WO2016034048A1 - 一种实现网络防钓鱼的方法 - Google Patents

一种实现网络防钓鱼的方法 Download PDF

Info

Publication number
WO2016034048A1
WO2016034048A1 PCT/CN2015/087742 CN2015087742W WO2016034048A1 WO 2016034048 A1 WO2016034048 A1 WO 2016034048A1 CN 2015087742 W CN2015087742 W CN 2015087742W WO 2016034048 A1 WO2016034048 A1 WO 2016034048A1
Authority
WO
WIPO (PCT)
Prior art keywords
url
browser
phishing
control
whitelist
Prior art date
Application number
PCT/CN2015/087742
Other languages
English (en)
French (fr)
Inventor
陆舟
于华章
Original Assignee
飞天诚信科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 飞天诚信科技股份有限公司 filed Critical 飞天诚信科技股份有限公司
Priority to US15/502,797 priority Critical patent/US10659494B2/en
Publication of WO2016034048A1 publication Critical patent/WO2016034048A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1483—Countermeasures against malicious traffic service impersonation, e.g. phishing, pharming or web spoofing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H04L67/146—Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/168—Implementing security features at a particular protocol layer above the transport layer

Definitions

  • the invention relates to a method for realizing network anti-phishing, belonging to the field of information security.
  • the online banking assistant is based on the existing manufacturer's certificate driver, CSP software, online banking and certificate control automation installation software and Microsoft related patches. It develops a software for all online banking and certificates with embedded programming software and utilization. The program calls the downloaded software.
  • the online banking assistant integrates the drivers of various manufacturers' certificates, CSP software, controls and related patches from Microsoft. After the customer downloads and installs the online banking assistant through the bank website and runs it, the software will automatically guide the customer to install.
  • the tool will search for the operating system, certificate driver and CSP according to the "U shield" voucher number entered by the customer, download and install the certificate driver, CSP and online banking controls step by step, and prompt the customer to download and install the operating system patch and modify the IE settings. . This eliminates the need for customers to download multiple software before, and only one software tool can achieve integrated installation, greatly improving the usability of "U shield".
  • Phishing is a kind of cyber fraud. It means that criminals use various means to fake the URL address of the real website and the content of the page, or use the vulnerability in the real website server program to insert dangerous HTML code into some pages of the site. This will defraud the user's bank or credit card account, password and other private information.
  • the existing network anti-phishing control is only judged according to the black and white list issued by the server. For the non-black and white list, the hacker will use this vulnerability to steal the user's bank information, resulting in incalculable loss and security. low.
  • the object of the present invention is to provide a method for implementing network anti-phishing, which can implement black and white list processing, and add fuzzy query to realize processing of non-black and white lists, preventing hackers from stealing by using URLs similar to white lists.
  • User's bank information increases security.
  • the present invention provides a method for implementing network anti-phishing, including: a browser startup, loading a network anti-phishing control, and the network anti-phishing control performs the following operations:
  • Step S1 The network anti-phishing control obtains a blacklist and a whitelist
  • Step S2 The network anti-phishing control waits to receive the URL of the browser, and determines the URL of the browser. If the URL is in the blacklist, the browser is prevented from loading the URL of the browser, and the process returns to step S2. In the white list, the browser is notified to load the URL of the browser, and returns to step S2, otherwise step S3 is performed;
  • Step S3 The network anti-phishing control determines whether the URL of the browser and the URL in the whitelist meet the preset fuzzy matching condition, and if yes, step S4 is performed, otherwise the browser is notified to load the browser. URL, returning to step S2;
  • Step S4 The network anti-phishing control prompts the user to perform a dangerous operation, and detects whether the user chooses to continue. If yes, the browser is notified to load the URL of the browser, and step S5 is performed; otherwise, the browser is prevented from loading the browser. URL, returning to step S2;
  • Step S5 The network anti-phishing control acquires, from the whitelist, a preset account combination corresponding to a URL of the browser whose URL conforms to a preset fuzzy matching condition;
  • Step S6 The network anti-phishing control waits to receive the button information input by the user, and after receiving the button information input by the user, determines whether the received button information is a numeric key, and if yes, performs step S7, otherwise proceeds to step S6;
  • Step S7 The network anti-phishing control determines whether the input focus is an input box control, and if so, step S8 is performed, otherwise returns to step S6;
  • Step S8 the network anti-phishing control acquires button information input by the user in the input box control, and determines the Whether the button information meets the preset account combination, if yes, step S9 is performed, otherwise returns to step S6;
  • Step S9 The network anti-phishing control prompts the user to perform a dangerous operation, and detects whether the user chooses to continue. If yes, the browser is notified to jump to the user access interface, and returns to step S2. Otherwise, the browser is prevented from loading the user access interface, and returns. Step S2.
  • the step S1 includes: the network anti-phishing control reads an installation path from the registry, and obtains the blacklist, the whitelist, and the preset account combination from the installation path, and saves .
  • the step S1 further includes:
  • Step a1 The network anti-phishing control determines whether the blacklist, the whitelist, and the preset account combination in the installation path exist, and if yes, obtains the blacklist from the installation path. And combining the white list and the preset account, and saving, performing step S2, otherwise performing step a2;
  • Step a2 The network anti-phishing control notifies the online banking assistant background service to download a blacklist, a whitelist, and a preset account combination from the server, and save the received blacklist, whitelist, and preset account combination to the installation path. Go to step S2.
  • the step a1 is further configured to: determine, by the network anti-phishing control, whether the blacklist, the whitelist, and the preset account combination in the installation path need to be updated, and if yes, execute In step a2, the blacklist, the whitelist, and the preset account combination are obtained from the installation path, and saved, and step S2 is performed.
  • the step a1 is further configured to: determine, by the network anti-phishing control, whether the blacklist, the whitelist, and the preset account combination in the installation path are tampered with, and if yes, execute In step a2, the blacklist, the whitelist, and the preset account combination are obtained from the installation path, and saved, and step S2 is performed.
  • the step a2 is specifically:
  • Step b1 The network anti-phishing control notifies the online banking assistant background service to download a blacklist, a whitelist, and a preset account combination from the server;
  • Step b2 After receiving the download notification of the network anti-phishing control, the online banking assistant background service notifies the server to download a blacklist, a whitelist, and a preset account combination;
  • Step b3 After receiving the download notification of the online banking assistant background service, the server obtains an encrypted blacklist, a whitelist, and an encrypted preset account combination, and sends the encrypted account combination to the online banking assistant background service.
  • Step b4 The online banking assistant background service sends the encrypted blacklist, the whitelist, and the encrypted preset account combination to the network anti-phishing control;
  • Step b5 After the network anti-phishing control receives the encrypted blacklist, the whitelist, and the encrypted preset account combination, the encrypted blacklist, the whitelist, and the encrypted preset account combination are Do the default decryption calculation to get the decrypted data;
  • Step b6 The network anti-phishing control intercepts data of a preset length from the decrypted data as a first digest value, performs digest calculation on data other than the first digest value in the decrypted data, and generates a first Two abstract values;
  • Step b7 The network anti-phishing control determines whether the first digest value is the same as the second digest value, and if yes, saves the encrypted blacklist, whitelist, and the encrypted preset account combination to the installation. In the path, step S2 is performed, otherwise step b8 is performed;
  • Step b8 The network anti-phishing control determines whether the download notification has been resent a preset number of times, and if so, ends, otherwise step b1 is performed;
  • the encrypted blacklist, whitelist, and encrypted preset account combination are decrypted, and a blacklist, a whitelist, and a preset account combination are obtained and saved.
  • the step S1 includes: the network anti-phishing control acquires a general blacklist, a universal whitelist, a customized whitelist corresponding to each bank information, and a customized blacklist;
  • the step S2 specifically includes: the network anti-phishing control waits to receive a URL of the browser, and determines the browsing. If the URL of the device is in the general blacklist or the customized blacklist corresponding to each bank, the browser is prevented from loading the URL of the browser, and the process returns to step S2, if the universal whitelist or the respective In the customized white list corresponding to the bank information, the browser is notified to load the URL of the browser, and returns to step S2, otherwise step S3 is performed;
  • the browser is notified to load the URL of the browser, and the method further includes: the network anti-phishing control acquires and determines that the URL of the browser matches the preset fuzzy matching condition in the white list. If the URL is in the general whitelist, the preset account combination corresponding to all the bank information is obtained, step S6 is performed, and if it is in the customized white list corresponding to the bank information, step S5 is performed;
  • the step S5 is specifically: the network anti-phishing control acquires, from the memory, bank information corresponding to the URL in the white list that meets the preset fuzzy matching condition of the URL of the browser, and acquires the bank information corresponding to the bank information.
  • the default account combination is specifically: the network anti-phishing control acquires, from the memory, bank information corresponding to the URL in the white list that meets the preset fuzzy matching condition of the URL of the browser, and acquires the bank information corresponding to the bank information.
  • the default account combination is specifically: the network anti-phishing control acquires, from the memory, bank information corresponding to the URL in the white list that meets the preset fuzzy matching condition of the URL of the browser, and acquires the bank information corresponding to the bank information.
  • the default account combination is specifically: the network anti-phishing control acquires, from the memory, bank information corresponding to the URL in the white list that meets the preset fuzzy matching condition of the URL of the browser, and acquires the bank information corresponding to the bank information.
  • the default account combination is specifically
  • the step S1 includes: the network anti-phishing control acquires a customized whitelist and a customized blacklist;
  • the step S2 includes: the network anti-phishing control waits to receive the URL of the browser, and determines the URL of the browser. If the URL is in the customized blacklist, the browser is prevented from loading the URL of the browser. Returning to step S2, if it is in the customized white list, notifying the browser to load the URL of the browser, returning to step S2, otherwise performing step S3;
  • the step S5 is specifically: the network anti-phishing control acquires bank information corresponding to the URL in the customized white list that matches the URL of the browser according to a preset fuzzy matching condition, and acquires a pre-corresponding to the bank information. Set the account combination.
  • the blocking browser loads the URL of the browser, specifically: the network anti-phishing control closes a tab corresponding to the URL of the browser or loads a tab corresponding to the browser URL as Empty page.
  • the step S6 is: determining whether the difference between the URL of the browser and the character of the URL in the whitelist is not greater than a preset difference, and if yes, complying with a preset fuzzy matching condition, performing Step S4, otherwise, the preset fuzzy matching condition is not met, and the browser is notified to load the URL of the browser, and the process returns to step S2.
  • the determining whether the difference between the URL of the browser and the character of the URL in the whitelist is not greater than a preset difference, specifically:
  • Step 1 The network anti-phishing control obtains an unprocessed URL from the whitelist, and uses the unprocessed URL as the current URL.
  • Step 2 The network anti-phishing control acquires a first character string length of the current URL and a second character string length of the URL of the browser, and determines a difference between the length of the first character string and the length of the second character string. Whether it is greater than the preset difference, if yes, step 4 is performed, otherwise step 3 is performed;
  • Step 3 The network anti-phishing control determines whether the difference between the URL of the browser and the character of the current URL is not greater than a preset difference, and if so, the URL of the browser and the whitelist The URL conforms to the preset fuzzy matching condition, and step S4 is performed; otherwise, step 4 is performed;
  • Step 4 The network anti-phishing control determines whether there is an unprocessed URL in the whitelist. If yes, step 1 is performed. Otherwise, the URL of the browser does not meet the preset fuzzy matching condition, and the browser is notified to load. The URL of the browser returns to step S2.
  • the step 3 is specifically:
  • Step c1 The network anti-phishing control constructs a matrix whose number of rows is the length of the first string plus 1, the number of columns is the length of the second string plus 1, and the matrix element values are all zero, and the first row of the matrix corresponds The matrix element value is initialized to 0 to the first string length, and the matrix element value corresponding to the first column of the matrix is initialized to 0 to the second string length;
  • Step c2 The network anti-phishing control obtains the current row and the current column that are not updated from the matrix, obtains the current row character corresponding to the current URL according to the current row, and obtains the current column character corresponding to the browser URL according to the current column. ;
  • Step c3 The network anti-phishing control determines whether the current line character is the same as the current column character, if yes, the added value is set to 0, step c4 is performed, otherwise the added value is set to 1, and step c4 is performed;
  • Step c4 The network anti-phishing control calculates the value of the current row minus 1 and the matrix element corresponding to the current column plus 1, and the obtained value As the first value, the value of the matrix element corresponding to the current row and the current column minus 1 is calculated, and the obtained value is used as the second value, and the value of the matrix element corresponding to the current row minus 1 and the current column minus 1 is calculated, and the obtained value is obtained. The value is taken as the third value;
  • Step c5 The network anti-phishing control updates the matrix element values corresponding to the current row and the current column according to the minimum values of the first value, the second value, and the third value;
  • Step c6 The network anti-phishing control determines whether there is an unupdated matrix element value, and if yes, returns to step c4, otherwise performs step c7;
  • Step c7 The network anti-phishing control obtains the number of rows as the length of the first string plus 1, and the number of columns is the value of the matrix element corresponding to the length of the second string plus one, and determines whether the value of the matrix element is less than or equal to the preset difference. If yes, the URL of the browser conforms to the preset fuzzy matching condition, and step S4 is performed; otherwise, step 4 is performed.
  • the method further includes: the network anti-phishing control saves the URL of the browser to the blacklist, and the network anti-phishing control notifies the online banking assistant
  • the background service sends the URL of the browser to the server, and the server manually detects the number of URLs of the browser after a predetermined time, and when the number of URLs of the browser reaches a preset value, the browsing is performed.
  • the URL of the device is saved to the encrypted blacklist and whitelist of the server.
  • the method further includes: determining whether the user's selection is detected within a preset time, and if yes, detecting whether the user selects to continue, otherwise preventing the browser from loading The URL of the browser returns to step S2;
  • step S9 the user is prompted to perform a dangerous operation, and detecting whether the user selects to continue, further includes: determining whether the user's selection is detected within the preset time, and if yes, detecting whether the user chooses to continue, otherwise Prevent the browser from loading the user access interface, and return to step S2.
  • the method further includes: the network anti-phishing control determines whether the input box control is an input password control, and if yes, returns to step S6, otherwise performs step S8.
  • the processing of the black and white list can be realized, but also the fuzzy query is added, and the URL in the non-black and white list can be processed to prevent the hacker from stealing the user's bank information by fraudulating the URL similar to the whitelist, and increasing Security.
  • FIG. 1 is a flowchart of a method for implementing network anti-phishing according to Embodiment 1 of the present invention
  • Embodiment 2 is a flowchart of another method for implementing network anti-phishing provided by Embodiment 2 of the present invention.
  • step 103 in Embodiment 2 of the present invention is a detailed flowchart of step 103 in Embodiment 2 of the present invention.
  • step 109 is a detailed flowchart of step 109 in the second embodiment of the present invention.
  • FIG. 5 is a flowchart of still another method for implementing network anti-phishing provided by Embodiment 3 of the present invention.
  • a first embodiment of the present invention provides a method for implementing network anti-phishing. As shown in FIG. 1 , the method includes: starting a browser, loading a network anti-phishing control, and the network anti-phishing control (hereinafter referred to as a control) performs the following operations:
  • Step S1 The control obtains a blacklist and a whitelist
  • the installation path is obtained from the registry, and the blacklist and whitelist are obtained from the installation path.
  • the method may also be: obtaining an installation path from the registry, obtaining an encrypted blacklist and a whitelist from the installation path, decrypting the encrypted blacklist and whitelist, and obtaining a blacklist and a whitelist and saving;
  • the blacklist and the whitelist in the installation path includes the information of the plurality of banks
  • the blacklist and the whitelist are obtained from the blacklist and the whitelist, including the general blacklist, the universal whitelist, and the bank information.
  • the blacklist and the whitelist in the installation path only includes the information of the specific bank
  • the blacklist and the whitelist are obtained from the blacklist and the whitelist, specifically, the customized blacklist and the customized whitelist corresponding to the bank information are obtained;
  • Step S2 The control waits to receive the URL of the browser, and determines the URL of the browser. If it is in the blacklist, the browser is prevented from loading the URL of the browser, and the process returns to step S2. If it is in the white list, the browser is notified to load. The URL of the browser returns to step S2, otherwise step S3 is performed;
  • the blacklist and whitelist in the installation path includes information of multiple banks, if the URL of the browser is in the general blacklist or the customized blacklist corresponding to each bank information, the browser is prevented from loading the browser.
  • URL if the URL of the browser is in the general white list or the customized white list corresponding to each bank information, the browser is notified to load the URL of the browser;
  • the blacklist and the list in the installation path only includes the information of the specific bank, if the URL of the browser is in the customized blacklist corresponding to the bank information, the browser is prevented from loading the URL of the browser, if the browser The URL is in the customized white list corresponding to the bank information, and the browser is notified to load the URL of the browser;
  • Step S3 The control determines whether the URL of the browser and the URL in the whitelist meet the preset fuzzy matching condition. If yes, step S4 is performed; otherwise, the browser is notified to load the URL of the browser, and the process returns to step S2. ;
  • the black and white list in the installation path includes the information of the plurality of banks, it is determined whether the URL of the browser and the URL in the white list meet the preset fuzzy matching condition, specifically: determining the browsing. Whether the URL of the device and the URL of the customized whitelist corresponding to the general whitelist or each bank information meet the preset fuzzy matching condition;
  • the blacklist and the list in the installation path only includes the information of the specific bank, it is determined whether the URL of the browser and the URL in the whitelist meet the preset fuzzy matching condition, specifically: determining the browser Whether the URL in the customized whitelist corresponding to the bank information matches the preset fuzzy matching condition;
  • Step S4 The control prompts the user to perform a dangerous operation, and detects whether the user chooses to continue. If yes, the browser is notified to load the URL of the browser, and step S5 is performed; otherwise, the browser is prevented from loading the URL of the browser, and the step is returned. S2;
  • Step S5 The control acquires, from the whitelist, a preset account combination corresponding to the URL of the browser whose URL conforms to the preset fuzzy matching condition;
  • step S5 is specifically: obtaining bank information corresponding to the URL of the browser whose URL matches the preset fuzzy matching condition from the white list. Obtaining a preset account combination corresponding to the bank information;
  • step S5 is specifically: obtaining, from the white list, the specific bank corresponding to the URL of the browser whose URL matches the preset fuzzy matching condition. Default account combination;
  • Step S6 The control waits to receive the button information input by the user, and after receiving the button information input by the user, determines whether the received button information is a numeric key, and if so, proceeds to step S7, otherwise proceeds to step S6;
  • Step S7 the control determines whether the input focus is an input box control, and if so, step S8 is performed, otherwise returns to step S6;
  • Step S8 The control obtains the button information input by the user in the input box control, determines whether the button information meets the preset account combination, and if so, proceeds to step S9, otherwise returns to step S6;
  • Step S9 The control prompts the user to perform a dangerous operation, detecting whether the user chooses to continue, and if so, notifying The browser jumps to the user access interface, and returns to step S2. Otherwise, the browser is prevented from loading the user access interface, and the process returns to step S2.
  • the second embodiment of the present invention provides a method for implementing network anti-phishing. As shown in FIG. 2, the method includes: starting a browser, loading a network anti-phishing control, and the network anti-phishing control (hereinafter referred to as a control) performs the following operations:
  • Step 101 The control reads the installation path from the registry
  • the installation path is used to identify the storage location of the encrypted blacklist, whitelist, and preset account combination in the memory
  • the blacklist and the whitelist are included in the installation path (the blacklist and the whitelist can be saved in a black and white list file, and can also be saved separately) and a plurality of preset account combinations, in the blacklist and the whitelist.
  • the URL includes a general black and white list of all banks and a customized black and white list corresponding to a single bank information, and each bank information corresponds to a preset account combination;
  • Step 102 The control determines whether the blacklist, whitelist, and preset account combination in the installation path exists. If yes, step 104 is performed; otherwise, step 103 is performed;
  • Step 103 The control informs the online banking assistant background service to download the blacklist, whitelist, and preset account combination from the server, and save the received encrypted blacklist, whitelist, and preset account combination in the installation path, and perform step 104;
  • the online banking assistant background service after receiving the download notification sent by the network anti-phishing control, notifies the server to download the blacklist, the whitelist, and the preset account combination, and waits until the blacklist, the whitelist, and the preset account combination are downloaded. After that, check whether the blacklist, the whitelist, and the preset account combination have been tampered with. If yes, continue to notify the server to download. Otherwise, save the encrypted blacklist, whitelist, and preset account combination to the installation path. 104;
  • the step 103 is specifically:
  • Step 103-1 The control notifies the online banking assistant background service to download a blacklist, a whitelist, and a preset account combination from the server;
  • Step 103-2 After receiving the download notification of the control, the online banking assistant background service notifies the server to download the blacklist, the whitelist, and the preset account combination;
  • Step 103-3 After receiving the download notification of the online banking assistant background service, the server obtains an encrypted blacklist, a whitelist, and an encrypted preset account combination;
  • the encrypted blacklist, the whitelist, and the preset account combination obtained by the server are used to perform the default summary calculation by using the MD5 digest algorithm in the blacklist, whitelist, and preset account combination of the plaintext to generate 16 words.
  • the first summary value of the section, the blacklist, the whitelist, and the preset account combination and the first summary value are sequentially spliced, and the splicing result is encrypted by using the RC4 algorithm to obtain an encrypted blacklist, whitelist, and preset account combination. ;
  • Step 103-4 The server sends the encrypted blacklist, whitelist, and encrypted preset account combination to the online banking assistant background service.
  • Step 103-5 The online banking assistant background service sends the encrypted blacklist, whitelist, and encrypted preset account combination to the control.
  • Step 103-6 After receiving the encrypted blacklist, the whitelist, and the encrypted preset account combination, the control performs a preset decryption calculation on the encrypted blacklist, the whitelist, and the encrypted preset account combination to obtain decrypted data.
  • the preset decryption calculation is an RC4 decryption calculation
  • Step 103-7 The control intercepts the preset length data from the decrypted data, and uses the first digest value to perform digest calculation on the data other than the first digest value in the decrypted data to generate a second digest value.
  • the data of the preset length is intercepted from the decrypted data, specifically, the data of the last 16 bytes is intercepted from the decrypted data;
  • Step 103-8 The control determines whether the first digest value and the second digest value are the same. If yes, the encrypted black and white list and the encrypted preset account combination are saved to the installation path, and step 104 is performed; otherwise, step 103- 9;
  • Step 103-9 The control determines whether the download notification has been resent the preset number of times, and if so, ends, otherwise the step is performed. 103-1;
  • the preset number of times is 3;
  • Step 104 The control reads the encrypted blacklist, the whitelist, and the encrypted preset account combination from the installation path.
  • the network anti-phishing control ensures that the black and white list and the preset account combination are not maliciously falsified by the hacker, so the black and white list and the preset account combination are encrypted and saved to the installation path;
  • Step 105 The control decrypts the encrypted blacklist, the whitelist, and the encrypted preset account combination, and saves the decrypted blacklist, whitelist, and preset account combination into the memory;
  • the network anti-phishing control applies a preset decryption algorithm to decrypt the read encrypted blacklist, whitelist, and encrypted preset account combination.
  • the preset decryption algorithm is an RC4 algorithm, and Can also be MD5 algorithm, etc.;
  • the blacklist and the whitelist are taken as an example of an XML file, and the blacklist and whitelist obtained by decrypting the network anti-phishing control are:
  • Step 106 The control obtains a general blacklist, a general whitelist, and a customized blacklist corresponding to each bank information from the blacklist and the whitelist, and the customized whitelist is saved in the memory;
  • information obtained from blacklists and whitelists includes:
  • Custom blacklists and custom whitelists corresponding to bank information 1. Custom blacklists and custom whitelists corresponding to bank information:
  • Custom blacklist corresponding to ABCBank
  • Custom whitelist corresponding to ABCBank
  • Custom whitelist corresponding to YTBank
  • the general blacklist obtained from the blacklist and whitelist is:
  • the general whitelists obtained from the blacklist and whitelist are:
  • Step 107 The control waits to receive the URL of the browser, and determines whether the URL of the browser is in the general blacklist or the customized blacklist corresponding to each bank information. If yes, the browser is prevented from loading the URL of the browser, and the process returns to step 107. Otherwise, step 108 is performed;
  • the message mapping is bound to the browser. Before the browser is loaded or after the loading is completed, the network anti-phishing control obtains the URL of the browser through the message mapping;
  • the URL (Uniform Resource Locator, which is a uniform resource locator of the WWW, refers to the network address), and the browser prevents the browser from loading the URL of the browser, which may be a URL for exiting the browser.
  • the corresponding tab page or the tab page corresponding to the browser's URL is stopped and an empty page is displayed;
  • the URL of the browser received by the network anti-phishing control may be a URL input by the user in the URL input field, or may be a pop-up URL;
  • the URL of the browser received by the network anti-phishing control is "http://www.aobchina.cn", which can be found from the universal blacklist;
  • the URL of the browser received by the network anti-phishing control is "http://www.baidu.com", the URL is not found in the general blacklist and the customized blacklist, and step 108 is performed;
  • Step 108 The control determines whether the URL of the browser is in the general white list or the customized white list corresponding to each bank information. If yes, the browser is notified to load the URL of the browser, and returns to step 107; otherwise, step 109 is performed;
  • the URL of the browser received by the network anti-phishing control is "https://www.taobao.com”.
  • the URL of the browser matches the URL in the whitelist when it matches to *, it means that all matches, that is, If the characters between "//" and ".” do not need to match, the URL in the whitelist matching the browser's URL can be found from the general whitelist: "https://*.taobao.com", so the browser is notified to load the URL of the browser;
  • the network anti-phishing control receives the URL of the browser as "http://www.baidu.com", the URL is not found in the white list, and step 109 is performed;
  • step 107 and step 108 have no sequence and can be executed simultaneously;
  • Step 109 The control determines whether the URL of the browser and the URL of the customized whitelist corresponding to the general whitelist or each bank information meets the preset fuzzy matching condition. If yes, step 110 is performed, otherwise the browser is notified to load the browser. URL, return to step 107;
  • the determining whether the URL of the browser and the URL of the customized whitelist corresponding to the general whitelist or each bank information meet the preset fuzzy matching condition specifically determining that the URL of the browser corresponds to the general whitelist or the bank information. Whether the number of characters of the URL in the customized whitelist is not greater than the preset difference. If yes, the preset fuzzy matching condition is met, and step 110 is performed. Otherwise, the preset fuzzy matching condition is not met, and the browser is notified to load the browser. URL, returning to step 107, preferably, the preset difference is 2;
  • the character difference between the two character strings is obtained by using a matrix, and the URL of the custom whitelist corresponding to the general whitelist or each bank information of the browser is determined to meet the preset fuzzy matching condition.
  • the specific operation is as follows:
  • Step 109-1 The control obtains an unprocessed URL from the general whitelist and the customized whitelist corresponding to each bank information, and uses the unprocessed URL as the current URL; for example, the first URL in the whitelist is http: //cmbchina.com, the incoming URL is http://camdchina.com;
  • Step 109-2 The control obtains the first string length of the current URL and the second string length of the browser URL, and determines whether the difference between the length of the first string and the length of the second string is greater than a preset difference. Go to step 109-10, otherwise go to step 109-3;
  • the preset difference is 2;
  • the first character string length of the current URL is 19, and the second character string length of the browser URL is 20;
  • Step 109-3 The control constructs a matrix whose number of rows is the length of the first string plus 1, the number of columns is the length of the second string plus 1, and the matrix element values are all zero, and the matrix element corresponding to the first row of the matrix The value is initialized to 0 to the first string length, and the matrix element value corresponding to the first column of the matrix is initialized to 0 to the second string length;
  • the matrix obtained after processing in step 109-3 is:
  • Step 109-4 The control obtains the current row and the current column that are not updated from the matrix, obtains the current row character corresponding to the current URL according to the current row, and obtains the current column character corresponding to the browser URL according to the current column;
  • the current line character corresponding to the current URL is obtained according to the current line, and the current line character corresponding to the current line minus 1 is obtained from the current URL.
  • the current line of the unupdated current behavior obtained from the matrix is 2, the value corresponding to the current row minus 1 is 1, and the corresponding line character is obtained from the current URL as the first character, that is, the current line character is h;
  • the current column character corresponding to the URL of the browser is obtained according to the current column: the current column character corresponding to the current column minus 1 is obtained from the URL of the browser;
  • the current column that is not updated from the matrix is the second row
  • the value corresponding to the current column minus 1 is 1, and the corresponding column character is obtained from the URL of the browser as the first character, that is, the current column character is h;
  • Step 109-5 The control determines whether the current line character is the same as the current column character. If yes, the added value is set to 0, step 109-6 is performed, otherwise the added value is set to 1, and step 109-6 is performed;
  • the added value is set to 0;
  • Step 109-6 The control calculates the value of the matrix element corresponding to the current row minus 1 and the current column plus 1 to obtain the value as the first value, and calculates the value of the matrix element corresponding to the current row and the current column minus 1 and adds 1 to obtain the value as The second value is used to calculate the value of the matrix element corresponding to the current row minus 1 and the current column minus 1, and the added value is used as the third value;
  • Step 109-7 The control updates the matrix element values corresponding to the current row and the current column according to the minimum values of the first value, the second value, and the third value;
  • the first value is 2, the second value is 2, and the third value is 0.
  • the minimum value obtained from the first value, the second value, and the third value is the third value 0, and the second line and the second line are The value of the matrix element corresponding to the column is updated to 0;
  • Step 109-8 The control determines whether there is an unupdated matrix element value, and if so, step 109-4 is performed, otherwise step 109-9 is performed;
  • the matrix obtained after the operations of step 109-3 to step 109-8 is:
  • Step 109-9 The control obtains the number of rows as the length of the first string plus 1 and the number of columns is the length of the second string plus 1 a value of the matrix element, determining whether the value of the matrix element is less than or equal to a preset difference, and if so, the URL of the browser conforms to the preset fuzzy matching condition, and step 110 is performed; otherwise, step 109-10 is performed;
  • the matrix element value corresponding to the 20th row and the 21st column is 2, which is equal to the preset difference 2
  • the browser The URL meets the preset fuzzy matching condition, and step 110 is performed;
  • Step 109-10 The control determines whether there is an unprocessed URL in the customized white list or the customized white list corresponding to each bank information, and if yes, returns to step 109-1, otherwise the URL of the browser does not meet the preset fuzzy match. Condition, the browser is notified to load the URL of the browser, and returns to step 107;
  • the URL of the browser may be a URL falsified by a hacker's generic whitelist or a URL in a customized whitelist corresponding to each bank information, so a prompt is required.
  • the user is carrying out dangerous operations, please handle it by yourself;
  • the network anti-phishing control directly informs the browser to load the URL of the browser, and the browser executes the URL of the browser to enter the Baidu page to complete the loading of the Baidu interface.
  • Step 110 The control prompts the user to perform a dangerous operation, and detects whether the user chooses to continue. If yes, the browser is notified to load the URL of the browser, and step 111 is performed. Otherwise, the browser is prevented from loading the URL of the browser and returning. Step 107;
  • the preventing the browser from loading the URL of the browser may be: deleting a tab corresponding to the URL of the browser or loading a tab corresponding to the URL of the browser into an empty page;
  • the network anti-phishing control blocks the incoming URL, and further includes: saving the URL of the browser to the blacklist, and the network anti-phishing control notifying the online banking assistant that the background service will
  • the URL of the browser is sent to the server, and the server manually detects the number of URLs of the browser after a predetermined time. When the number of URLs of the browser reaches a preset value, the URL of the browser is Save to the encrypted blacklist and whitelist of the server;
  • the prompting the user to perform a dangerous operation further comprising: determining whether the user's selection is detected within a preset time, and if yes, detecting whether the user chooses to continue, otherwise preventing the browser from loading the browser URL, return to step 107;
  • Step 111 The control obtains and determines a URL that matches the URL of the browser according to the preset fuzzy matching condition. If it is a URL in the universal whitelist, obtains a preset account combination corresponding to all the bank information, and performs step 114, if it is a bank. The URL in the customized white list corresponding to the information, step 112 is performed;
  • the preset account combination corresponding to all the bank information saved in the memory is obtained;
  • Step 112 The control acquires, from the memory, the bank information corresponding to the URL of the browser whose URL conforms to the preset fuzzy matching condition;
  • the incoming URL is http://camdchina.com
  • the URL corresponding to the default fuzzy matching condition of the browser URL is http://cmbchina.com
  • the corresponding bank information is ABCBank
  • Step 113 The control obtains an encrypted preset account combination corresponding to the bank information from the memory, and decrypts the encrypted preset account combination to obtain a preset account combination.
  • the preset account combination is saved in the form of a regular expression, wherein the regular expression starts with ⁇ and ends with $, for example, the meaning of the regular expression ⁇ 622825 ⁇ d ⁇ 13 ⁇ $ begins with ⁇ , After adding a fixed value of 622825, then a 13-digit number, and finally ending with $;
  • the encrypted default account combination is decrypted, and the preset account combination is obtained.
  • the preset decryption algorithm is used to decrypt the encrypted preset account combination.
  • the preset decryption algorithm is RC4 algorithm, in addition to this, can also be MD5 algorithm, etc.;
  • the resulting default account combination is:
  • Step 114 The control waits to receive the button information input by the user;
  • Step 115 When the control receives the key information input by the user, it is determined whether the received key information is a numeric key, and if so, step 116 is performed, otherwise step 114 is continued;
  • the network anti-phishing control needs to monitor the account information. If the button information input by the user is a numeric key, the received number needs to be processed. If the preset account combination is met, the user needs to be prompted. Dangerous operation increases the security of the network anti-phishing control;
  • Step 116 The control determines whether the current focus control is an input box control, and if so, step 117 is performed, otherwise step 114 is continued;
  • the current focus control is a mouse click control, including an input box control (input control), a button control (button control), a radio button control (RadioButton control), and a check box control (CheckBox control). ), etc., wherein the input box control includes inputting an account control, inputting a password control, etc.;
  • Step 117 The control determines whether the input box control is an input password control, and if so, step 114 is performed, otherwise step 118 is performed;
  • Step 118 The control determines whether the characters in the input box control meet the preset account combination, and if so, step 119 is performed, otherwise step 114 is continued;
  • the character in the input box control received by the network anti-phishing control is a number, and is 6228270001010202030, which conforms to the preset account combination, and step 119 is performed;
  • Step 119 The control prompts the user to perform a dangerous operation, and detects whether the user chooses to continue. If yes, the browser is notified to jump to the user access interface, and returns to step 107. Otherwise, the browser is prevented from loading the user access interface, and the process returns to step 107;
  • the URL is a user trusting the website, so the URL of the browser can be saved to the local white list;
  • the network anti-phishing control when the characters in the input box received by the network anti-phishing control are digital and conform to the preset account combination, it may be known that the user input may be an account, but the URL is not in the white list, so the user may be prompted to There is danger, waiting for the user to make a decision;
  • the user is prompted to perform a dangerous operation, and detecting whether the user selects to continue, further includes: determining whether the user's selection is detected within the preset time, and if yes, detecting whether the user selects to continue, otherwise preventing the browser from loading.
  • the user accesses the interface and returns to step 107.
  • the third embodiment of the present invention provides a method for implementing network anti-phishing. As shown in FIG. 5, the method includes: starting a browser, loading a network anti-phishing control, and the network anti-phishing control (hereinafter referred to as a control) performs the following operations:
  • Step 201 The control reads the installation path from the registry
  • the installation path is used to identify the storage location of the encrypted blacklist, whitelist, and preset account combination in the memory;
  • the installation path includes a blacklist, a whitelist, and a preset account combination.
  • the URL data in the blacklist and the whitelist is a blacklist and a blacklist of a specific bank, and the bank information corresponds to a preset account combination;
  • Step 202 The control determines whether the black and white list and the preset account combination in the installation path exist, and if so, step 204 is performed, otherwise step 203 is performed;
  • Step 203 The control notifies the online banking assistant background service to download the blacklist, the whitelist, and the preset account combination from the server, and save the received encrypted blacklist, whitelist, and encrypted preset account combination in the installation path, and perform the steps. 204;
  • step 203 is the same as the operation of step 103 in the first embodiment, and details are not described herein again.
  • Step 204 The control reads the encrypted blacklist, the whitelist, and the encrypted preset account combination from the installation path.
  • Step 205 The control decrypts the encrypted blacklist, the whitelist, and the encrypted preset account combination, and obtains a blacklist, a whitelist, and a preset account combination;
  • control applies a preset decryption algorithm to decrypt the read encrypted blacklist, whitelist, and preset account combination.
  • the preset decryption algorithm is an RC4 algorithm, and in addition, the MD5 algorithm may be used. Wait;
  • the blacklist and the whitelist are used as an example to illustrate that the blacklist and whitelist obtained by decrypting the network anti-phishing control are:
  • Step 206 The control obtains bank information, a customized blacklist, and a customized whitelist from the blacklist and the whitelist, and saves them in the memory;
  • a custom blacklist obtained from a blacklist or whitelist is:
  • the custom whitelists obtained from the blacklist and whitelist are:
  • Step 207 The control waits to receive the URL of the browser, determines whether the URL of the browser is in the custom blacklist, and if so, prevents the browser from loading the URL of the browser, and returns to step 207, otherwise step 208 is performed;
  • the URL of the browser received by the control is "http://www.abcrchina.cn", which can be found from the blacklist;
  • Step 208 The control determines whether the URL of the browser is in the custom whitelist, and if so, notifies the browser to load the URL of the browser, and returns to step 207, otherwise step 209 is performed;
  • control receives the URL of the browser as "http://cmbchina.com", and the URL can be found from the customized whitelist, so the browser is notified to load the URL of the browser;
  • Step 209 The control determines whether the URL of the browser and the URL in the customized whitelist meet the preset fuzzy matching condition, and if yes, execute step 210, otherwise notify the browser to load the URL of the browser, and return to step 207;
  • step 209 is the same as the operation of step 109 in the first embodiment, and details are not described herein again.
  • the URL of the browser is http://camdchina.com
  • the difference between the character of the URL http://cmbchina.com in the whitelist is 2, which is in accordance with the preset fuzzy matching condition
  • Step 210 The control prompts the user to perform a dangerous operation, and detects whether the user chooses to continue. If yes, the browser is notified to load the URL of the browser, and step 211 is performed. Otherwise, the browser is prevented from loading the URL of the browser and returning. Step 207;
  • Step 211 The control obtains from the memory a custom white list that matches the browser URL with a preset fuzzy matching condition.
  • the bank information corresponding to the URL, and the preset account combination corresponding to the bank information is obtained;
  • the step 204 and the step 205 may be: obtaining an encrypted blacklist and a whitelist from the installation path, decrypting the encrypted blacklist and the whitelist, and obtaining a blacklist and a whitelist;
  • the step 211 is specifically: acquiring bank information corresponding to the URL in the customized whitelist that matches the URL of the browser with the preset fuzzy matching condition, and acquiring the encrypted preset account combination corresponding to the bank information, and the encrypted preset Set the account combination to decrypt, and get the default account combination;
  • the preset account combination obtained by the control is:
  • Step 212 The control waits to receive the button information input by the user;
  • Step 213 After the control receives the key information input by the user, it is determined whether the received key information is a numeric key, and if so, step 214 is performed, otherwise returns to step 212;
  • Step 214 The control determines whether the current focus control is an input box control, and if so, step 215 is performed, otherwise returns to step 212;
  • Step 215 The control determines whether the input box control is an input password control, and if so, step 212 is performed, otherwise step 216 is performed;
  • Step 216 The control determines whether the characters in the input box control meet the preset account combination, and if so, step 217 is performed, otherwise returns to step 212;
  • the characters in the input box control received by the network anti-phishing control are numbers, and are 622827001010202030, which conforms to the preset account combination;
  • Step 217 The control prompts the user to perform a dangerous operation, and detects whether the user chooses to continue. If yes, the browser is notified to jump to the user access interface, and returns to step 207. Otherwise, the browser is prevented from loading the user access interface, and the process returns to step 207.
  • the URL is the user trusting the website, so the URL of the browser can be saved to the local white list;
  • the user is prompted to perform a dangerous operation, and detecting whether the user selects to continue, further includes: determining whether the user's selection is detected within the preset time, and if yes, detecting whether the user selects to continue, otherwise preventing the browser from loading.
  • User access interface determining whether the user's selection is detected within the preset time, and if yes, detecting whether the user selects to continue, otherwise preventing the browser from loading.
  • Embodiment 1 of the present invention is applicable to operations of all banks, and Embodiment 2 is applicable to operations of a specific bank.
  • the core technologies used in the two modes are the same, and the technical problems solved are the same, and the beneficial effects are the same.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

一种实现网络防钓鱼的方法，属于信息安全领域，包括：浏览器加载网络防钓鱼控件，控件获取黑名单、白名单，当接收的浏览器的URL在黑名单中，阻止浏览器加载，当在白名单中，通知浏览器加载，当不在黑名单和白名单中，判断浏览器的URL是否符合预设模糊匹配条件，符合则提示用户危险，用户选择继续时，获取预设账号组合，当接收到按键信息为数字且输入焦点为输入框控件时，比较按键信息与预设账号组合，若相同则提示用户危险，根据用户选择进行阻止或加载。上述方法能够实现对黑白名单的处理，并增加模糊查询，实现对非黑白名单的处理，防止黑客通过冒用与白名单相似的URL而盗用用户的银行信息，增加安全性。

Description

一种实现网络防钓鱼的方法 技术领域
本发明涉及一种实现网络防钓鱼的方法，属于信息安全领域。
背景技术
网银助手是现有各厂商证书驱动、CSP软件、网银和证书所用的控件自动化安装软件及微软相关补丁的基础上，开发的一项将所有网银和证书所用的软件以嵌入式程序化软件和利用程序去调用下载的软件。
网银助手集成了各家厂商证书的驱动、CSP软件、控件以及微软的相关补丁，客户通过银行网站下载安装网银助手并运行后，软件会自动引导客户安装。该工具会根据客户输入的“U盾”凭证号查找本机操作系统、证书驱动及CSP等情况，分步下载安装证书驱动、CSP和网银控件，并提示客户下载安装操作系统补丁、修改IE设置。从而免去了此前客户需要下载多个软件之苦，只需一个软件工具即可实现集成化安装，大大提高了“U盾”的可用性。
钓鱼，是一种网络欺诈行为，指不法分子利用各种手段，仿冒真实网站的URL地址以及页面内容，或利用真实网站服务器程序上的漏洞在站点的某些网页中插入危险的HTML代码，以此来骗取用户银行或信用卡账号、密码等私人资料。
现有的网络防钓鱼控件只是根据服务器下发的黑白名单进行判断，对于非黑白名单中的网址甄别能力差，黑客会利用此漏洞盗取用户的银行信息，造成不可估量的损失，安全性较低。
发明内容
本发明的目的是提供一种实现网络防钓鱼的方法，其能够实现对黑白名单的处理，并增加模糊查询，实现对非黑白名单的处理，防止黑客通过冒用与白名单相似的URL而盗用用户的银行信息，增加安全性。
为此，本发明提供了一种实现网络防钓鱼的方法，包括：浏览器启动，加载网络防钓鱼控件，所述网络防钓鱼控件执行以下操作：
步骤S1：所述网络防钓鱼控件获取黑名单和白名单；
步骤S2：所述网络防钓鱼控件等待接收浏览器的URL，判断所述浏览器的URL，若在所述黑名单中，则阻止浏览器加载所述浏览器的URL，返回步骤S2，若在所述白名单中，则通知浏览器加载所述浏览器的URL，返回步骤S2，否则执行步骤S3；
步骤S3：所述网络防钓鱼控件判断所述浏览器的URL与所述白名单中的URL是否符合预设模糊匹配条件，如果是，则执行步骤S4，否则通知浏览器加载所述浏览器的URL，返回步骤S2；
步骤S4：所述网络防钓鱼控件提示用户正在进行危险操作，检测用户是否选择继续，如果是，则通知浏览器加载所述浏览器的URL，执行步骤S5，否则阻止浏览器加载所述浏览器的URL，返回步骤S2；
步骤S5：所述网络防钓鱼控件从所述白名单中获取与所述浏览器的URL符合预设模糊匹配条件的URL对应的预设账号组合；
步骤S6：所述网络防钓鱼控件等待接收用户输入的按键信息，当接收到用户输入的按键信息后，判断接收到的按键信息是否为数字键，如果是，则执行步骤S7，否则继续执行步骤S6；
步骤S7：所述网络防钓鱼控件判断输入焦点是否为输入框控件，如果是，则执行步骤S8，否则返回步骤S6；
步骤S8：所述网络防钓鱼控件获取所述输入框控件中用户输入的按键信息，判断所述 按键信息是否符合所述预设账号组合，如果是，则执行步骤S9，否则返回步骤S6；以及
步骤S9：所述网络防钓鱼控件提示用户正在进行危险操作，检测用户是否选择继续，如果是，则通知浏览器跳转至用户访问界面，返回步骤S2，否则阻止浏览器加载用户访问界面，返回步骤S2。
优选地，所述步骤S1，具体包括：所述网络防钓鱼控件从注册表中读取安装路径，从所述安装路径下获取所述黑名单、所述白名单和预设账号组合，并保存。
优选地，所述步骤S1还包括：
步骤a1：所述网络防钓鱼控件判断所述安装路径下的所述黑名单、所述白名单和所述预设账号组合是否存在，如果是，则从所述安装路径下获取所述黑名单、所述白名单和预设账号组合，并保存，执行步骤S2，否则执行步骤a2；以及
步骤a2：所述网络防钓鱼控件通知网银助手后台服务从服务器中下载黑名单、白名单和预设账号组合，将接收到的黑名单、白名单和预设账号组合保存至所述安装路径下，执行步骤S2。
优选地，所述步骤a1，还可以为：所述网络防钓鱼控件判断所述安装路径下的所述黑名单、所述白名单和所述预设账号组合是否需要更新，如果是，则执行步骤a2，否则从所述安装路径下获取所述黑名单、所述白名单和预设账号组合，并保存，执行步骤S2。
优选地，所述步骤a1，还可以为：所述网络防钓鱼控件判断所述安装路径下的所述黑名单、所述白名单和所述预设账号组合是否被篡改，如果是，则执行步骤a2，否则从所述安装路径下获取所述黑名单、所述白名单和预设账号组合，并保存，执行步骤S2。
优选地，所述步骤a2，具体为：
步骤b1：所述网络防钓鱼控件通知网银助手后台服务从服务器中下载黑名单、白名单和预设账号组合；
步骤b2：所述网银助手后台服务接收到所述网络防钓鱼控件的下载通知后，通知服务器下载黑名单、白名单和预设账号组合；
步骤b3：所述服务器接收到所述网银助手后台服务的下载通知后，获取加密的黑名单、白名单和加密的预设账号组合，并发送给所述网银助手后台服务；
步骤b4：所述网银助手后台服务将所述加密的黑名单、白名单和所述加密的预设账号组合发送给所述网络防钓鱼控件；
步骤b5：所述网络防钓鱼控件接收到所述加密的黑名单、白名单和所述加密的预设账号组合后，对所述加密的黑名单、白名单和所述加密的预设账号组合做预设解密计算，得到解密数据；
步骤b6：所述网络防钓鱼控件从所述解密数据中截取预设长度的数据，作为第一摘要值，对所述解密数据中除第一摘要值之外的数据，进行摘要计算，生成第二摘要值；
步骤b7：所述网络防钓鱼控件判断第一摘要值与第二摘要值是否相同，如果是，则将所述加密的黑名单、白名单和所述加密的预设账号组合保存至所述安装路径下，执行步骤S2，否则执行步骤b8；以及
步骤b8：所述网络防钓鱼控件判断下载通知是否已重发预设次数，如果是，则结束，否则执行步骤b1；
所述从所述安装路径下获取所述黑名单、所述白名单和预设账号组合，并保存，具体为：从所述安装路径下获取加密的黑名单、白名单和加密的预设账号组合，对所述加密的黑名单、白名单和加密的预设账号组合进行解密，得到黑名单、白名单和预设账号组合，并保存。
优选地，所述步骤S1，具体包括：所述网络防钓鱼控件获取通用黑名单、通用白名单、各银行信息对应的定制白名单、定制黑名单；
所述步骤S2，具体包括：所述网络防钓鱼控件等待接收浏览器的URL，判断所述浏览 器的URL，若是在所述通用黑名单或所述各银行对应的定制黑名单中，则阻止浏览器加载所述浏览器的URL，返回步骤S2，若是在所述通用白名单或所述各银行信息对应的定制白名单中，则通知浏览器加载所述浏览器的URL，返回步骤S2，否则执行步骤S3；
所述步骤S4判断为是时，通知浏览器加载所述浏览器的URL，之后还包括：所述网络防钓鱼控件获取并判断与所述浏览器的URL符合预设模糊匹配条件的白名单中的URL，如果是在所述通用白名单中，则获取所有银行信息对应的预设账号组合，执行步骤S6，如果是在所述各银行信息对应的定制白名单中，则执行步骤S5；以及
所述步骤S5具体为：所述网络防钓鱼控件从内存中获取与所述浏览器的URL符合预设模糊匹配条件的所述白名单中的URL对应的银行信息，获取与所述银行信息对应的预设账号组合。
优选地，所述步骤S1，具体包括：所述网络防钓鱼控件获取定制白名单和定制黑名单；
所述步骤S2，具体包括：所述网络防钓鱼控件等待接收浏览器的URL，判断所述浏览器的URL，若是在所述定制黑名单中，则阻止浏览器加载所述浏览器的URL，返回步骤S2，若是在所述定制白名单中，则通知浏览器加载所述浏览器的URL，返回步骤S2，否则执行步骤S3；以及
所述步骤S5具体为：所述网络防钓鱼控件获取与所述浏览器的URL符合预设模糊匹配条件的所述定制白名单中的URL对应的银行信息，获取与所述银行信息对应的预设账号组合。
优选地，所述阻止浏览器加载所述浏览器的URL，具体为：所述网络防钓鱼控件关闭所述浏览器的URL对应的标签页或将所述浏览器的URL对应的标签页加载为空页面。
优选地，所述步骤S6，具体为：判断所述浏览器的URL与所述白名单中的URL的字符相差数是否不大于预设差值，如果是，则符合预设模糊匹配条件，执行步骤S4，否则不符合预设模糊匹配条件，通知浏览器加载所述浏览器的URL，返回步骤S2。
优选地，所述判断所述浏览器的URL与所述白名单中的URL的字符相差数是否不大于预设差值，具体为：
步骤1：所述网络防钓鱼控件从所述白名单中获取一个未处理的URL，将该未处理的URL作为当前URL；
步骤2：所述网络防钓鱼控件获取当前URL的第一字符串长度和所述浏览器的URL的第二字符串长度，判断所述第一字符串长度与所述第二字符串长度之差是否大于所述预设差值，如果是，则执行步骤4，否则执行步骤3；
步骤3：所述网络防钓鱼控件判断所述浏览器的URL与所述当前URL的字符相差数是否不大于预设差值，如果是，则所述浏览器的URL与所述白名单中的URL符合预设模糊匹配条件，执行步骤S4，否则执行步骤4；以及
步骤4：所述网络防钓鱼控件判断所述白名单中是否还有未处理的URL，如果是，则执行步骤1，否则所述浏览器的URL不符合预设模糊匹配条件，通知浏览器加载所述浏览器的URL，返回步骤S2。
优选地，所述步骤3，具体为：
步骤c1：网络防钓鱼控件构造一个行数为第一字符串长度加1、列数为第二字符串长度加1，且矩阵元素值全为零的矩阵，将所述矩阵的第一行对应的矩阵元素值初始化为0至第一字符串长度，将所述矩阵的第一列对应的矩阵元素值初始化为0至第二字符串长度；
步骤c2：网络防钓鱼控件从所述矩阵中获取未更新的当前行和当前列，根据当前行获取当前URL中对应的当前行字符，并根据当前列获取浏览器的URL中对应的当前列字符；
步骤c3：网络防钓鱼控件判断当前行字符与当前列字符是否相同，如果是，则将添加值置为0，执行步骤c4，否则将添加值置为1，执行步骤c4；
步骤c4：网络防钓鱼控件计算当前行减1和当前列对应的矩阵元素值加1，得到的值 作为第一数值，计算当前行和当前列减1对应的矩阵元素值加1，得到的值作为第二数值，计算当前行减1和当前列减1对应的矩阵元素值加添加值，得到的值作为第三数值；
步骤c5：所述网络防钓鱼控件根据第一数值、第二数值和第三数值的最小值，更新当前行和当前列对应的矩阵元素值；
步骤c6：网络防钓鱼控件判断是否还有未更新的矩阵元素值，如果是，则返回执行步骤c4，否则执行步骤c7；以及
步骤c7：网络防钓鱼控件获取行数为第一字符串长度加1、列数为第二字符串长度加1对应的矩阵元素值，判断该矩阵元素值是否小于等于所述预设差值，如果是，则所述浏览器的URL符合预设模糊匹配条件，执行步骤S4，否则执行步骤4。
优选地，所述阻止浏览器加载所述浏览器的URL之后，还包括：所述网络防钓鱼控件将所述浏览器的URL保存至所述黑名单中，所述网络防钓鱼控件通知网银助手后台服务将所述浏览器的URL发送给服务器，所述服务器在预定时间后人工检测所述浏览器的URL的数量，当所述浏览器的URL的数量达到预设值时，将所述浏览器的URL保存至服务器的加密的黑名单、白名单中。
优选地，所述步骤S4中，所述提示用户正在进行危险操作之后，还包括：判断在预设时间内是否检测到用户的选择，如果是，则检测用户是否选择继续，否则阻止浏览器加载所述浏览器的URL，返回步骤S2；以及
所述步骤S9中，所述提示用户正在进行危险操作，检测用户是否选择继续，还包括：判断在所述预设时间内是否检测到用户的选择，如果是，则检测用户是否选择继续，否则阻止浏览器加载用户访问界面，返回步骤S2。
优选地，所述步骤S7判断为是时，还包括：所述网络防钓鱼控件判断所述输入框控件是否为输入密码控件，如果是，则返回执行步骤S6，否则执行步骤S8。
根据本发明，不仅能够实现对黑白名单的处理，同时增加了模糊查询，能够对非黑白名单中的URL进行处理，防止黑客通过冒用与白名单相似的URL而盗用用户的银行信息，而且增加了安全性。
附图说明
为了更清楚的说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需待使用的附图作简单的介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域的技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本发明实施例一提供的一种实现网络防钓鱼的方法流程图；
图2是本发明实施例二提供的另一种实现网络防钓鱼的方法流程图；
图3是本发明实施例二中步骤103的细化流程图；
图4是本发明实施例二中步骤109的细化流程图；
图5是本发明实施例三提供的再一种实现网络防钓鱼的方法流程图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域的技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
实施例一
本发明实施例一提供了一种实现网络防钓鱼的方法，如图1所示，包括：浏览器启动，加载网络防钓鱼控件，所述网络防钓鱼控件(以下简称控件)执行以下操作：
步骤S1：控件获取黑名单和白名单；
具体为：从注册表中获取安装路径，从安装路径下获取黑名单和白名单；
进一步地，也可以为：从注册表中获取安装路径，从安装路径下获取加密的黑名单、白名单，对加密的黑名单、白名单进行解密，得到黑名单和白名单并保存；
其中，如果所述安装路径下的黑白名单中包括多个银行的信息，则从所述黑名单、白名单中获取黑名单和白名单，具体包括获取通用黑名单、通用白名单和各银行信息对应的定制黑名单、定制白名单；
如果所述安装路径下的黑白名单中仅包括特定银行的信息，则从所述黑名单、白名单中获取黑名单和白名单，具体为获取该银行信息对应的定制黑名单和定制白名单；
步骤S2：控件等待接收浏览器的URL，判断浏览器的URL，若在黑名单中，则阻止浏览器加载所述浏览器的URL，返回步骤S2，若在白名单中，则通知浏览器加载所述浏览器的URL，返回步骤S2，否则执行步骤S3；
其中，如果所述安装路径下的黑白名单中包括多个银行的信息，则如果浏览器的URL在通用黑名单或各银行信息对应的定制黑名单中，则阻止浏览器加载所述浏览器的URL，如果浏览器的URL在通用白名单或各银行信息对应的定制白名单中，则通知浏览器加载所述浏览器的URL；
如果所述安装路径下的黑白名单中仅包括特定银行的信息，则如果浏览器的URL在该银行信息对应的定制黑名单中，则阻止浏览器加载所述浏览器的URL，如果浏览器的URL在该银行信息对应的定制白名单中，则通知浏览器加载所述浏览器的URL；
步骤S3：控件判断所述浏览器的URL与所述白名单中的URL是否符合预设模糊匹配条件，如果是，则执行步骤S4，否则通知浏览器加载所述浏览器的URL，返回步骤S2；
其中，如果所述安装路径下的黑白名单中包括多个银行的信息，则判断所述浏览器的URL与所述白名单中的URL是否符合预设模糊匹配条件，具体为：判断所述浏览器的URL与通用白名单或各银行信息对应的定制白名单中的URL是否符合预设模糊匹配条件；
如果所述安装路径下的黑白名单中仅包括特定银行的信息，则判断所述浏览器的URL与所述白名单中的URL是否符合预设模糊匹配条件，具体为：判断所述浏览器的URL与该银行信息对应的定制白名单中的URL是否符合预设模糊匹配条件；
步骤S4：控件提示用户正在进行危险操作，检测用户是否选择继续，如果是，则通知浏览器加载所述浏览器的URL，执行步骤S5，否则阻止浏览器加载所述浏览器的URL，返回步骤S2；
步骤S5：控件从所述白名单中获取与所述浏览器的URL符合预设模糊匹配条件的URL对应的预设账号组合；
其中，如果所述安装路径下的黑白名单中包括多个银行的信息，则步骤S5，具体为：从白名单中获取与所述浏览器的URL符合预设模糊匹配条件的URL对应的银行信息，获取与所述银行信息对应的预设账号组合；
如果所述安装路径下的黑白名单中仅包括特定银行的信息，则步骤S5，具体为：从白名单中获取与所述浏览器的URL符合预设模糊匹配条件的URL对应的该特定银行的预设账号组合；
步骤S6：控件等待接收用户输入的按键信息，当接收到用户输入的按键信息后，判断接收到的按键信息是否为数字键，如果是，则执行步骤S7，否则继续执行步骤S6；
步骤S7：控件判断输入焦点是否为输入框控件，如果是，则执行步骤S8，否则返回步骤S6；
步骤S8：控件获取所述输入框控件中用户输入的按键信息，判断所述按键信息是否符合所述预设账号组合，如果是，则执行步骤S9，否则返回步骤S6；
步骤S9：控件提示用户正在进行危险操作，检测用户是否选择继续，如果是，则通知 浏览器跳转至用户访问界面，返回步骤S2，否则阻止浏览器加载用户访问界面，返回步骤S2。
实施例二
本发明实施例二提供了一种实现网络防钓鱼的方法，如图2所示，包括：浏览器启动，加载网络防钓鱼控件，所述网络防钓鱼控件(以下简称控件)执行以下操作：
步骤101：控件从注册表中读取安装路径；
本实施例二中，安装路径用于标识加密的黑名单、白名单和预设账号组合在内存中的存储位置；
本实施例二中，安装路径下包括黑名单、白名单(黑名单、白名单可以保存在一个黑白名单文件中，也可以分别保存)和多个预设账号组合，黑名单、白名单中的URL包括所有银行的通用黑白名单和单个银行信息对应的定制黑白名单，每个银行信息对应一个预设账号组合；
步骤102：控件判断安装路径下的黑名单、白名单和预设账号组合是否存在，如果是，则执行步骤104，否则执行步骤103；
步骤103：控件通知网银助手后台服务从服务器中下载黑名单、白名单和预设账号组合，将接收到的加密的黑名单、白名单和预设账号组合保存在安装路径下，执行步骤104；
本实施例二中，网银助手后台服务接收到网络防钓鱼控件发送的下载通知后，通知服务器下载黑名单、白名单以及预设账号组合，待到黑名单、白名单及预设账号组合下载完成后，检查黑名单、白名单及预设账号组合是否被篡改，如果是，则继续通知服务器下载，否则将加密的黑名单、白名单及预设账号组合保存至所述安装路径下，执行步骤104；
参见图3，所述步骤103具体为：
步骤103-1：控件通知网银助手后台服务从服务器中下载黑名单、白名单和预设账号组合；
步骤103-2：网银助手后台服务接收到控件的下载通知后，通知服务器下载黑名单、白名单以及预设账号组合；
步骤103-3：服务器接收到网银助手后台服务的下载通知后，获取加密的黑名单、白名单以及加密的预设账号组合；
本实施例二中，服务器获取到的加密的黑名单、白名单以及预设账号组合，是将明文的黑名单、白名单以及预设账号组合应用MD5摘要算法进行预设摘要计算，生成16字节的第一摘要值，将明文的黑名单、白名单以及预设账号组合和第一摘要值顺序拼接，应用RC4算法对拼接结果进行加密，得到加密的黑名单、白名单以及预设账号组合；
步骤103-4：服务器将加密的黑名单、白名单以及加密的预设账号组合发送给网银助手后台服务；
步骤103-5：网银助手后台服务将加密的黑名单、白名单以及加密的预设账号组合发送给控件；
步骤103-6：控件接收到加密的黑名单、白名单以及加密的预设账号组合后，对加密的黑名单、白名单以及加密的预设账号组合做预设解密计算，得到解密数据；
优选地，所述预设解密计算为RC4解密计算；
步骤103-7：控件从解密数据中截取预设长度的数据，作为第一摘要值，对解密数据中除第一摘要值之外的数据进行摘要计算，生成第二摘要值；
优选地，从解密数据中截取预设长度的数据，具体为从解密数据中截取后16字节的数据；
步骤103-8：控件判断第一摘要值与第二摘要值是否相同，如果是，则将加密的黑白名单及加密的预设账号组合保存至安装路径下，执行步骤104，否则执行步骤103-9；
步骤103-9：控件判断下载通知是否已重发预设次数，如果是，则结束，否则执行步骤 103-1；
优选地，预设次数为3；
步骤104：控件从安装路径下读取加密的黑名单、白名单和加密的预设账号组合；
本实施例二中，网络防钓鱼控件为保证黑白名单和预设账号组合不被黑客恶意篡改，故将黑白名单和预设账号组合加密保存至安装路径下；
步骤105：控件将读取到的加密的黑名单、白名单和加密的预设账号组合进行解密，将解密得到的黑名单、白名单和预设账号组合保存至内存中；
具体地，网络防钓鱼控件应用预设解密算法对读取到的加密的黑名单、白名单和加密的预设账号组合进行解密，优选地，预设解密算法为RC4算法，除此之外，还可以为MD5算法等；
本实施例以黑名单、白名单为XML文件形式为例来说明，网络防钓鱼控件解密得到的黑名单、白名单为：
Figure PCTCN2015087742-appb-000001
步骤106：控件从黑名单、白名单中获取通用黑名单、通用白名单和各银行信息对应的定制黑名单、定制白名单，并保存在内存中；
例如，从黑名单、白名单中获取到的信息包括：
一、各银行信息对应的定制黑名单和定制白名单：
1、银行信息：ABCBank
与ABCBank对应的定制黑名单：
url＝"http://www.abcrchina.cn"
url＝"http://www.abichina.cn"
url＝"http://www.abcichina.cn"
与ABCBank对应的定制白名单：
url＝"http://cmbchina.com"
2、银行信息：YTBank
与YTBank对应的定制黑名单
url＝"http://www.yanta1bank.net"
url＝"http://www.yantanbank.net"
url＝"http://www.yantaibank.com"
与YTBank对应的定制白名单：
url＝http://www.yantaibank.net
二、从黑名单、白名单中获取到的通用黑名单为：
url＝"http://www.aobchina.cn"
url＝"http://www.abcihina.cn"
url＝"http://www.abnchina.cn"
从黑名单、白名单中获取到的通用白名单为：
url＝"http://*.tmall.com"
url＝"https://*.tmall.com"
url＝"http://*.taobao.com"
url＝"https://*.taobao.com"
url＝"http://*.jd.com"
url＝"https://*.jd.com"
url＝"http://www.95599.cn"；
步骤107：控件等待接收浏览器的URL，判断浏览器的URL是否在通用黑名单或各银行信息对应的定制黑名单中，如果是，则阻止浏览器加载所述浏览器的URL，返回步骤107，否则执行步骤108；
本实施例二中，网络防钓鱼控件加载后，在浏览器上绑定消息映射，当浏览器加载完成前或加载完成后，网络防钓鱼控件通过消息映射获取浏览器的URL；
其中，URL(Uniform Resource Locator，统一资源定位符，它是WWW的统一资源定位标志，就是指网络地址)，所述阻止浏览器加载所述浏览器的URL，具体可以为退出该浏览器的URL对应的标签页或将该浏览器的URL对应的标签页停止并显示空页面；
本实施例二中，网络防钓鱼控件接收到的浏览器的URL，可以为用户在网址输入栏输入的URL，也可以是弹出的URL；
例如，网络防钓鱼控件接收到的浏览器的URL为"http://www.aobchina.cn"，从通用黑名单中能够找到此URL；
例如，网络防钓鱼控件接收到的浏览器的URL为"http://www.baidu.com"，从通用黑名单和定制黑名单中找不到此URL，执行步骤108；
步骤108：控件判断浏览器的URL是否在通用白名单或各银行信息对应的定制白名单中，如果是，则通知浏览器加载所述浏览器的URL，返回步骤107，否则执行步骤109；
例如，网络防钓鱼控件接收到的浏览器的URL为"https://www.taobao.com"，当浏览器的URL与白名单中的URL进行匹配，当匹配至*时表示匹配所有，即“//”和“.”之间的字符不需匹配，则从通用白名单中能够找到与浏览器的URL匹配的白名单中的URL： "https://*.taobao.com"，因此通知浏览器加载所述浏览器的URL；
例如，网络防钓鱼控件接收到浏览器的URL为"http://www.baidu.com"，从白名单中找不到此URL，执行步骤109；
本实施例二中，步骤107和步骤108无先后顺序，可同时执行；
步骤109：控件判断浏览器的URL与通用白名单或各银行信息对应的定制白名单中的URL是否符合预设模糊匹配条件，如果是，则执行步骤110，否则通知浏览器加载所述浏览器的URL，返回步骤107；
其中，所述判断浏览器的URL与通用白名单或各银行信息对应的定制白名单中的URL是否符合预设模糊匹配条件，具体为判断浏览器的URL与通用白名单或各银行信息对应的定制白名单中的URL的字符相差数是否不大于预设差值，如果是，则符合预设模糊匹配条件，执行步骤110，否则不符合预设模糊匹配条件，通知浏览器加载所述浏览器的URL，返回步骤107，优选地，所述预设差值为2；
优选地，本实施例采用矩阵的方式获知两个字符串的字符相差数，所述判断浏览器的URL与通用白名单或各银行信息对应的定制白名单中的URL是否符合预设模糊匹配条件，如图4所示，具体操作如下：
步骤109-1：控件从通用白名单和各银行信息对应的定制白名单中获取一个未处理的URL，将该未处理的URL作为当前URL；例如，白名单中的第一个URL为http://cmbchina.com，传入的URL为http://camdchina.com；
步骤109-2：控件获取当前URL的第一字符串长度和浏览器的URL的第二字符串长度，判断第一字符串长度与第二字符串长度之差是否大于预设差值，如果是，则执行步骤109-10，否则执行步骤109-3；
优选地，所述预设差值为2；
例如，当前URL的第一字符串长度为19，浏览器的URL的第二字符串长度为20；
步骤109-3：控件构造一个行数为第一字符串长度加1、列数为第二字符串长度加1，且矩阵元素值全为零的矩阵，将矩阵的第一行对应的矩阵元素值初始化为0至第一字符串长度，将矩阵的第一列对应的矩阵元素值初始化为0至第二字符串长度；
例如，经步骤109-3处理后得到的矩阵为：
Figure PCTCN2015087742-appb-000002
步骤109-4：控件从矩阵中获取未更新的当前行和当前列，根据当前行获取当前URL中对应的当前行字符，并根据当前列获取浏览器的URL中对应的当前列字符；
本实施例二中，根据当前行获取当前URL中对应的当前行字符具体为：从当前URL中获取当前行减1对应的当前行字符；
例如，从矩阵中获取的未更新的当前行为第2行，则当前行减1对应的值为1，从当前URL中获取对应的行字符为第1个字符，即当前行字符为h；
本实施例二中，根据当前列获取浏览器的URL中对应的当前列字符具体为：从浏览器的URL中获取当前列减1对应的当前列字符；
例如，从矩阵中获取的未更新的当前列为第2行，则当前列减1对应的值为1，从浏览器的URL中获取对应的列字符为第1个字符，即当前列字符为h；
步骤109-5：控件判断当前行字符与当前列字符是否相同，如果是，则将添加值置为0，执行步骤109-6，否则将添加值置为1，执行步骤109-6；
例如，当前行字符为h，当前列字符也为h，则将添加值置为0；
步骤109-6：控件计算当前行减1和当前列对应的矩阵元素值加1，得到的值作为第一数值，计算当前行和当前列减1对应的矩阵元素值加1，得到的值作为第二数值，计算当前行减1和当前列减1对应的矩阵元素值加添加值，得到的值作为第三数值；
例如，当添加值为0时，计算第一行、第二列对应的矩阵值为1，得到的第一数值为1+1＝2；计算第二行、第一列对应的矩阵值为1，得到的第二数值为1+1＝2,；计算第一行、第一列对应的矩阵值为0，加上添加值0，得到的第三数值为0；
步骤109-7：控件根据第一数值、第二数值和第三数值的最小值，更新当前行和当前列对应的矩阵元素值；
例如，第一数值为2，第二数值为2，第三数值为0，从第一数值、第二数值和第三数值中获取最小值为第三数值0，则将第二行、第二列对应的矩阵元素值更新为0；
步骤109-8：控件判断是否还有未更新的矩阵元素值，如果是，则执行步骤109-4，否则执行步骤109-9；
本实施例二中，经步骤109-3至步骤109-8的操作后得到的矩阵为：
Figure PCTCN2015087742-appb-000003
步骤109-9：控件获取行数为第一字符串长度加1、列数为第二字符串长度加1对应的 矩阵元素值，判断该矩阵元素值是否小于等于预设差值，如果是，则浏览器的URL符合预设模糊匹配条件，执行步骤110，否则执行步骤109-10；
例如，第一字符串长度19+1＝20，第二字符串长度20+1＝21，获取第20行第21列对应的矩阵元素值为2，等于预设差值2，则浏览器的URL符合预设模糊匹配条件，执行步骤110；
步骤109-10：控件判断通用白名单或各银行信息对应的定制白名单中是否还有未处理的URL，如果是，则返回执行步骤109-1，否则浏览器的URL不符合预设模糊匹配条件，通知浏览器加载所述浏览器的URL，返回步骤107；
本实施例中，如果浏览器的URL符合预设模糊匹配条件，则该浏览器的URL可能为黑客假冒通用白名单或各银行信息对应的定制白名单中的URL所篡改的URL，因此需要提示用户正在进行危险操作，请用户自行处理；
本实施例中，如果接收到的URL为http://www.baidu.com，当前URL为"https://www.taobao.com"，则采用矩阵的方式获知两个字符串的字符相差值为5，大于2，不符合预设模糊匹配条件，则网络防钓鱼控件直接通知浏览器加载浏览器的URL，浏览器执行所述浏览器的URL，进入百度页面，完成百度界面加载；
步骤110：控件提示用户正在进行危险操作，并检测用户是否选择继续，如果是，则通知浏览器加载所述浏览器的URL，执行步骤111，否则阻止浏览器加载所述浏览器的URL，返回步骤107；
本实施例中，所述阻止浏览器加载所述浏览器的URL，具体可以为退出所述浏览器的URL对应的标签页或将所述浏览器的URL对应的标签页加载为空页面；
进一步地，当用户选择不继续，网络防钓鱼控件阻止传入的URL后，还包括：将所述浏览器的URL保存至所述黑名单中，所述网络防钓鱼控件通知网银助手后台服务将所述浏览器的URL发送给服务器，所述服务器在预定时间后人工检测所述浏览器的URL的数量，当所述浏览器的URL的数量达到预设值时，将所述浏览器的URL保存至服务器的加密的黑名单、白名单中；
所述提示用户正在进行危险操作，检测用户是否选择继续，还包括：判断在预设时间内是否检测到用户的选择，如果是，则检测用户是否选择继续，否则阻止浏览器加载所述浏览器的URL，返回步骤107；
步骤111：控件获取并判断与浏览器的URL符合预设模糊匹配条件的URL，如果是通用白名单中的URL，则获取所有银行信息对应的预设账号组合，执行步骤114，如果是各银行信息对应的定制白名单中的URL，则执行步骤112；
例如，浏览器的URL为https://www.tmall.com，则与通用白名单中的URL相同，则获取内存中保存的所有银行信息对应的预设账号组合；
步骤112：控件从内存中获取与浏览器的URL符合预设模糊匹配条件的URL对应的银行信息；
例如，传入的URL为http://camdchina.com，则与浏览器的URL符合预设模糊匹配条件的URL为http://cmbchina.com，则对应的银行信息为ABCBank；
步骤113：控件从内存中获取与所述银行信息对应的加密的预设账号组合，对加密的预设账号组合进行解密，得到预设账号组合；
优选地，预设账号组合是采用正则表达式的形式保存，其中，正则表达式是以^开头，以$结尾，例如，正则表达式^622825\d{13}$的涵义是以^开头，后加固定值622825，然后为13位的数字，最后以$结尾；
本实施例二中，所述对加密的预设账号组合进行解密，得到预设账号组合，具体为：应用预设解密算法对加密的预设账号组合进行解密，优选地，预设解密算法为RC4算法，除此之外，还可以为MD5算法等；
例如，得到的预设账号组合为：
^622825\d{13}$
^622826\d{13}$
^622827\d{13}$
^491025\d{10}$
^491027\d{10}$
^491028\d{10}$
^491029\d{10}$
……
步骤114：控件等待接收用户输入的按键信息；
步骤115：当控件接收到用户输入的按键信息后，判断接收到的按键信息是否为数字键，如果是，则执行步骤116，否则继续执行步骤114；
本实施例二中，网络防钓鱼控件需要对账号信息进行监控，如果接收到用户输入的按键信息为数字键，则需要对接收到的数字进行处理，如果符合预设账号组合，则需要提示用户危险操作，更增加了网络防钓鱼控件的安全性；
步骤116：控件判断当前焦点的控件是否为输入框控件，如果是，则执行步骤117，否则继续执行步骤114；
本实施例二中，当前焦点的控件，即为鼠标点击的控件，包括输入框控件(input控件)、按钮控件(button控件)、单选框控件(RadioButton控件)、复选框控件(CheckBox控件)等，其中，输入框控件包括输入账号控件，输入密码控件等；
步骤117：控件判断输入框控件是否为输入密码控件，如果是，则执行步骤114，否则执行步骤118；
步骤118：控件判断输入框控件里的字符是否符合预设账号组合，如果是，则执行步骤119，否则继续执行步骤114；
例如，网络防钓鱼控件接收到的输入框控件中的字符为数字，且为6228270001010202030，符合预设账号组合，执行步骤119；
步骤119：控件提示用户正在进行危险操作，并检测用户是否选择继续，如果是，则通知浏览器跳转至用户访问界面，返回步骤107，否则阻止浏览器加载用户访问界面，返回步骤107；
本实施例中，如果用户选择继续，则说明该URL为用户信任网站，因此可将该浏览器的URL保存至本地的白名单中；
本实施例二中，当网络防钓鱼控件接收到的输入框中的字符为数字且符合预设账号组合，可知用户输入的可能为账号，但该URL不在白名单中，因此需要向用户提示可能存在危险，等待用户进行判定；
其中，所述提示用户正在进行危险操作，检测用户是否选择继续，还包括：判断在所述预设时间内是否检测到用户的选择，如果是，则检测用户是否选择继续，否则阻止浏览器加载用户访问界面，返回步骤107。
实施例三
本发明实施例三提供了一种实现网络防钓鱼的方法，如图5所示，包括：浏览器启动，加载网络防钓鱼控件，所述网络防钓鱼控件(以下简称控件)执行以下操作：
步骤201：控件从注册表中读取安装路径；
其中，安装路径用于标识加密的黑名单、白名单和预设账号组合在内存中的存储位置；
本实施例三中，安装路径下包括一个黑名单、白名单和一个预设账号组合，黑名单、白名单中的URL数据为特定银行的黑白名单，该银行信息对应一个预设账号组合；
步骤202：控件判断安装路径下的黑白名单和预设账号组合是否存在，如果是，则执行步骤204，否则执行步骤203；
步骤203：控件通知网银助手后台服务从服务器中下载黑名单、白名单和预设账号组合，将接收到的加密的黑名单、白名单和加密的预设账号组合保存在安装路径下，执行步骤204；
本实施例三中，步骤203的操作与实施例1中步骤103的操作相同，在此不再赘述；
步骤204：控件从所述安装路径下读取加密的黑名单、白名单和加密的预设账号组合；
步骤205：控件对读取到的加密的黑名单、白名单和加密的预设账号组合进行解密，得到黑名单、白名单和预设账号组合；
具体地，控件应用预设解密算法对读取到的加密的黑名单、白名单和预设账号组合进行解密，优选地，预设解密算法为RC4算法，除此之外，还可以为MD5算法等；
本实施例以黑名单、白名单为XML文件为例来说明，网络防钓鱼控件解密得到的黑名单、白名单为：
Figure PCTCN2015087742-appb-000004
步骤206：控件从黑名单、白名单中获取银行信息、定制黑名单和定制白名单，并保存在内存中；
例如，从黑名单、白名单中获取到的定制黑名单为：
url＝"http://www.abcrchina.cn"
url＝"http://www.abichina.cn"
url＝"http://www.abcichina.cn"
从黑名单、白名单中获取到的定制白名单为：
url＝"http://cmbchina.com"
步骤207：控件等待接收浏览器的URL，判断浏览器的URL是否在定制黑名单中，如果是，则阻止浏览器加载所述浏览器的URL，返回步骤207，否则执行步骤208；
例如，控件接收到的浏览器的URL为"http://www.abcrchina.cn"，从黑名单中能够找到此URL；
步骤208：控件判断浏览器的URL是否在定制白名单中，如果是，则通知浏览器加载所述浏览器的URL，返回步骤207，否则执行步骤209；
例如，控件接收到浏览器的URL为"http://cmbchina.com"，从定制白名单中能够找到该URL，因此通知浏览器加载所述浏览器的URL；
步骤209：控件判断浏览器的URL与定制白名单中的URL是否符合预设模糊匹配条件，如果是，则执行步骤210，否则通知浏览器加载所述浏览器的URL，返回步骤207；
本实施例三中，步骤209的操作与实施例1中步骤109的操作相同，在此不再赘述；
例如，浏览器的URL为http://camdchina.com，与白名单中的URL http://cmbchina.com字符相差数为2，符合预设模糊匹配条件；
步骤210：控件提示用户正在进行危险操作，并检测用户是否选择继续，如果是，则通知浏览器加载所述浏览器的URL，执行步骤211，否则阻止浏览器加载所述浏览器的URL，返回步骤207；
步骤211：控件从内存中获取与浏览器的URL符合预设模糊匹配条件的定制白名单中 的URL对应的银行信息，获取与该银行信息对应的预设账号组合；
本实施例三中，所述步骤204和步骤205还可以为：从安装路径下获取加密的黑名单、白名单，对加密的黑名单、白名单进行解密，得到黑名单、白名单；对应的，所述步骤211具体为，获取与浏览器的URL符合预设模糊匹配条件的定制白名单中的URL对应的银行信息，获取与该银行信息对应的加密的预设账号组合，对加密的预设账号组合进行解密，得到预设账号组合；
本实施例三中，控件得到的预设账号组合为：
^622825\d{13}$
^622826\d{13}$
^622827\d{13}$
^491025\d{10}$
^491027\d{10}$
^491028\d{10}$
^491029\d{10}$
……
步骤212：控件等待接收用户输入的按键信息；
步骤213：当控件接收到用户输入的按键信息后，判断接收到的按键信息是否为数字键，如果是，则执行步骤214，否则返回步骤212；
步骤214：控件判断当前焦点的控件是否为输入框控件，如果是，则执行步骤215，否则返回步骤212；
步骤215：控件判断输入框控件是否为输入密码控件，如果是，则执行步骤212，否则执行步骤216；
步骤216：控件判断输入框控件里的字符是否符合预设账号组合，如果是，则执行步骤217，否则返回步骤212；
例如，网络防钓鱼控件接收到的输入框控件中的字符为数字，且为6228270001010202030，符合预设账号组合；
步骤217：控件提示用户正在进行危险操作，并检测用户是否选择继续，如果是，则通知浏览器跳转至用户访问界面，返回步骤207，否则阻止浏览器加载用户访问界面，返回步骤207；
本实施例三中，如果用户选择继续，则说明该URL为用户信任网站，因此可将该浏览器的URL保存至本地的白名单中；
其中，所述提示用户正在进行危险操作，检测用户是否选择继续，还包括：判断在所述预设时间内是否检测到用户的选择，如果是，则检测用户是否选择继续，否则阻止浏览器加载用户访问界面。
本发明实施例1适用于对所有银行的操作，实施例2适用于对特定银行的操作，两种方式使用的核心技术相同，解决的技术问题相同，达到的有益效果相同。
以上所述，仅为本发明较佳的具体实施方式，但本发明的保护范围并不局限于此，本领域的技术人员在本发明公开的技术范围内，可轻易想到的变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应该以所附权利要求书的保护范围为准。

Claims (15)

  1. 一种实现网络防钓鱼的方法，其特征在于，包括：浏览器启动，加载网络防钓鱼控件，所述网络防钓鱼控件执行以下操作：
    步骤S1：所述网络防钓鱼控件获取黑名单和白名单；
    步骤S2：所述网络防钓鱼控件等待接收浏览器的URL，判断所述浏览器的URL，若在所述黑名单中，则阻止浏览器加载所述浏览器的URL，返回步骤S2，若在所述白名单中，则通知浏览器加载所述浏览器的URL，返回步骤S2，否则执行步骤S3；
    步骤S3：所述网络防钓鱼控件判断所述浏览器的URL与所述白名单中的URL是否符合预设模糊匹配条件，如果是，则执行步骤S4，否则通知浏览器加载所述浏览器的URL，返回步骤S2；
    步骤S4：所述网络防钓鱼控件提示用户正在进行危险操作，检测用户是否选择继续，如果是，则通知浏览器加载所述浏览器的URL，执行步骤S5，否则阻止浏览器加载所述浏览器的URL，返回步骤S2；
    步骤S5：所述网络防钓鱼控件从所述白名单中获取与所述浏览器的URL符合预设模糊匹配条件的URL对应的预设账号组合；
    步骤S6：所述网络防钓鱼控件等待接收用户输入的按键信息，当接收到用户输入的按键信息后，判断接收到的按键信息是否为数字键，如果是，则执行步骤S7，否则继续执行步骤S6；
    步骤S7：所述网络防钓鱼控件判断输入焦点是否为输入框控件，如果是，则执行步骤S8，否则返回步骤S6；
    步骤S8：所述网络防钓鱼控件获取所述输入框控件中用户输入的按键信息，判断所述按键信息是否符合所述预设账号组合，如果是，则执行步骤S9，否则返回步骤S6；以及
    步骤S9：所述网络防钓鱼控件提示用户正在进行危险操作，检测用户是否选择继续，如果是，则通知浏览器跳转至用户访问界面，返回步骤S2，否则阻止浏览器加载用户访问界面，返回步骤S2。
  2. 如权利要求1所述的方法，其特征在于，所述步骤S1，具体包括：所述网络防钓鱼控件从注册表中读取安装路径，从所述安装路径下获取所述黑名单、所述白名单和预设账号组合，并保存。
  3. 如权利要求2所述的方法，其特征在于，所述步骤S1还包括：
    步骤a1：所述网络防钓鱼控件判断所述安装路径下的所述黑名单、所述白名单和所述预设账号组合是否存在，如果是，则从所述安装路径下获取所述黑名单、所述白名单和预设账号组合，并保存，执行步骤S2，否则执行步骤a2；以及
    步骤a2：所述网络防钓鱼控件通知网银助手后台服务从服务器中下载黑名单、白名单和预设账号组合，将接收到的黑名单、白名单和预设账号组合保存至所述安装路径下，执行步骤S2。
  4. 如权利要求3所述的方法，其特征在于，所述步骤a1，还可以为：所述网络防钓鱼控件判断所述安装路径下的所述黑名单、所述白名单和所述预设账号组合是否需要更新，如果是，则执行步骤a2，否则从所述安装路径下获取所述黑名单、所述白名单和预设账号组合，并保存，执行步骤S2。
  5. 如权利要求3所述的方法，其特征在于，所述步骤a1，还可以为：所述网络防钓鱼控件判断所述安装路径下的所述黑名单、所述白名单和所述预设账号组合是否被篡改，如果是，则执行步骤a2，否则从所述安装路径下获取所述黑名单、所述白名单和预设账号组合，并保存，执行步骤S2。
  6. 如权利要求3所述的方法，其特征在于，所述步骤a2，具体为：
    步骤b1：所述网络防钓鱼控件通知网银助手后台服务从服务器中下载黑名单、白名单 和预设账号组合；
    步骤b2：所述网银助手后台服务接收到所述网络防钓鱼控件的下载通知后，通知服务器下载黑名单、白名单和预设账号组合；
    步骤b3：所述服务器接收到所述网银助手后台服务的下载通知后，获取加密的黑名单、白名单和加密的预设账号组合，并发送给所述网银助手后台服务；
    步骤b4：所述网银助手后台服务将所述加密的黑名单、白名单和所述加密的预设账号组合发送给所述网络防钓鱼控件；
    步骤b5：所述网络防钓鱼控件接收到所述加密的黑名单、白名单和所述加密的预设账号组合后，对所述加密的黑名单、白名单和所述加密的预设账号组合做预设解密计算，得到解密数据；
    步骤b6：所述网络防钓鱼控件从所述解密数据中截取预设长度的数据，作为第一摘要值，对所述解密数据中除第一摘要值之外的数据，进行摘要计算，生成第二摘要值；
    步骤b7：所述网络防钓鱼控件判断第一摘要值与第二摘要值是否相同，如果是，则将所述加密的黑名单、白名单和所述加密的预设账号组合保存至所述安装路径下，执行步骤S2，否则执行步骤b8；以及
    步骤b8：所述网络防钓鱼控件判断下载通知是否已重发预设次数，如果是，则结束，否则执行步骤b1；
    所述从所述安装路径下获取所述黑名单、所述白名单和预设账号组合，并保存，具体为：从所述安装路径下获取加密的黑名单、白名单和加密的预设账号组合，对所述加密的黑名单、白名单和加密的预设账号组合进行解密，得到黑名单、白名单和预设账号组合，并保存。
  7. 如权利要求1所述的方法，其特征在于，
    所述步骤S1，具体包括：所述网络防钓鱼控件获取通用黑名单、通用白名单、各银行信息对应的定制白名单、定制黑名单；
    所述步骤S2，具体包括：所述网络防钓鱼控件等待接收浏览器的URL，判断所述浏览器的URL，若是在所述通用黑名单或所述各银行对应的定制黑名单中，则阻止浏览器加载所述浏览器的URL，返回步骤S2，若是在所述通用白名单或所述各银行信息对应的定制白名单中，则通知浏览器加载所述浏览器的URL，返回步骤S2，否则执行步骤S3；
    所述步骤S4判断为是时，通知浏览器加载所述浏览器的URL，之后还包括：所述网络防钓鱼控件获取并判断与所述浏览器的URL符合预设模糊匹配条件的白名单中的URL，如果是在所述通用白名单中，则获取所有银行信息对应的预设账号组合，执行步骤S6，如果是在所述各银行信息对应的定制白名单中，则执行步骤S5；以及
    所述步骤S5具体为：所述网络防钓鱼控件从内存中获取与所述浏览器的URL符合预设模糊匹配条件的所述白名单中的URL对应的银行信息，获取与所述银行信息对应的预设账号组合。
  8. 如权利要求1所述的方法，其特征在于，
    所述步骤S1，具体包括：所述网络防钓鱼控件获取定制白名单和定制黑名单；
    所述步骤S2，具体包括：所述网络防钓鱼控件等待接收浏览器的URL，判断所述浏览器的URL，若是在所述定制黑名单中，则阻止浏览器加载所述浏览器的URL，返回步骤S2，若是在所述定制白名单中，则通知浏览器加载所述浏览器的URL，返回步骤S2，否则执行步骤S3；以及
    所述步骤S5具体为：所述网络防钓鱼控件获取与所述浏览器的URL符合预设模糊匹配条件的所述定制白名单中的URL对应的银行信息，获取与所述银行信息对应的预设账号组合。
  9. 如权利要求1所述的方法，其特征在于，所述阻止浏览器加载所述浏览器的URL， 具体为：所述网络防钓鱼控件关闭所述浏览器的URL对应的标签页或将所述浏览器的URL对应的标签页加载为空页面。
  10. 如权利要求1所述的方法，其特征在于，所述步骤S6，具体为：判断所述浏览器的URL与所述白名单中的URL的字符相差数是否不大于预设差值，如果是，则符合预设模糊匹配条件，执行步骤S4，否则不符合预设模糊匹配条件，通知浏览器加载所述浏览器的URL，返回步骤S2。
  11. 如权利要求10所述的方法，其特征在于，所述判断所述浏览器的URL与所述白名单中的URL的字符相差数是否不大于预设差值，具体为：
    步骤1：所述网络防钓鱼控件从所述白名单中获取一个未处理的URL，将该未处理的URL作为当前URL；
    步骤2：所述网络防钓鱼控件获取当前URL的第一字符串长度和所述浏览器的URL的第二字符串长度，判断所述第一字符串长度与所述第二字符串长度之差是否大于所述预设差值，如果是，则执行步骤4，否则执行步骤3；
    步骤3：所述网络防钓鱼控件判断所述浏览器的URL与所述当前URL的字符相差数是否不大于预设差值，如果是，则所述浏览器的URL与所述白名单中的URL符合预设模糊匹配条件，执行步骤S4，否则执行步骤4；以及
    步骤4：所述网络防钓鱼控件判断所述白名单中是否还有未处理的URL，如果是，则执行步骤1，否则所述浏览器的URL不符合预设模糊匹配条件，通知浏览器加载所述浏览器的URL，返回步骤S2。
  12. 如权利要求11所述的方法，其特征在于，所述步骤3，具体为：
    步骤c1：网络防钓鱼控件构造一个行数为第一字符串长度加1、列数为第二字符串长度加1，且矩阵元素值全为零的矩阵，将所述矩阵的第一行对应的矩阵元素值初始化为0至第一字符串长度，将所述矩阵的第一列对应的矩阵元素值初始化为0至第二字符串长度；
    步骤c2：网络防钓鱼控件从所述矩阵中获取未更新的当前行和当前列，根据当前行获取当前URL中对应的当前行字符，并根据当前列获取浏览器的URL中对应的当前列字符；
    步骤c3：网络防钓鱼控件判断当前行字符与当前列字符是否相同，如果是，则将添加值置为0，执行步骤c4，否则将添加值置为1，执行步骤c4；
    步骤c4：网络防钓鱼控件计算当前行减1和当前列对应的矩阵元素值加1，得到的值作为第一数值，计算当前行和当前列减1对应的矩阵元素值加1，得到的值作为第二数值，计算当前行减1和当前列减1对应的矩阵元素值加添加值，得到的值作为第三数值；
    步骤c5：所述网络防钓鱼控件根据第一数值、第二数值和第三数值的最小值，更新当前行和当前列对应的矩阵元素值；
    步骤c6：网络防钓鱼控件判断是否还有未更新的矩阵元素值，如果是，则返回执行步骤c4，否则执行步骤c7；以及
    步骤c7：网络防钓鱼控件获取行数为第一字符串长度加1、列数为第二字符串长度加1对应的矩阵元素值，判断该矩阵元素值是否小于等于所述预设差值，如果是，则所述浏览器的URL符合预设模糊匹配条件，执行步骤S4，否则执行步骤4。
  13. 如权利要求1所述的方法，其特征在于，所述阻止浏览器加载所述浏览器的URL之后，还包括：所述网络防钓鱼控件将所述浏览器的URL保存至所述黑名单中，所述网络防钓鱼控件通知网银助手后台服务将所述浏览器的URL发送给服务器，所述服务器在预定时间后人工检测所述浏览器的URL的数量，当所述浏览器的URL的数量达到预设值时，将所述浏览器的URL保存至服务器的加密的黑名单、白名单中。
  14. 如权利要求1所述的方法，其特征在于，
    所述步骤S4中，所述提示用户正在进行危险操作之后，还包括：判断在预设时间内是否检测到用户的选择，如果是，则检测用户是否选择继续，否则阻止浏览器加载所述浏览 器的URL，返回步骤S2；以及
    所述步骤S9中，所述提示用户正在进行危险操作，检测用户是否选择继续，还包括：判断在所述预设时间内是否检测到用户的选择，如果是，则检测用户是否选择继续，否则阻止浏览器加载用户访问界面，返回步骤S2。
  15. 如权利要求1所述的方法，其特征在于，所述步骤S7判断为是时，还包括：所述网络防钓鱼控件判断所述输入框控件是否为输入密码控件，如果是，则返回执行步骤S6，否则执行步骤S8。
PCT/CN2015/087742 2014-09-03 2015-08-21 一种实现网络防钓鱼的方法 WO2016034048A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US15/502,797 US10659494B2 (en) 2014-09-03 2015-08-21 Method for implementing online anti-phishing

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410446939.0 2014-09-03
CN201410446939.0A CN104243460B (zh) 2014-09-03 2014-09-03 一种实现网络防钓鱼的方法

Publications (1)

Publication Number Publication Date
WO2016034048A1 true WO2016034048A1 (zh) 2016-03-10

Family

ID=52230810

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/087742 WO2016034048A1 (zh) 2014-09-03 2015-08-21 一种实现网络防钓鱼的方法

Country Status (3)

Country Link
US (1) US10659494B2 (zh)
CN (1) CN104243460B (zh)
WO (1) WO2016034048A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109889546A (zh) * 2019-03-28 2019-06-14 北京邮电大学 一种快速细粒度多域网络互联安全控制方法
CN110278271A (zh) * 2019-06-24 2019-09-24 厦门美图之家科技有限公司 网络请求控制方法、装置及终端设备

Families Citing this family (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104243460B (zh) * 2014-09-03 2018-04-27 飞天诚信科技股份有限公司 一种实现网络防钓鱼的方法
US10091214B2 (en) * 2015-05-11 2018-10-02 Finjan Mobile, Inc. Malware warning
CN104915594B (zh) * 2015-06-30 2019-02-12 北京奇虎科技有限公司 应用程序运行方法及装置
US10728301B1 (en) * 2015-12-21 2020-07-28 Highwinds Holdings, Inc. Cryptographic content delivery network
US10333973B1 (en) 2016-05-25 2019-06-25 Wells Fargo Bank, N.A. Managing unpatched users
CN106101117B (zh) * 2016-06-28 2019-06-07 中国联合网络通信集团有限公司 一种钓鱼网站阻断方法、装置和系统
CN107968769A (zh) * 2016-10-19 2018-04-27 中兴通讯股份有限公司 网页安全检测方法及装置
WO2018085732A1 (en) 2016-11-03 2018-05-11 RiskIQ, Inc. Techniques for detecting malicious behavior using an accomplice model
CN108206806A (zh) * 2016-12-16 2018-06-26 广东世纪网通信设备股份有限公司 钓鱼网站拦截方法、装置以及用于拦截钓鱼网站的服务器
CN108092962B (zh) * 2017-12-08 2020-11-06 奇安信科技集团股份有限公司 一种恶意url检测方法及装置
CN109063195B (zh) * 2018-08-31 2019-10-29 北京诚志重科海图科技有限公司 一种信息检索方法和装置
CN110808955B (zh) * 2019-09-29 2021-11-16 烽火通信科技股份有限公司 一种实现url动态变换的系统及方法
CN111159701B (zh) * 2019-12-25 2023-09-29 五八同城信息技术有限公司 第三方页面加载方法、装置、电子设备及存储介质
CN111666172B (zh) * 2020-06-07 2023-07-07 中信银行股份有限公司 网银环境的保护方法、装置、电子设备以及存储介质
CN111859373B (zh) * 2020-07-15 2024-05-28 杭州安恒信息技术股份有限公司 一种针对hid攻击的防御方法、装置和计算机设备
CN113420239B (zh) * 2021-06-24 2023-08-01 中山大学 一种基于hacker搜索语法的钓鱼站点检测方法
CN114980115B (zh) * 2021-08-10 2023-09-01 中移互联网有限公司 消息链接安全管控的方法及系统

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102299918A (zh) * 2011-07-08 2011-12-28 盛大计算机（上海）有限公司 一种网络交易安全系统及方法
CN102790762A (zh) * 2012-06-18 2012-11-21 东南大学 基于url分类的钓鱼网站检测方法
CN102932348A (zh) * 2012-10-30 2013-02-13 常州大学 一种钓鱼网站的实时检测方法及系统
US8381292B1 (en) * 2008-12-30 2013-02-19 The Uab Research Foundation System and method for branding a phishing website using advanced pattern matching
CN103428186A (zh) * 2012-05-24 2013-12-04 中国移动通信集团公司 一种检测钓鱼网站的方法及装置
CN104243460A (zh) * 2014-09-03 2014-12-24 飞天诚信科技股份有限公司 一种实现网络防钓鱼的方法

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8353016B1 (en) * 2008-02-29 2013-01-08 Adobe Systems Incorporated Secure portable store for security skins and authentication information
US8666904B2 (en) * 2008-08-20 2014-03-04 Adobe Systems Incorporated System and method for trusted embedded user interface for secure payments
US8468597B1 (en) * 2008-12-30 2013-06-18 Uab Research Foundation System and method for identifying a phishing website
CN102231745A (zh) * 2011-07-08 2011-11-02 盛大计算机（上海）有限公司 一种网络应用的安全系统及方法
CN102664878B (zh) * 2012-04-10 2014-09-03 中国科学院计算机网络信息中心 仿冒域名检测方法及设备
US9973534B2 (en) * 2013-11-04 2018-05-15 Lookout, Inc. Methods and systems for secure network connections

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8381292B1 (en) * 2008-12-30 2013-02-19 The Uab Research Foundation System and method for branding a phishing website using advanced pattern matching
CN102299918A (zh) * 2011-07-08 2011-12-28 盛大计算机（上海）有限公司 一种网络交易安全系统及方法
CN103428186A (zh) * 2012-05-24 2013-12-04 中国移动通信集团公司 一种检测钓鱼网站的方法及装置
CN102790762A (zh) * 2012-06-18 2012-11-21 东南大学 基于url分类的钓鱼网站检测方法
CN102932348A (zh) * 2012-10-30 2013-02-13 常州大学 一种钓鱼网站的实时检测方法及系统
CN104243460A (zh) * 2014-09-03 2014-12-24 飞天诚信科技股份有限公司 一种实现网络防钓鱼的方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109889546A (zh) * 2019-03-28 2019-06-14 北京邮电大学 一种快速细粒度多域网络互联安全控制方法
CN110278271A (zh) * 2019-06-24 2019-09-24 厦门美图之家科技有限公司 网络请求控制方法、装置及终端设备

Also Published As

Publication number Publication date
CN104243460A (zh) 2014-12-24
US20170237775A1 (en) 2017-08-17
US10659494B2 (en) 2020-05-19
CN104243460B (zh) 2018-04-27

Similar Documents

Publication Publication Date Title
WO2016034048A1 (zh) 一种实现网络防钓鱼的方法
US8312520B2 (en) Methods and systems to detect attacks on internet transactions
US10255053B2 (en) Alerting the presence of bundled software during an installation
US9547765B2 (en) Validating a type of a peripheral device
US7783891B2 (en) System and method facilitating secure credential management
CN105446713B (zh) 安全存储方法及设备
JP6100898B2 (ja) メッセージを処理するための方法およびデバイス
US9898739B2 (en) System and method for ensuring safety of online transactions
US9426134B2 (en) Method and systems for the authentication of a user
KR101851686B1 (ko) 거래 인증을 위하여 추출된 무작위 일회용 패스워드
US10169580B2 (en) Identifying whether an application is malicious
US9148415B2 (en) Method and system for accessing e-book data
US8656160B2 (en) Computer system authentication using security indicator
US20090187763A1 (en) System and method for protecting data accessed through a network connection
CN104063788B (zh) 一种移动平台可信支付系统及方法
WO2010123565A1 (en) System and method for protecting against malware utilizing key loggers
WO2008012567A1 (en) Secure use of user secrets on a computing platform
CN111163094B (zh) 网络攻击检测方法、网络攻击检测装置、电子设备和介质
WO2017084569A1 (zh) 在智能终端中获取登陆凭证的方法、智能终端以及操作系统
CN106664535A (zh) 一种信息发送方法、装置、终端设备以及系统
KR101745919B1 (ko) 패스워드 노출 없는 소프트웨어 방식의 hsm을 이용한 사용자 인증 방법 및 시스템
JP6634737B2 (ja) 移動通信端末、アプリ判定システム、及び移動通信端末の制御方法
EP2854088A1 (en) A system and method for ensuring safety of online transactions
KR20170065922A (ko) 금융 서비스를 위한 단말 및 그의 금융 서비스 방법
KR20170065929A (ko) 금융 서비스를 위한 단말 및 그의 금융 서비스 방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15838270

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15838270

Country of ref document: EP

Kind code of ref document: A1