks.
Implementing the method within a DNS server can protect users by checking for phishing or other attacks at the moment the domain request is performed. In case of a phishing attack, a message "domain non-existent" can be returned or the user can be redirected to a page that warns the user and/ or suggests alternatives.
According to another aspect of the present invention, there is presented a computer program comprising instructions for carrying out the steps of the method according to anyone of claims 1 to 14 when said computer program is executed on a computer system.
According to another aspect of the present invention, there is presented a computer system comprising a computer for carrying out the steps of the method according to anyone of claims 1 to 14.
According to another aspect of the present invention, there is presented a method for deploying computing infrastructure, comprising integrating computer readable code into a computer system, wherein the code in combination with the computer system is capable of performing the following:
- requesting a network address,
- generating derivatives of the requested network address,
- assigning a trust level to the generated derivatives and the requested network address,
- comparing the trust levels of the derivatives with the trust level of the requested network address and - issuing a response based on the comparison.
This method allows to improve the security of computer systems in a reliable and efficient way. This method is particularly suited for service providers who offer information technology services.
According to another aspect of the present invention, there is presented a method for performing an analysis of the network communication traffic of a business entity, the method comprising the steps of:
- compiling a list of network addresses accessed by the business entity,
- generating derivatives of the accessed network addresses,
- assigning a trust level to the generated derivatives and the accessed network addresses,
- comparing the trust levels of the derivatives with the trust level of the accessed network addresses and
- compiling a list of accessed network addresses with low trustworthiness based on the comparison.
This method allows business entities or service providers to analyse security risks of business entities. Computer systems of business entities are more and more linked and interconnected with external networks, in particular with the Internet. This poses a serious threat on the data security. Doing an analysis of the network communication traffic with external networks such as the internet may reveal security risks and dangers. Once dangerous or untrustworthy network addresses have been detected, they can be put on a blacklist and the employees can be warned.
DESCRIPTION OF THE DRAWINGS
Preferred embodiments of the invention are described in detail below, by way of example only, with reference to the following schematic drawings. FIG. 1 shows a schematic illustration of a computer system according to an embodiment of the present invention. FIG. 2 shows a schematic illustration of a general flow chart of a method according to an embodiment of the present invention. FIG. 3 shows a schematic illustration of a specific flow chart of a method according to an embodiment of the present invention.
The drawings are provided for illustrative purpose only and do not necessarily represent practical examples of the present invention to scale.
With reference to Fig. 1, the general layout of a computer system 1 is described in which the invention can be used. In the figures, same reference signs are used to denote the same or like parts. Fig. 1 shows a person P, who uses a computer 2. The computer 2 executes as computer program a browser 3. The browser 3 comprises evaluation software that evaluates if requested network addresses are trustworthy. The evaluation software might be implemented as separate software tool as well. The computer 2 and the browser 3 are connectable for application-dependent interactions to a network 4. The network 4 can represent e.g. the Internet. The computer 2 can exchange information with other network users and data via the network 4 and by means of the browser 3. Fig. 1 shows as further network users a bank 5, a first business entity 6, a second business entity 7 and a malicious entity 8. The bank 5, the first business entity 6 and the second business entity 7 are trustworthy users of the network 4. The bank 5, the first business entity 6, the second business entity 7 and the malicious entity 8 have each an individual network or internet address, e.g. a URL. The person P has to enter this individual network address into his computer and can then communicate via the network 4 by means of the browser 3 with the respective network user.
Fig. 2 shows a schematic illustration of a general flow chart of a method according to an embodiment of the invention. The method can be performed e.g. as software program that runs on the computer 2 of Fig. 1. In this general example it is assumed that the person P wants to request a specific webpage. In step 10 the person P enters as network address 50 the Uniform Resource Locator (URL) of this webpage into the browser 3 of the computer 2. The browser 3 starts the evaluation software which receives and evaluates the trustworthiness of the requested URL 50. The security software generates in step 20 derivatives 60 of the requested URL 50. The generated derivatives 60 are a set of network addresses, i.e. in this example a set of URLs, which are derived from the requested URL 50 and are similar to the requested URL 50. The similarity can be e.g. optical, editorial or structural. Several algorithms for deriving derivatives 60 can be combined. Each of them may target one or more form of similarity. Optical similar network addresses can be constructed by performing Optical Character Recognition (OCR) on the requested network address (URL) 50. Structural similar network addresses can be generated by adding and/or removing and/or replacing common pre- and postfixes, punctuation marks and/or other common network address elements. Editorial similar network addresses can be generated by means of compensating for common typing errors. In addition, derivatives 60 can be generated by means of changing the top level domain.
One goal of this step 20 is to create a set of derivatives 60 of which one is the network address which the user intended to request, in case this is not the requested network address itself.
In a following step 30 all the generated derivatives 60 as well as the requested network address 50 are checked for trustworthiness by means of a set of properties of the requested network address 50 and the generated derivatives 60. Then a trust level is assigned to the requested network address 50 and to the generated derivatives 60. The trust level assignment is preferably based on at least a first property and a second property of the generated derivatives 60 and the requested network address 50. Such properties could be the validity, the page rank, the host location, the creation date, and/or the character set of the requested network address 50 and the derivatives 60. As another property it could be checked if the requested network address 50 and the derivatives 60 belong to a whitelist with trusted network addresses and/or to a blacklist with untrusted network addresses. Preferably the properties of the network addresses 50 and the derivatives 60 are given different relevance by means of weighing coefficients. The trust level assignment is then based on a weighed combination of the used properties of the network addresses. As an example, if the requested network address 50 or one of the derivatives 60 belongs to a blacklist, this will have a very high impact on the trust level, i.e. the trust level will be generally zero. As another example, the creation date of the requested network address 50 or the derivatives 60 will have a relatively low weighing factor and hence have lower influence on the assigned trust level.
In a following step 40 the trust level of the derivatives 60 is compared with the trust level of the requested network address 50 and a response is issued based on this comparison. If the requested network address 50 is trustworthy, the trust level of the requested network address 50 will be relatively high compared to the trust level of the generated derivatives 60. In this case, the response could comprise the requested network address 50, i.e. the requested webpage. If the requested network address 50 is not trustworthy, the trust level of the requested network address 50 will be relatively low compared to the trust level of the generated derivatives 60. In this case, the response could indicate that the requested network address 50 is untrustworthy. This can be done in several ways. One possibility would be to warn the person P. Another possibility would be to suggest alternative network addresses that have a higher trust level. A further option would be to just block the requested network address 50 or to issue automatically the network address which the user most likely intended to request.
Fig. 3 shows a schematic illustration of a specific flow chart of a method according to an embodiment of the invention. In this specific example it is assumed that the person P requests in step 10 as network address 50 the URL http://www.mybank-online.com. This URL belongs to a fraudulent webpage of the malicious entity 8 of Fig. 1. By means of this fraudulent webpage the malicious entity 8 wants to get sensitive information, such as credit card information, account numbers, account names and passwords, from the person P. This means the malicious entity 8 wants to perform a so called phishing-attack.
In step 20 the evaluation software of the browser 3 generates a set of similar derivatives 60 comprising as an example the URLs http://www.mybakn-online.com, http://www.my-bank-online.com, http://www.mybank-online.org, http://www.mybank.com, http://www.mybank.co.uk etc.
In step 30 different trust levels are assigned to the generated derivatives 60 and the requested network address (URL) 50:
http://www.mybakn-oniine.com: trust level 0 (non-existent) http://www.my-bank-online.com: trust level 5 http://www.mybank-online.org: trust level 2 http://www.mybank.com: trust level 30 http://www.mybank.co.uk: trust level 4 http://www.mybank-oniine.com: trust level 10
In step 40 the trust level of the derivatives 60 is compared with the trust level of the requested network address 50. In this example, the trust level "10" of the requested URL http://www.mybank-oniine.com is relatively low compared to the trust level "30" of the generated derivative http://www.mybank.com.
In this case the response is issued in form of a suggestion. It is suggested to issue the URL http://www.mybank.com instead of the requested URL http://www.mybank- online.com.
Any disclosed embodiment may be combined with one or several of the other embodiments shown and/or described. This is also possible for one or more features of the embodiments.
The present invention can be realized in hardware, software, or a combination of hardware and software. Any kind of computer system - or other apparatus adapted for carrying out the method described herein - is suited. A typical combination of hardware and software could be a general purpose computer system with a computer program that, when being loaded and executed, controls the computer system such that it carries out the methods described herein. The present invention can also be embedded in a computer program product, which comprises all the features enabling the implementation of the methods described herein, and which - when loaded in a computer system - is able to carry out these methods.
Computer program means or computer program in the present context mean any expression, in any language, code or notation, of a set of instructions intended to cause a system having an information processing capability to perform a particular function either directly or after either or both of the following a) conversion to another language, code or notation; b) reproduction in a different material form.

Claims

1. A method for evaluating a network address, comprising the steps of: receiving a network address (50); generating derivatives (60) of the received network address (50); assigning a trust level to the generated derivatives (60) and the received network address
(50); comparing the trust levels of the derivatives (60) with the trust level of the received network address (50); and issuing a response based on the comparison.
2. The method according to claim 1, wherein the received network address (50) is the address of a webpage.
3. The method according to claim 1 or 2, wherein the received network address (50) is a Uniform Resource Identifier (URI), in particular a Uniform Resource Locator (URL).
4. The method according to anyone of claims 1 to 3, wherein the derivatives (60) are generated by means of at least two different methods.
5. The method according to anyone of claims 1 to 4, wherein derivatives (60) which are optically similar to the received network address (50) are generated by means of Optical Character Recognition (OCR).
6. The method according to anyone of claims 1 to 5, wherein derivatives (60) which are structurally similar to the received network address (50) are generated by means of adding and/or removing prefixes, postfixes, punctuation marks, and/or other common network address elements.
7. The method according to anyone of claims 1 to 6, wherein derivatives (60) which are editorially similar to the received network address (50) are generated by means of compensating for typing errors.
8. The method according to anyone of claims 1 to 7, wherein derivatives (60) are generated by means of changing the top level domain.
9. The method according to anyone of claims 1 to 8, wherein the trust level assignment is based on at least a first property and a second property of the generated derivatives (60) and the received network address (50).
10. The method according to claim 9, wherein a first weighing coefficient is assigned to the first property and a second weighing coefficient is assigned to the second property and wherein the trust level assignment is based on a weighed combination of the first and the second property by means of the first and the second weighing coefficient.
11. The method according to claim 9, wherein the trust level is assigned by means of a combination of at least two of the following properties of the received network address (50) and the derivatives (60): the validity of the received network address (50) and the derivatives (60), the rank of the the received network address (50) and the derivatives (60), the host location of the received network address (50) and the derivatives (60), the creation date of the received network address (50) and the derivatives (60), the character set of the received network address (50) and the derivatives (60), belonging to a whitelist with trusted network addresses and/or belonging to a blacklist with untrusted network addresses.
12. The method according to anyone of claims 1 to 11, wherein the response is based on the difference between the trust level of the received network address (50) and the trust level of the derivatives (60).
13. The method according to anyone of claims 1 to 12, wherein the response comprises the received network address (50) or the content of the received network address (50) respectively, if the difference between the trust level of the received network address (50) and the trust level of the derivatives (60) is greater than a predetermined threshold level or the response indicates that the received network address (50) is untrustworthy, if the relative difference between the trust level of the received network address (50) and the trust level of the derivatives (60) is smaller than or equal to the predetermined threshold level.
14. The method according to anyone of claims 1 to 13, wherein the method is performed within a proxy server, within a browser (3) or within a Domain Name System (DNS)- server of a computer system (1).
15. A computer program (3) comprising instructions for carrying out the steps of the method according to anyone of claims 1 to 14 when said computer program (3) is executed on a computer system (1).
16. A computer system (1) comprising a computer (2) for carrying out the steps of the method according to anyone of claims 1 to 14.
17. A method for accessing a network address, comprising the steps of: requesting a network address (50); generating derivatives (60) of the requested network address (50); assigning a trust level to the generated derivatives (60) and the requested network address
(50); comparing the trust levels of the derivatives (60) with the trust level of the requested network address (50); and issuing a response based on the comparison.
18. A method for deploying computing infrastructure, comprising integrating computer readable code into a computer system (1), wherein the code in combination with the computer system (1) is capable of performing the following: requesting a network address (50); generating derivatives (60) of the requested network address (50); assigning a trust level to the generated derivatives (60) and the requested network address
(50); comparing the trust levels of the derivatives (60) with the trust level of the requested network address (50); and issuing a response based on the comparison.
19. A method for performing an analysis of the network communication traffic of a business entity (5, 6, 7), the method comprising the steps of: compiling a list of network addresses (50) accessed by the business entity (5, 6, 7); generating derivatives (60) of the accessed network addresses (50); assigning a trust level to the generated derivatives (60) and the accessed network addresses (50); comparing the trust levels of the derivatives (60) with the trust level of the accessed network addresses (50); and compiling a list of accessed network addresses (50) with low trustworthiness based on the comparison.
PCT/IB2006/054801 2005-12-23 2006-12-13 Method for evaluating and accessing a network address WO2007072320A2 (en)

Priority Applications (6)

Application Number Priority Date Filing Date Title
CN2006800479749A CN101341717B (en) 2005-12-23 2006-12-13 Method for evaluating and accessing a network address
AT06842475T ATE470306T1 (en) 2005-12-23 2006-12-13 METHOD FOR NETWORK ADDRESS EVALUATION AND ACCESS
EP06842475A EP1964364B1 (en) 2005-12-23 2006-12-13 Method for evaluating and accessing a network address
US12/158,773 US8201259B2 (en) 2005-12-23 2006-12-13 Method for evaluating and accessing a network address
DE602006014726T DE602006014726D1 (en) 2005-12-23 2006-12-13 METHOD FOR NETWORK ADDRESS EVALUATION AND ACCESS
JP2008546740A JP4596556B2 (en) 2005-12-23 2006-12-13 Methods for evaluating and accessing network addresses

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
EP05112935 2005-12-23
EP05112935.1 2005-12-23

Publications (2)

Publication Number Publication Date
WO2007072320A2 true WO2007072320A2 (en) 2007-06-28
WO2007072320A3 WO2007072320A3 (en) 2007-09-20

Family

ID=38015370

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/IB2006/054801 WO2007072320A2 (en) 2005-12-23 2006-12-13 Method for evaluating and accessing a network address

Country Status (8)

Country Link
US (1) US8201259B2 (en)
EP (1) EP1964364B1 (en)
JP (1) JP4596556B2 (en)
KR (1) KR100935776B1 (en)
CN (1) CN101341717B (en)
AT (1) ATE470306T1 (en)
DE (1) DE602006014726D1 (en)
WO (1) WO2007072320A2 (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2017019355A1 (en) * 2015-07-24 2017-02-02 Mastercard International Incorporated Method for securing an electronic transaction request from a computing device for fraud detection

Families Citing this family (31)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1933522B1 (en) * 2006-12-11 2013-10-23 Sap Ag Method and system for authentication
US9521161B2 (en) * 2007-01-16 2016-12-13 International Business Machines Corporation Method and apparatus for detecting computer fraud
US8763136B2 (en) * 2007-03-22 2014-06-24 Red Hat, Inc. Privacy enhanced browser
US8608487B2 (en) * 2007-11-29 2013-12-17 Bank Of America Corporation Phishing redirect for consumer education: fraud detection
US8271424B2 (en) * 2008-05-15 2012-09-18 International Business Machines Corporation Privacy and confidentiality preserving reporting of URLs
US9461966B2 (en) * 2009-05-08 2016-10-04 F-Secure Oyj Method and apparatus for rating URLs
GB2479565A (en) * 2010-04-14 2011-10-19 Mtld Top Level Domain Ltd Providing mobile versions of web resources
US8800033B2 (en) * 2011-05-26 2014-08-05 International Business Machines Corporation Rotation of web site content to prevent E-mail spam/phishing attacks
CN102316099B (en) * 2011-07-28 2014-10-22 中国科学院计算机网络信息中心 Network fishing detection method and apparatus thereof
CN102638448A (en) * 2012-02-27 2012-08-15 珠海市君天电子科技有限公司 Method for judging phishing websites based on non-content analysis
CN102647417B (en) * 2012-03-31 2017-03-29 北京奇虎科技有限公司 The implementation method of network access, device and system and network system
CN103685174B (en) * 2012-09-07 2016-12-21 中国科学院计算机网络信息中心 A kind of detection method for phishing site of independent of sample
US9203849B2 (en) 2013-12-04 2015-12-01 Apple Inc. Preventing URL confusion attacks
US10127388B1 (en) * 2014-08-26 2018-11-13 Amazon Technologies, Inc. Identifying visually similar text
CN104836864A (en) * 2015-05-12 2015-08-12 广东睿江科技有限公司 Domain name access error correction method and device
US11762989B2 (en) 2015-06-05 2023-09-19 Bottomline Technologies Inc. Securing electronic data by automatically destroying misdirected transmissions
US10601865B1 (en) * 2015-09-30 2020-03-24 Fireeye, Inc. Detection of credential spearphishing attacks using email analysis
US20170163664A1 (en) 2015-12-04 2017-06-08 Bottomline Technologies (De) Inc. Method to secure protected content on a mobile device
CN106066850A (en) * 2016-05-30 2016-11-02 乐视控股（北京）有限公司 A kind of content processing method and device
US11163955B2 (en) 2016-06-03 2021-11-02 Bottomline Technologies, Inc. Identifying non-exactly matching text
US11575707B2 (en) * 2017-12-18 2023-02-07 Intsights Cyber Intelligence Ltd. System and method for blocking phishing attempts in computer networks
JP6947307B2 (en) * 2018-07-25 2021-10-13 日本電信電話株式会社 Analytical equipment, analysis method and analysis program
JP6998294B2 (en) * 2018-12-12 2022-01-18 Kddi株式会社 Detection device, detection method and detection program
US20220245639A1 (en) * 2019-01-11 2022-08-04 Bottomline Technologies (De) Inc. Virtual Fraud Detection
US11416713B1 (en) 2019-03-18 2022-08-16 Bottomline Technologies, Inc. Distributed predictive analytics data set
US11042555B1 (en) 2019-06-28 2021-06-22 Bottomline Technologies, Inc. Two step algorithm for non-exact matching of large datasets
US11269841B1 (en) 2019-10-17 2022-03-08 Bottomline Technologies, Inc. Method and apparatus for non-exact matching of addresses
US11449870B2 (en) 2020-08-05 2022-09-20 Bottomline Technologies Ltd. Fraud detection rule optimization
US11694276B1 (en) 2021-08-27 2023-07-04 Bottomline Technologies, Inc. Process for automatically matching datasets
US11544798B1 (en) 2021-08-27 2023-01-03 Bottomline Technologies, Inc. Interactive animated user interface of a step-wise visual path of circles across a line for invoice management
US20230188563A1 (en) * 2021-12-09 2023-06-15 Blackberry Limited Identifying a phishing attempt

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2004055632A2 (en) * 2002-12-13 2004-07-01 Wholesecurity, Inc. Method, system, and computer program product for security within a global computer network
WO2005091107A1 (en) * 2004-03-16 2005-09-29 Netcraft Limited Security component for use with an internet browser application and method and apparatus associated therewith

Family Cites Families (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5892919A (en) * 1997-06-23 1999-04-06 Sun Microsystems, Inc. Spell checking universal resource locator (URL) by comparing the URL against a cache containing entries relating incorrect URLs submitted by users to corresponding correct URLs
US7073193B2 (en) * 2002-04-16 2006-07-04 Microsoft Corporation Media content descriptions
US7130923B2 (en) * 2002-07-01 2006-10-31 Avaya Technology Corp. Method and apparatus for guessing correct URLs using tree matching
US20040078422A1 (en) * 2002-10-17 2004-04-22 Toomey Christopher Newell Detecting and blocking spoofed Web login pages
US7376752B1 (en) * 2003-10-28 2008-05-20 David Chudnovsky Method to resolve an incorrectly entered uniform resource locator (URL)
CN1684460A (en) * 2004-04-18 2005-10-19 西南科技大学 Sementic indexing method for network information resource
US8041769B2 (en) * 2004-05-02 2011-10-18 Markmonitor Inc. Generating phish messages
US7502923B2 (en) * 2004-09-16 2009-03-10 Nokia Corporation Systems and methods for secured domain name system use based on pre-existing trust
US20060168066A1 (en) * 2004-11-10 2006-07-27 David Helsper Email anti-phishing inspector
US20060123478A1 (en) * 2004-12-02 2006-06-08 Microsoft Corporation Phishing detection, prevention, and notification
US7653812B2 (en) * 2004-12-09 2010-01-26 Microsoft Corporation Method and system for evaluating confidence in a sending domain to accurately assign a trust that a communication is not unwanted
US7698442B1 (en) * 2005-03-03 2010-04-13 Voltage Security, Inc. Server-based universal resource locator verification service
JP2006285844A (en) * 2005-04-04 2006-10-19 Katsuyoshi Nagashima Phishing fraud prevention system
US20060277591A1 (en) * 2005-06-01 2006-12-07 Arnold William C System to establish trust between policy systems and users
JP4429971B2 (en) * 2005-06-03 2010-03-10 日本電信電話株式会社 Legitimate site verification method, apparatus, and program
JP4950606B2 (en) * 2005-09-30 2012-06-13 トレンドマイクロ株式会社 COMMUNICATION SYSTEM, SECURITY MANAGEMENT DEVICE, AND ACCESS CONTROL METHOD
JP4781922B2 (en) * 2005-12-01 2011-09-28 日本電信電話株式会社 Link information verification method, system, apparatus, and program
US20070136806A1 (en) * 2005-12-14 2007-06-14 Aladdin Knowledge Systems Ltd. Method and system for blocking phishing scams

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2004055632A2 (en) * 2002-12-13 2004-07-01 Wholesecurity, Inc. Method, system, and computer program product for security within a global computer network
WO2005091107A1 (en) * 2004-03-16 2005-09-29 Netcraft Limited Security component for use with an internet browser application and method and apparatus associated therewith

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
LIU WENYIN ET AL: "Phishing Webpage Detection" PROCEEDINGS. EIGHTH INTERNATIONAL CONFERENCE ON DOCUMENT ANALYSIS AND RECOGNITION, SEOUL, KOREA, AUG 31 -SEP 1 2005, PISCATAWAY, NJ, USA, IEEE, 31 August 2005 (2005-08-31), pages 560-564, XP010878009 ISBN: 0-7695-2420-6 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2017019355A1 (en) * 2015-07-24 2017-02-02 Mastercard International Incorporated Method for securing an electronic transaction request from a computing device for fraud detection

Also Published As

Publication number Publication date
US8201259B2 (en) 2012-06-12
KR20080078693A (en) 2008-08-27
EP1964364B1 (en) 2010-06-02
JP4596556B2 (en) 2010-12-08
CN101341717B (en) 2011-12-28
CN101341717A (en) 2009-01-07
ATE470306T1 (en) 2010-06-15
KR100935776B1 (en) 2010-01-06
DE602006014726D1 (en) 2010-07-15
WO2007072320A3 (en) 2007-09-20
EP1964364A2 (en) 2008-09-03
US20090094677A1 (en) 2009-04-09
JP2009521047A (en) 2009-05-28

Similar Documents

Publication Publication Date Title
EP1964364B1 (en) Method for evaluating and accessing a network address
Jain et al. A novel approach to protect against phishing attacks at client side using auto-updated white-list
Tan et al. PhishWHO: Phishing webpage detection via identity keywords extraction and target domain name finder
RU2744671C2 (en) System and methods for detecting network fraud
Jain et al. Two-level authentication approach to protect from phishing attacks in real time
US8578481B2 (en) Method and system for determining a probability of entry of a counterfeit domain in a browser
US7769820B1 (en) Universal resource locator verification services using web site attributes
US8615802B1 (en) Systems and methods for detecting potential communications fraud
Alkhozae et al. Phishing websites detection based on phishing characteristics in the webpage source code
US8769706B2 (en) System and method for user to verify a network resource address is trusted
US20130263263A1 (en) Web element spoofing prevention system and method
US20090089859A1 (en) Method and apparatus for detecting phishing attempts solicited by electronic mail
Kang et al. Advanced white list approach for preventing access to phishing sites
Gupta et al. Prevention of cross-site scripting vulnerabilities using dynamic hash generation technique on the server side
Hawanna et al. A novel algorithm to detect phishing URLs
Thaker et al. Detecting phishing websites using data mining
US11496510B1 (en) Fully automated target identification of a phishing web site
JP4617243B2 (en) Information source verification method and apparatus
WO2023157191A1 (en) Communication system, gateway device, terminal device, and program
Rahamathunnisa et al. Preventing from phishing attack by implementing url pattern matching technique in web
Sonowal et al. What Does a Phishing URL Look Like?
Bhardwaj et al. Web-Based Classification for Safer Browsing
Kim et al. A quantitative approach to estimate a website security risk using whitelist
Saric et al. Hyperlink Hijacking: Exploiting Erroneous URL Links to Phantom Domains
David Transition from Observation to Knowledge to Intelligence

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 200680047974.9

Country of ref document: CN

121 Ep: the epo has been informed by wipo that ep was designated in this application
WWE Wipo information: entry into national phase

Ref document number: 2008546740

Country of ref document: JP

Ref document number: 1020087015221

Country of ref document: KR

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2006842475

Country of ref document: EP

WWP Wipo information: published in national office

Ref document number: 2006842475

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 12158773

Country of ref document: US