WO2016201994A1 - 域名可信度确定的方法及装置 - Google Patents

域名可信度确定的方法及装置 Download PDF

Info

Publication number
WO2016201994A1
WO2016201994A1 PCT/CN2016/073118 CN2016073118W WO2016201994A1 WO 2016201994 A1 WO2016201994 A1 WO 2016201994A1 CN 2016073118 W CN2016073118 W CN 2016073118W WO 2016201994 A1 WO2016201994 A1 WO 2016201994A1
Authority
WO
WIPO (PCT)
Prior art keywords
domain name
detected
similarity
determining
real
Prior art date
Application number
PCT/CN2016/073118
Other languages
English (en)
French (fr)
Inventor
李庆宁
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016201994A1 publication Critical patent/WO2016201994A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1483—Countermeasures against malicious traffic service impersonation, e.g. phishing, pharming or web spoofing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
    • H04L61/4511—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]

Definitions

  • the present invention relates to the field of communications, and in particular to a method and apparatus for determining domain name credibility.
  • Figure 1 shows the phishing attacks in various countries. pie chart. According to the "2009 China Netizen Network Information Security Status Survey Report" released by the United Nations Internet Emergency Center of the China Internet Network Information Center, more than 90% of Internet users encountered phishing in 2009. Among the netizens who have experienced phishing incidents, 45 million netizens suffered economic losses, accounting for 11.9% of the total number of netizens. The damage caused by phishing to netizens has reached 7.6 billion yuan.
  • the whitelisting method is that only websites that are within the whitelist are credible, otherwise they are not credible.
  • the blacklist method is that the websites in the blacklist are all untrustworthy, and the blacklists are all trusted.
  • the method of combining black and white lists is to combine the advantages of the above two methods.
  • the whitelist is trusted.
  • the blacklists are all untrustworthy, others are suspicious and need to be identified.
  • the main object of the present invention is to provide a method and a device for determining domain name credibility, so as to at least solve the problem that the accuracy of the determination of an illegal domain name is low and the determination is complicated.
  • a method for determining a domain name credibility including: performing a similarity judgment on a domain name to be detected and a real domain name; and determining a credibility of the domain name to be detected according to the judgment result. degree.
  • determining the similarity between the domain name to be detected and the real domain name includes: determining a similarity between the domain name to be detected and the real domain name recorded in the real domain name database, where the real domain name recorded in the real domain name database needs to be protected The real domain name.
  • determining the similarity judgment between the domain name to be detected and the real domain name includes: determining a largest similar substring in the character string of the to-be-detected domain name and the real domain name; according to the maximum similar substring and the predefined The similarity between the characters determines the similarity between the domain name to be detected and the real domain name.
  • determining, according to the determination result, the credibility of the to-be-detected domain name includes: determining the domain name to be detected when the similarity between the to-be-detected domain name and the real domain name is 100% or the similarity is less than a predetermined threshold.
  • the trusted domain name wherein the predetermined threshold is less than 100%; and when the similarity between the to-be-detected domain name and the real domain name is greater than or equal to a predetermined threshold and less than 100%, determining that the to-be-detected domain name is a suspicious domain name.
  • At least one of the following is displayed: displaying alarm information for reminding that the to-be-detected domain name is a suspicious domain name; and adding the to-be-detected domain name to the blacklist.
  • an apparatus for determining a domain name credibility includes: a processing module configured to perform a similarity determination between a domain name to be detected and a real domain name; and a determining module configured to determine the The credibility of the domain name to be detected.
  • the processing module includes: determining a similarity between the domain name to be detected and the real domain name recorded in the real domain name database, where the real domain name recorded in the real domain name database is a real domain name to be protected.
  • the processing module includes: a first determining unit, configured to determine a largest similar substring in the character string of the to-be-detected domain name and the real domain name; and a second determining unit, configured to be according to the maximum The similarity between the similar substring and the predefined character determines the similarity between the to-be-detected domain name and the real domain name.
  • the determining module includes: a third determining unit, configured to determine that the to-be-detected domain name is ok when the similarity between the to-be-detected domain name and the real domain name is 100% or the similarity is less than a predetermined threshold. a domain name, wherein the predetermined threshold is less than 100%; and the fourth determining unit is configured to determine that the to-be-detected when the similarity between the to-be-detected domain name and the real domain name is greater than or equal to a predetermined threshold and less than 100%
  • the domain name is a suspicious domain name.
  • the device further includes at least one of the following: an alarm module, configured to display alarm information for reminding that the domain name to be detected is a suspicious domain name, and adding a module, configured to add the domain name to be detected to a blacklist.
  • an alarm module configured to display alarm information for reminding that the domain name to be detected is a suspicious domain name
  • adding a module configured to add the domain name to be detected to a blacklist.
  • the method for determining the degree of similarity between the domain name to be detected and the real domain name and determining the credibility of the domain name to be detected according to the judgment result does not need to adopt a complicated means for analyzing the content of the webpage, and directly performs the domain name to be detected and the real domain name.
  • the similarity judgment solves the problem that the accuracy of the determination of the illegal domain name is low and the judgment is complicated in the related art, and the effect of improving the accuracy of determining the illegal domain name and reducing the complexity of the judgment is achieved.
  • Figure 1 is a pie chart of phishing attacks in various countries
  • FIG. 2 is a flowchart of a method for determining a domain name credibility according to an embodiment of the present invention
  • FIG. 3 is a structural block diagram of a domain name credibility determining apparatus according to an embodiment of the present invention.
  • FIG. 4 is a structural block diagram of a processing module 32 in a domain name credibility determining apparatus according to an embodiment of the present invention
  • FIG. 5 is a structural block diagram of a determining module 34 in a domain name credibility determining apparatus according to an embodiment of the present invention
  • FIG. 6 is a block diagram showing a preferred structure of a domain name credibility determining apparatus according to an embodiment of the present invention.
  • FIG. 7 is a block diagram of an apparatus of an anti-phishing device according to an embodiment of the present invention.
  • FIG. 8 is a flowchart showing an operation of an anti-phishing fraud device applied to a browser according to an embodiment of the present invention
  • FIG. 9 is a flowchart showing the operation of an anti-phishing device in a domain name application system according to an embodiment of the present invention.
  • FIG. 10 is a flowchart showing the operation of the anti-phishing device in the gateway device according to an embodiment of the present invention.
  • FIG. 2 is a flowchart of a method for determining a domain name credibility according to an embodiment of the present invention. As shown in FIG. 2, the method includes:
  • Step S202 performing a similarity judgment on the domain name to be detected and the real domain name
  • Step S204 Determine the credibility of the domain name to be detected according to the judgment result.
  • the reliability of the domain name to be detected can be determined directly according to the similarity judgment result of the domain name to be detected and the real domain name, and the complicated method such as analyzing the content of the webpage is not needed, and the present invention is solved.
  • the accuracy of the illegal domain name is low, and the complicated problem is determined.
  • the judgment of the illegal domain name is more purposeful and intelligent. To a certain extent, the security of the user's network transaction is guaranteed, and the accuracy of determining the illegal domain name is improved and the accuracy is lowered.
  • the real domain name may be a domain name in a real domain name database, and the domain name stored in the real domain name database is a legal domain name, or may be a domain name to be protected. Therefore, the real domain name that is similar to the domain name to be detected is a legal domain name, and may also be a protected domain name.
  • the real domain name to be protected can be conveniently found, and the efficiency of similarity judgment is improved.
  • step S202 may be implemented as follows: determining a largest similar substring in a string of a domain name to be detected and a real domain name; according to a similarity between the largest similar substring and a predefined character Determine the similarity between the domain name to be detected and the real domain name.
  • the similarity between the domain name to be detected and the real domain name can be quickly obtained. degree.
  • the method for determining the largest similar substring of the domain name to be detected and the real domain name may be a suffix tree algorithm or other algorithms.
  • Step S204 is implemented in various manners.
  • step S204 may include: when the similarity between the detected domain name and the real domain name is 100% or the similarity is less than a predetermined threshold, determining that the domain name to be detected is The trusted domain name, wherein the predetermined threshold is less than 100%; when the similarity between the to-be-detected domain name and the real domain name is greater than or equal to a predetermined threshold and less than 100%, the domain name to be detected is determined to be a suspicious domain name.
  • the similarity between the to-be-detected domain name and the real domain name may be matched with the predetermined similarity determination rule to determine whether the to-be-detected domain name is a trusted domain name.
  • the alarm information for reminding the domain name to be detected as a suspicious domain name may be displayed; and/or the domain name to be detected is added to the black domain. List.
  • the user may be protected to some extent from phishing scams, and/or, in the to-be-checked When the domain name is again suspected of phishing, the domain name to be detected is quickly located as a suspicious domain name, and access to the suspicious domain name is prohibited.
  • the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation.
  • the technical solution of the present invention which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk,
  • the optical disc includes a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present invention.
  • a device for determining the domain name credibility is further provided, and the device is used to implement the foregoing embodiments and preferred embodiments, and details are not described herein.
  • the term "module” may implement a combination of software and/or hardware of a predetermined function.
  • the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • FIG. 3 is a structural block diagram of a domain name credibility determining device according to an embodiment of the present invention. As shown in FIG. 3, the device includes a processing module 32 and Determining module 34, the device is described below:
  • the processing module 32 is configured to determine the similarity between the domain name to be detected and the real domain name.
  • the determining module 34 is connected to the processing module 32, and is configured to determine the credibility of the domain name to be detected according to the determination result.
  • the processing module 32 is implemented in various manners.
  • the processing module 32 may be configured to determine the similarity between the domain name to be detected and the real domain name recorded in the real domain name database, where The real domain name recorded in the real domain name database is the real domain name that needs to be protected.
  • the processing module 32 may be configured to determine the similarity between the domain name to be detected and the real domain name recorded in the real domain name database, where The real domain name recorded in the real domain name database is the real domain name that needs to be protected.
  • the real domain name to be protected can be conveniently found, and the efficiency of the similarity judgment is improved.
  • FIG. 4 is a structural block diagram of a processing module 32 in a domain name credibility determining apparatus according to an embodiment of the present invention. As shown in FIG. 4, the processing module 32 includes a first determining unit 42 and a second determining unit 44. Processing module 32 is described.
  • the first determining unit 42 is configured to determine a largest similar substring in the character string of the domain name to be detected and the real domain name; the second determining unit 44 is connected to the first determining unit 42 to be set according to the largest similar substring and The similarity between the predefined characters determines the similarity between the domain to be detected and the real domain name.
  • the first determining unit 42 may first determine the largest similar substring of the domain name to be detected and the real domain name, and then the second determining unit 44 may be similar to other characters according to the predetermined character. Degree, quickly get the similarity between the domain to be detected and the real domain name.
  • the first determining unit 42 determines the domain name to be detected and The method of maximizing similar substrings of real domain names may use a suffix tree algorithm or other algorithms.
  • FIG. 5 is a structural block diagram of a determining module 34 in a domain name credibility determining apparatus according to an embodiment of the present invention. As shown in FIG. 5, the determining module 34 includes a third determining unit 52 and a fourth determining unit 54, which are determined below. Module 34 is described.
  • the third determining unit 52 is configured to: when the similarity between the detected domain name and the real domain name is 100% or the similarity is less than a predetermined threshold, determine that the domain name to be detected is a trusted domain name, wherein the predetermined threshold is less than 100%; and the fourth determining unit 54.
  • the similarity between the to-be-detected domain name and the real domain name is greater than or equal to a predetermined threshold and less than 100%, the domain name to be detected is determined to be a suspicious domain name.
  • the similarity between the to-be-detected domain name and the real domain name may be matched with the predetermined similarity determination rule to determine whether the to-be-detected domain name is a trusted domain name.
  • FIG. 6 is a block diagram showing a preferred structure of a domain name credibility determining apparatus according to an embodiment of the present invention. As shown in FIG. 6, the apparatus includes an alarm module 62 and/or an adding module 64 in addition to all the modules shown in FIG. The device will be described below.
  • the alarm module 62 is connected to the determining module 34, and is configured to display, when the domain name to be detected is a suspicious domain name, alarm information for reminding the domain name to be detected as a suspicious domain name; and/or, adding a module 64, connecting The determining module 34 is configured to add the to-be-detected domain name to the blacklist if the domain name to be detected is determined to be a suspicious domain name.
  • the user may be protected from phishing scams to a certain extent, and/or the domain name to be detected may be quickly identified as a suspicious domain name according to the blacklist technology when the domain name to be detected is suspected of being phishing again. .
  • each of the above modules may be implemented by software or hardware.
  • the processing module 32 and the determining module 34 are located in the same processor, or the processing module 32 and determination module 34 are located in the first processor and the second processor, respectively.
  • the present invention is exemplified in combination with a specific application scenario.
  • the fraud is mainly performed by registering a similar or similar domain name, which is used to imitate the domain name that the user needs to access, such as fraud.
  • Www.cctv01.com, www.taobao.com-agc.us and other domain names are suspected of fraud.
  • the embodiments of the present invention are mainly directed to such phishing fraud using a WEB webpage method.
  • the embodiment can also be used to protect certain websites specified by the user, such as Taobao, eBay, cctv, and some well-known public domain names that are commonly used by users.
  • FIG. 7 is a block diagram of an apparatus for an anti-phishing device according to an embodiment of the present invention.
  • the anti-phishing device in the embodiment ie, the device for determining domain name credibility
  • the device for determining domain name credibility includes:
  • the real domain name database 72 is used to store the real domain name that the user needs to protect;
  • the similarity calculation module 74 is configured to calculate a similarity between the domain name that the user is accessing and the real domain name;
  • the phishing fraud determination module 76 is configured to determine whether the currently accessed domain name is a phishing scam
  • the result feedback module 78 returns to the user whether the currently accessed domain name is suspected of phishing fraud
  • the phishing website database 710 which is a well-known phishing URL data, is set to more clearly determine cyber fraud.
  • the data comes from the user's input, and the feedback can be used to update and share the knowledge after the user uses the device.
  • the specific processing method includes the following steps:
  • Step A The similarity calculation module 74 retrieves the domain name accessed by the user, for example, extracts the domain name accessed by the user from the uniform resource locator (URL);
  • URL uniform resource locator
  • Step B The similarity calculation module 74 performs similarity calculation with the domain name accessed by the user and the domain name in the real domain name database 72;
  • Step C the similarity calculation module 74 passes the calculated result to the phishing fraud determination module 76 for determination;
  • step D the result feedback module 78 performs feedback on the result.
  • the user can determine, according to the judgment result, that the accessed domain name is a phishing scam, and the domain name access is not allowed. If the result of the determination may be phishing scam, the user is alerted.
  • the anti-phishing device in this embodiment also provides an interface to perform:
  • Phishing website configuration used to update the phishing website database.
  • the degree of similarity calculation is mainly done by changing the suffix tree.
  • the Suffix tree is a data structure that can quickly solve many problems about strings.
  • the concept of the suffix tree was first proposed by Weiner in 1973, and was improved by McCrex in 1976 and Ukkonen in 1992 and 1995.
  • the purpose of the suffix tree is to support efficient string matching and querying. Can be used to easily match the largest common substring of two strings.
  • the suffix tree needs to be extended and modified, and is mainly used to query the largest of the two strings.
  • the similar substrings are then derived to the similarity of the two strings.
  • the definition of the degree of similarity between characters as defined in Table 1:
  • Character A Character B similarity 1 l 0.97 0 o 0.95 p q 0.6 u v 0.8 y v 0.9
  • the degree of similarity can be calculated for the two strings, and then the decision rule shown in Table 2 can be defined according to the degree of similarity. Whether the domain name accessed is trusted. Of course, this rule can be modified through configuration.
  • the present embodiment introduces a real domain name database 72, a similarity calculation module 74, and a phishing fraud determination module 76, and determines whether a domain name is by using a data structure of a suffix tree to calculate a string similarity degree algorithm.
  • the method of phishing websites makes the judgment of anti-phishing scam more purposeful and intelligent, on the one hand, guarantees the security of users to conduct network transactions, and on the other hand improves the performance of judging phishing scam. Same
  • the existing blacklist technology can also be used to blacklist the domain name of the determined phishing website, so that the phishing fraud information can be determined and checked more quickly.
  • the anti-phishing device ie, the device for determining the domain name credibility may also be used for a domain name registration system, a browser plug-in used by an end user, a gateway device, a network device, etc.
  • a domain name registration system ie, a browser plug-in used by an end user
  • a gateway device ie, a gateway device
  • network device ie, a network device, etc. The following describes the use of the anti-phishing device in the browser, the domain name application system, and the gateway device.
  • the anti-phishing device can be used in a browser to integrate the device by using a plug-in in a browser, and can protect the user from visiting the phishing website in time, and can perform timely and efficient operation. Anti-phishing fraud.
  • FIG. 8 is a flowchart showing the operation of the anti-phishing device in the browser according to an embodiment of the present invention. As shown in FIG. 8, the method includes:
  • Step S802 the user inputs a URL to be accessed on the browser
  • Step S804 the user submits a URL access request.
  • Step S806 the browser plugin obtains the URL
  • Step S808 calling the interface of the device to perform an inspection
  • Step S810 determining whether the visited site is a phishing site
  • Step S812 if suspicious, an alarm is popped up, and the user decides whether to continue to request the webpage;
  • Step S814 if it is determined to be a phishing website, the access is denied;
  • the anti-phishing device can be used in the domain name application system, and all domain name assignments are performed by the domain name registration authority, so in order to conduct anti-phishing fraud from the source, the device can apply for the domain name. Used in the system, it can also be used in applications that prevent malicious domain cybersquatting.
  • FIG. 9 is a flow chart showing the operation of the anti-phishing device in the domain name application system according to an embodiment of the present invention, as shown in FIG.
  • Step S902 accepting a user application request when the user prepares to register a domain name
  • Step S904 after the user submits the registration request, acquire the domain name that the user wants to apply;
  • Step S906 calling the device to perform an inspection
  • Step S908 performing a result check to determine whether the domain name constitutes a phishing webpage
  • Step S910 if the check result is credible, the registration is permitted
  • step S912 if the check result is suspicious, an alarm is generated, and the user is not allowed to apply for registration, and the user can make a representation. If the appeal is successful, the process goes to step S910, otherwise, the process goes to S902, and the application is re-applied.
  • the anti-phishing device can be used on the gateway device to control at the network device level, which can reduce the cost of deployment.
  • FIG. 10 is a flowchart showing the operation of the anti-phishing device in the gateway device according to the embodiment of the present invention. As shown in FIG. 10, the method includes:
  • Step S1002 The gateway device receives the packet.
  • Step S1004 Determine whether the packet is an http packet
  • Step S1006 If it is not an HTTP message, forwarding is performed
  • Step S1008 The message type is HTTP, and the URL is parsed therefrom, and the webpage information is requested from the network;
  • Step S1010 invoking the interface provided by the device to check whether it is a phishing website, the determination result is yes, go to step S1012, otherwise, go to step S1006;
  • step S1012 if the result of the check is a suspicious phishing website, the HTTP information of the warning is pushed to the user.
  • the embodiment of the present invention achieves the following beneficial effects: determining whether a domain name is a phishing website by using a data structure of a suffix tree to calculate a string similarity degree algorithm, so that the judgment of anti-phishing fraud is more Purpose, intelligence, on the one hand to ensure the security of users to conduct online transactions, on the other hand to improve the performance of phishing fraud.
  • the existing blacklist technology is used to determine and check phishing fraud information more quickly.
  • the identification of the suspicious domain name system can be realized in the user side, the source side, and the intermediate transmission, respectively.
  • a storage medium configured to store program code for performing the following steps:
  • the foregoing storage medium may include, but is not limited to, a USB flash drive, a Read-Only Memory (ROM), and a Random Access Memory (RAM).
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • the processor performs, according to the stored program code in the storage medium, a similarity judgment between the domain name to be detected and the real domain name recorded in the real domain name database, where the real record is recorded in the real domain name database.
  • the domain name is the real domain name that needs to be protected.
  • the processor performs, according to the stored program code in the storage medium, a maximum similar substring in the character string determining the domain name to be detected and the real domain name; according to the largest similar substring and the predefined The similarity between the characters determines the similarity between the domain to be detected and the real domain name.
  • the method and apparatus for determining the domain name credibility provided by the embodiment of the present invention have the following beneficial effects: the problem of low accuracy and complicated judgment in determining the illegal domain name in the related art is solved, and the problem is improved. The accuracy of the illegal domain name is determined, and the effect of the complexity of the determination is reduced.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本发明提供了一种域名可信度确定的方法及装置，其中，该方法包括：将待检测域名与真实域名进行相似度判断，根据判断结果确定该待检测域名的可信度。采用上述方法，解决了相关技术中存在的在判定非法域名时准确率低，判定复杂的问题，达到了提高判定非法域名的准确率，降低判定的复杂度的效果。

Description

域名可信度确定的方法及装置 技术领域
本发明涉及通信领域，具体而言，涉及一种域名可信度确定的方法及装置。
背景技术
随着因特网的高速发展，网络购物以及网络办公已经成为人们日常生活的一部分，经过专业统计，现在中国每年在网上购物达到的金额已经超过了100亿人民币。但由于普通大众对网络安全的意识以及知识掌握不够，不法分子从网络交易的过程中也发现了存在有利可图的漏洞，其中最主要的就是网络钓鱼事件，图1是各国受网络钓鱼攻击的饼状图。据中国互联网络信息中心联合国家互联网应急中心发布的《2009年中国网民网络信息安全状况调查报告》显示，2009年有超过九成网民遇到过网络钓鱼，在遭遇过网络钓鱼事件的网民中，4500万网民蒙受了经济损失，占网民总数11.9％。网络钓鱼给网民造成的损失已达76亿元。
目前用于实现反钓鱼欺诈的方法主要有三个：1、白名单；2、黑名单；3、白名单黑名单结合。白名单的方法是认为只有在白名单之内的网站才是可信的，否则都是不可信的。黑名单的方法是认为在黑名单内的网站都是不可信的，黑名单之外的都是可信的，黑白名单结合的方法是综合了以上两个方法的优点，白名单都是可信的，黑名单都是不可信的，其他都是可疑的，需要进行辨识。
然而这些方法都存在一个问题，这些名单的谁来维护白名单，名单的容量如何保证，尤其是白名单的方法，定义的不够会导致大量的误报，而且现在也没有办法来进行杜绝所有的钓鱼攻击。
通过搜索相关的专利文献，发现相关的方法都是采用黑白名单或者分析网页内容等复杂手段来进行钓鱼欺诈识别，即进行域名是否合法的识别，这些方法的一个主要缺点就是实现复杂，然而达到的效果也不会太好。实际上现在也没有一个100％的方法能够对抗所有类型的网络钓鱼欺诈手段。一般都是针对于某些特殊需求进行一些防范。
针对相关技术中存在的在判定非法域名时准确率低，判定复杂的问题，目前尚未提出有效的解决方案。
发明内容
本发明的主要目的在于提供一种域名可信度确定的方法及装置，以至少解决相关技术中存在的在判定非法域名时准确率低，判定复杂的问题。
为了实现上述目的，根据本发明的一个方面，提供了一种域名可信度确定的方法，包括：将待检测域名与真实域名进行相似度判断；根据判断结果确定所述待检测域名的可信度。
可选地，将待检测域名与真实域名进行相似度判断包括：将待检测域名与真实域名数据库中记录的真实域名进行相似度判断，其中，所述真实域名数据库中记录的真实域名为需要保护的真实域名。
可选地，将待检测域名与真实域名进行相似度判断包括：确定所述待检测域名和所述真实域名的字符串中的最大的相似子串；根据所述最大的相似子串和预定义的字符之间的相似度确定所述待检测域名与所述真实域名的相似度。
可选地，根据判断结果确定所述待检测域名的可信度包括：当所述待检测域名和所述真实域名的相似度为100％或相似度小于预定阈值时，确定所述待检测域名为可信域名，其中，所述预定阈值小于100％；当所述待检测域名和所述真实域名的相似度大于或等于预定阈值且小于100％时，确定所述待检测域名为可疑域名。
可选地，在确定所述待检测域名为可疑域名之后，还包括以下至少之一：显示用于提醒所述待检测域名为可疑域名的告警信息；将所述待检测域名加入黑名单。
根据本发明的另一个方面，提供了一种域名可信度确定的装置，包括：处理模块，设置为将待检测域名与真实域名进行相似度判断；确定模块，设置为根据判断结果确定所述待检测域名的可信度。
可选地，所述处理模块包括：将待检测域名与真实域名数据库中记录的真实域名进行相似度判断，其中，所述真实域名数据库中记录的真实域名为需要保护的真实域名。
可选地，所述处理模块包括：第一确定单元，设置为确定所述待检测域名和所述真实域名的字符串中的最大的相似子串；第二确定单元，设置为根据所述最大的相似子串和预定义的字符之间的相似度确定所述待检测域名与所述真实域名的相似度。
可选地，所述确定模块包括：第三确定单元，设置为当所述待检测域名和所述真实域名的相似度为100％或相似度小于预定阈值时，确定所述待检测域名为可信域名，其中，所述预定阈值小于100％；第四确定单元，设置为当所述待检测域名和所述真实域名的相似度大于或等于预定阈值且小于100％时，确定所述待检测域名为可疑域名。
可选地，所述装置还包括以下至少之一：告警模块，设置为显示用于提醒所述待检测域名为可疑域名的告警信息；添加模块，设置为将所述待检测域名加入黑名单。
通过本发明，采用将待检测域名与真实域名进行相似度判断，根据判断结果确定该待检测域名的可信度的方式，无需采用分析网页内容等复杂手段，直接进行待检测域名与真实域名的相似度判断，解决了相关技术中存在的在判定非法域名时准确率低，判定复杂的问题，达到了提高判定非法域名的准确率，降低判定的复杂度的效果。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是各国受网络钓鱼攻击的饼状图；
图2是根据本发明实施例的域名可信度确定方法的流程图；
图3是根据本发明实施例的域名可信度确定装置的结构框图；
图4是根据本发明实施例的域名可信度确定装置中处理模块32的结构框图；
图5是根据本发明实施例的域名可信度确定装置中确定模块34的结构框图；
图6是根据本发明实施例的域名可信度确定装置的优选结构框图；
图7是根据本发明实施例的反钓鱼欺诈装置的装置框图；
图8是根据本发明实施例的反钓鱼欺诈装置应用于浏览器中的工作流程图；
图9是根据本发明实施例的反钓鱼欺诈装置应用于域名申请系统中的工作流程图；
图10是根据本发明实施例的反钓鱼欺诈装置应用于网关设备中的工作流程图。
具体实施方式
需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。下面将参考附图并结合实施例来详细说明本发明。
在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机系统中执行，并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
以下实施例中的“第一”“第二”仅用于区分，并不对顺序进行限定。
本实施例提供了一种域名可信度确定的方法，图2是根据本发明实施例的域名可信度确定方法的流程图，如图2所示，该方法包括：
步骤S202：将待检测域名与真实域名进行相似度判断；
步骤S204：根据判断结果确定该待检测域名的可信度。
通过上述各个处理步骤，可以直接根据待检测域名与真实域名的相似度判断结果，来确定该待检测域名的可信度，无需采用分析网页内容等复杂手段，解决了相关技术中存在的在判定非法域名时准确率低，判定复杂的问题，使得非法域名的判断更加具有目的性、智能性，在一定程度上保证了用户进行网络交易的安全性，达到了提高判定非法域名的准确率，降低判定的复杂度的效果。
在一个可选实施方式中，上述的真实域名可以使真实域名数据库中的域名，并且，该真实域名数据库中存储的域名都是合法的域名，也可以是需要被保护的域名。因此，上述的与待检测域名进行相似度判断的真实域名是合法的域名，也可以是受保护的域名。
通过将真实域名预先记录在真实域名数据库中，可以方便的查找到需要保护的真实域名，提高了相似度判断的效率。
在一个可选的实施方式中，步骤S202可以采取如下方式实现：确定待检测域名和真实域名的字符串中的最大的相似子串；根据最大的相似子串和预定义的字符之间的相似度确定该待检测域名与真实域名的相似度。在该可选的实施方式中，通过首先确定待检测域名和真实域名的最大的相似子串，以及预定的每个字符与其它字符的相似度，可以快速的得到待检测域名和真实域名的相似度。其中，确定待检测域名和真实域名的最大的相似子串的方式，可以采用后缀树算法，也可以采用其它算法。
步骤S204的实现方式有多种，其中，在一个可选的实施方式中，步骤S204可以包括：当所检测域名和真实域名的相似度为100％或相似度小于预定阈值时，确定待检测域名为可信域名，其中，预定阈值小于100％；当待检测域名和真实域名的相似度大于或等于预定阈值且小于100％时，确定待检测域名为可疑域名。在可选实施方式中，可以根据计算得到的待检测域名与真实域名的相似度与预定的相似度判断规则进行匹配，判断出该待检测域名是否为可信域名。
在一个可选的实施方式中，在确定该待检测域名为可疑域名的情况下，还可以显示用于提醒该待检测域名为可疑域名的告警信息；和/或，将该待检测域名加入黑名单。在该可选的实施方式中，可以在一定程度上避免用户受到钓鱼欺诈，和/或，在该待检 测域名再次有钓鱼嫌疑时，迅速的将该待检测域名定位成可疑域名，禁止访问可疑的域名。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本发明各个实施例所述的方法。
在本实施例中还提供了一种域名可信度确定的装置，该装置用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
本发明实施例中还提供了一种域名可信度确定的装置，图3是根据本发明实施例的域名可信度确定装置的结构框图，如图3所示，该装置包括处理模块32和确定模块34，下面对该装置进行说明：
处理模块32，设置为将待检测域名与真实域名进行相似度判断；确定模块34，连接至上述处理模块32，设置为根据判断结果确定该待检测域名的可信度。
处理模块32的实现方式有多种，在本实施例的一个可选实施方式中，处理模块32还可以设置为将待检测域名与真实域名数据库中记录的真实域名进行相似度判断，其中，在真实域名数据库中记录的真实域名为需要保护的真实域名。在该可选实施方式中，通过将真实域名预先记录在真实域名数据库中，可以方便的查找到需要保护的真实域名，提高了相似度判断的效率。
图4是根据本发明实施例的域名可信度确定装置中处理模块32的结构框图，如图4所示，该处理模块32包括第一确定单元42和第二确定单元44，下面对该处理模块32进行说明。
第一确定单元42，设置为确定待检测域名和真实域名的字符串中的最大的相似子串；第二确定单元44，连接至上述第一确定单元42，设置为根据最大的相似子串和预定义的字符之间的相似度确定该待检测域名与真实域名的相似度。在该可选的实施方式中，通过第一确定单元42可以首先确定待检测域名和真实域名的最大的相似子串，再通过第二确定单元44可以根据预定的每个字符与其它字符的相似度，快速的得到待检测域名和真实域名的相似度。其中，上述第一确定单元42中确定待检测域名和 真实域名的最大的相似子串的方式，可以采用后缀树算法，也可以采用其他算法。
图5是根据本发明实施例的域名可信度确定装置中确定模块34的结构框图，如5所示，该确定模块34包括第三确定单元52和第四确定单元54，下面对该确定模块34进行说明。
第三确定单元52，设置为当所检测域名和真实域名的相似度为100％或相似度小于预定阈值时，确定待检测域名为可信域名，其中，该预定阈值小于100％；第四确定单元54，设置为当待检测域名和真实域名的相似度大于或等于预定阈值且小于100％时，确定待检测域名为可疑域名。在该可选实施方式中，可以根据计算得到的待检测域名与真实域名的相似度与预定的相似度判断规则进行匹配，判断出该待检测域名是否为可信域名。
图6是根据本发明实施例的域名可信度确定装置的优选结构框图，如图6所示，该装置除包括图5所示的所有模块外，还包括告警模块62和/或添加模块64，下面对该装置进行说明。
告警模块62，连接至上述确定模块34，设置为在确定该待检测域名为可疑域名的情况下，显示用于提醒该待检测域名为可疑域名的告警信息；和/或，添加模块64，连接至上述确定模块34，设置为在确定该待检测域名为可疑域名的情况下，将该待检测域名加入黑名单。在该可选的实施方式中，可以在一定程度上避免用户受到钓鱼欺诈，和/或，在该待检测域名再次有钓鱼嫌疑时，根据黑名单技术迅速的将该待检测域名定位成可疑域名。
需要说明的是，上述各个模块是可以通过软件或硬件来实现的，对于后者，可以表现为以下形式，但不限于此：处理模块32和确定模块34位于同一处理器中，或者，处理模块32和确定模块34分别位于第一处理器和第二处理器中。
下面，结合具体应用场景对本发明进行举例说明，以WEB网站为例，相关技术中，采用WEB方式进行欺诈主要是通过注册相近或者相似的域名，用来模仿用户需要访问的域名来进行欺诈，比如www.cctv01.com，www.taobao.com-agc.us等等域名都有欺诈的嫌疑。
本发明实施例主要针对于这种采用WEB网页方式的钓鱼欺诈。另外本实施例还可以用于保护用户指定的某些网站，比如用户比较常用的淘宝、易趣、cctv以及一些知名的公共域名等等。
图7是根据本发明实施例的反钓鱼欺诈装置的装置框图，如图7所示，本实施例中的反钓鱼欺诈装置(即域名可信度确定的装置)包括：
真实域名数据库72，用来保存用户需要进行保护的真实的域名；
相似度计算模块74，用来计算用户正在访问的域名与真实的域名之间的相似度；
钓鱼欺诈判定模块76，用来判断当前访问的域名是否是钓鱼欺诈；
结果反馈模块78，向用户反馈当前访问的域名是否存在钓鱼欺诈的嫌疑；
钓鱼网站数据库710，这个数据库是明确已知的钓鱼URL数据，设置为更加明确判断网络欺诈。数据来源于用户的输入，也可以在用户使用本装置以后反馈结果来进行知识更新和共享。
在利用本实施例中的反钓鱼欺诈装置对用户访问域名进行处理时，具体处理方法包括以下步骤：
步骤A，相似度计算模块74取出用户访问的域名，例如从统一资源定位符(URL)中取出用户访问的域名；
步骤B，相似度计算模块74利用用户访问的域名与真实域名数据库72中的域名进行相似度计算；
步骤C，相似度计算模块74将计算的结果传递到钓鱼欺诈判定模块76进行判定；
步骤D，结果反馈模块78进行结果反馈，用户可以根据判断结果确定访问的域名如果是钓鱼欺诈，则不允许进行域名访问，如果判定结果可能是钓鱼欺诈，则向用户进行告警提示。
另外，本实施例中的反钓鱼欺诈装置还提供接口来进行：
1、判定规则配置，用来设置判定的各种规则。
2、真实域名配置，用来更新需要保护的网站。
3、钓鱼网站配置，用来更新钓鱼网站数据库。
下面，进行判定规则配置的详细描述。
相似程度的计算主要采用变化的后缀树(suffix tree)来完成，后缀树(Suffix tree)是一种数据结构，能快速解决很多关于字符串的问题。后缀树的概念最早由Weiner于1973年提出，既而由McCreight在1976年和Ukkonen在1992年和1995年加以改进完善。后缀树提出的目的是用来支持有效的字符串匹配和查询。可以用来很方便的匹配两个字符串中最大的公共子串。
本发明实施例中需要对后缀树进行扩展和修改，主要用来查询两个字符串中最大 的相似子串，然后得出两个字符串的相似程度。为了得到两个字符串的相似度，首先需要定义字符的相似程度，如字符与字符本身的相似程度是100％，然后如1和l，o和0也是很相似的，在一个字符串中通过修改一两个字符也会让用户认为是一样的，那么对于这样的字符之间需要定义出相似的程度。如表1定义的字符间的相似程度的定义：
表1
字符A 字符B 相似程度
1 l 0.97
0 o 0.95
p q 0.6
u v 0.8
y v 0.9
根据预先定义的字符间的相似程度，再采用变化后的后缀树算法，就可以为两个字符串计算出相似程度，然后根据相似程度定义出如表2所示的判定规则，可以得出正在访问的域名是否可信。当然，此规则可以通过配置进行修改。
表2
相似程度 判定规则
100％ 真实可信
大于等于80％ 非常可疑
大于等于60％小于80％ 比较可疑
大于等于30小于60％ 可疑站点
小于30％ 可信站点或者不需要保护站点
与相关技术相比较，本实施例引入了真实域名数据库72、相似度计算模块74、钓鱼欺诈判定模块76，通过采用后缀树的数据结构来计算字符串相似程度的算法来判定某一个域名是否是钓鱼网站的方法，使得反钓鱼欺诈的判断更加具有目的性、智能性、一方面保证了用户进行网络交易的安全性，另一方面提高了判断钓鱼欺诈的性能。同 时还可以采用现有的黑名单技术，将确定的钓鱼网站的域名加入黑名单，从而能更加快速的判定和检查钓鱼欺诈信息。
此外，本发明的可选的实施例中，该反钓鱼欺诈装置(即域名可信度确定的装置还可以用于域名注册系统、终端用户使用的浏览器插件、网关设备、网络设备上等等。下面，对于该反钓鱼欺诈装置应用于浏览器、域名申请系统、网关设备中的使用情况进行具体描述。
情况一：在浏览器中使用
在一个可选的实施例中，该反钓鱼欺诈装置可以使用在浏览器上，通过在浏览器中使用插件来集成本装置，可以及时的对用户访问钓鱼网站尽心保护，能及时、高效的进行反钓鱼欺诈。
图8是根据本发明实施例的反钓鱼欺诈装置应用于浏览器中的工作流程图，如图8所示，包括：
步骤S802，用户在浏览器上输入要访问的URL；
步骤S804，用户提交URL访问请求；
步骤S806，浏览器插件获取URL；
步骤S808，调用本装置接口进行检查；
步骤S810，判断被访问站点是否是钓鱼站点；
步骤S812，如果可疑则弹出告警，由用户自己决策是否继续请求网页；
步骤S814，如果确定是钓鱼网站则拒绝访问；
步骤S816，如果确定不是钓鱼网站则正常访问。
情况二：在域名申请系统中使用
在一个可选的实施例中，该反钓鱼欺诈装置可以使用在域名申请系统中，所有的域名分配都由域名注册机构来进行，那么为了从源头上进行反钓鱼欺诈，本装置可以在域名申请系统中使用，同时也可以用于防止恶意域名抢注的应用中。
图9是根据本发明实施例的反钓鱼欺诈装置应用于域名申请系统中的工作流程图，如图9所示：
步骤S902，在用户准备注册某个域名时，接受用户申请请求；
步骤S904，在用户提交注册请求后，获取用户要申请的域名；
步骤S906，调用本装置进行检查；
步骤S908，进行结果检查，判断该域名是否会构成钓鱼网页；
步骤S910，如果检查结果可信，则准许注册；
步骤S912，如果检查结果可疑，则进行告警，不允许用户进行申请注册，可以用户进行申述，申诉成功则转向步骤S910，否则转S902，重新申请。
情况三：在网关设备中使用
在一个可选的实施例中，该反钓鱼诈欺装置可以在网关设备上使用，在网络设备级别上进行控制，可以减少部署的成本。
图10是根据本发明实施例的反钓鱼欺诈装置应用于网关设备中的工作流程图，如图10所示，包括：
步骤S1002，网关设备收到报文；
步骤S1004，对报文进行判断，是否是http报文；
步骤S1006，如果不是HTTP报文则进行转发；
步骤S1008，报文类型是HTTP，从中解析出URL，同时向网络请求网页信息；
步骤S1010，调用本装置提供的接口进行检查，判断是否是钓鱼网站，判断结果为是，转至步骤S1012，否则，转至步骤S1006；
步骤S1012，如果检查结果为可疑的钓鱼网站，向用户推送警告的HTTP信息。
综上所述，本发明实施例实现了以下有益效果：通过采用后缀树的数据结构来计算字符串相似程度的算法来判定某一个域名是否是钓鱼网站的方法，使得反钓鱼欺诈的判断更加具有目的性、智能性、一方面保证了用户进行网络交易的安全性，另一方面提高了判断钓鱼欺诈的性能。同时还采用现有的黑名单技术，能更加快速的判定和检查钓鱼欺诈信息。另外，通过在浏览器、域名注册系统、网关设备上应用该反钓鱼诈欺装置，可以分别在用户侧、源侧、中间传输中，实现对可疑域名系统的识别。
在另外一个实施例中，还提供了一种软件，该软件用于执行上述实施例及优选实施方式中描述的技术方案。
在另外一个实施例中，还提供了一种存储介质，上述存储介质可以被设置为存储用于执行以下步骤的程序代码：
S1，将待检测域名与真实域名进行相似度判断；
S2，根据判断结果确定该待检测域名的可信度。
可选地，在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(Read-Only Memory，简称为ROM)、随机存取存储器(Random Access Memory，简称为RAM)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行将待检测域名与真实域名数据库中记录的真实域名进行相似度判断，其中，在真实域名数据库中记录的真实域名为需要保护的真实域名。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行确定待检测域名和真实域名的字符串中的最大的相似子串；根据最大的相似子串和预定义的字符之间的相似度确定该待检测域名与真实域名的相似度。
可选地，本实施例中的具体示例可以参考上述实施例及可选实施方式中所描述的示例，本实施例在此不再赘述。
以上仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
工业实用性
如上所述，本发明实施例提供的一种域名可信度确定的方法及装置具有以下有益效果：解决了相关技术中存在的在判定非法域名时准确率低，判定复杂的问题，达到了提高判定非法域名的准确率，降低判定的复杂度的效果。

Claims (10)

  1. 一种域名可信度确定的方法，包括：
    将待检测域名与真实域名进行相似度判断；
    根据判断结果确定所述待检测域名的可信度。
  2. 根据权利要求1所述的方法，其中，将待检测域名与真实域名进行相似度判断包括：
    将待检测域名与真实域名数据库中记录的真实域名进行相似度判断，其中，所述真实域名数据库中记录的真实域名为需要保护的真实域名。
  3. 根据权利要求1所述的方法，其中，将待检测域名与真实域名进行相似度判断包括：
    确定所述待检测域名和所述真实域名的字符串中的最大的相似子串；
    根据所述最大的相似子串和预定义的字符之间的相似度确定所述待检测域名与所述真实域名的相似度。
  4. 根据权利要求1所述的方法，其中，根据判断结果确定所述待检测域名的可信度包括：
    当所述待检测域名和所述真实域名的相似度为100％或相似度小于预定阈值时，确定所述待检测域名为可信域名，其中，所述预定阈值小于100％；
    当所述待检测域名和所述真实域名的相似度大于或等于预定阈值且小于100％时，确定所述待检测域名为可疑域名。
  5. 根据权利要求3所述的方法，其中，在确定所述待检测域名为可疑域名之后，还包括以下至少之一：
    显示用于提醒所述待检测域名为可疑域名的告警信息；
    将所述待检测域名加入黑名单。
  6. 一种域名可信度确定的装置，包括：
    处理模块，设置为将待检测域名与真实域名进行相似度判断；
    确定模块，设置为根据判断结果确定所述待检测域名的可信度。
  7. 根据权利要求6所述的装置，其中，所述处理模块包括：
    将待检测域名与真实域名数据库中记录的真实域名进行相似度判断，其中， 所述真实域名数据库中记录的真实域名为需要保护的真实域名。
  8. 根据权利要求6所述的装置，其中，所述处理模块包括：
    第一确定单元，设置为确定所述待检测域名和所述真实域名的字符串中的最大的相似子串；
    第二确定单元，设置为根据所述最大的相似子串和预定义的字符之间的相似度确定所述待检测域名与所述真实域名的相似度。
  9. 根据权利要求6所述的装置，其中，所述确定模块包括：
    第三确定单元，设置为当所述待检测域名和所述真实域名的相似度为100％或相似度小于预定阈值时，确定所述待检测域名为可信域名，其中，所述预定阈值小于100％；
    第四确定单元，设置为当所述待检测域名和所述真实域名的相似度大于或等于预定阈值且小于100％时，确定所述待检测域名为可疑域名。
  10. 根据权利要求9所述的装置，其中，还包括以下至少之一：
    告警模块，设置为显示用于提醒所述待检测域名为可疑域名的告警信息；
    添加模块，设置为将所述待检测域名加入黑名单。
PCT/CN2016/073118 2015-06-15 2016-02-01 域名可信度确定的方法及装置 WO2016201994A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510329911.3 2015-06-15
CN201510329911.3A CN106330811A (zh) 2015-06-15 2015-06-15 域名可信度确定的方法及装置

Publications (1)

Publication Number Publication Date
WO2016201994A1 true WO2016201994A1 (zh) 2016-12-22

Family

ID=57544931

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/073118 WO2016201994A1 (zh) 2015-06-15 2016-02-01 域名可信度确定的方法及装置

Country Status (2)

Country Link
CN (1) CN106330811A (zh)
WO (1) WO2016201994A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109451091A (zh) * 2018-11-29 2019-03-08 华为技术有限公司 防护方法及代理设备

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108712403B (zh) * 2018-05-04 2020-08-04 哈尔滨工业大学（威海） 基于域名构造相似性的非法域名挖掘方法
CN111091019B (zh) * 2019-12-23 2024-03-01 支付宝(杭州)信息技术有限公司 一种信息提示方法、装置及设备
CN112507176A (zh) * 2020-12-03 2021-03-16 平安科技（深圳）有限公司 域名侵权的自动化判定方法、装置、电子设备和存储介质
CN114710468B (zh) * 2022-03-31 2024-05-14 绿盟科技集团股份有限公司 一种域名生成和识别方法、装置、设备及介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102664878A (zh) * 2012-04-10 2012-09-12 中国科学院计算机网络信息中心 仿冒域名检测方法及设备
US20130086677A1 (en) * 2010-12-31 2013-04-04 Huawei Technologies Co., Ltd. Method and device for detecting phishing web page
CN103927480A (zh) * 2013-01-14 2014-07-16 腾讯科技（深圳）有限公司 一种恶意网页的识别方法、装置和系统

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130086677A1 (en) * 2010-12-31 2013-04-04 Huawei Technologies Co., Ltd. Method and device for detecting phishing web page
CN102664878A (zh) * 2012-04-10 2012-09-12 中国科学院计算机网络信息中心 仿冒域名检测方法及设备
CN103927480A (zh) * 2013-01-14 2014-07-16 腾讯科技（深圳）有限公司 一种恶意网页的识别方法、装置和系统

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109451091A (zh) * 2018-11-29 2019-03-08 华为技术有限公司 防护方法及代理设备

Also Published As

Publication number Publication date
CN106330811A (zh) 2017-01-11

Similar Documents

Publication Publication Date Title
US11451572B2 (en) Online portal for improving cybersecurity risk scores
Kumari et al. Verification and validation techniques for streaming big data analytics in internet of things environment
Jain et al. A novel approach to protect against phishing attacks at client side using auto-updated white-list
US10223524B1 (en) Compromised authentication information clearing house
US8051484B2 (en) Method and security system for indentifying and blocking web attacks by enforcing read-only parameters
Rao et al. Phishshield: a desktop application to detect phishing webpages through heuristic approach
US9838384B1 (en) Password-based fraud detection
US9055097B1 (en) Social network scanning
US11381598B2 (en) Phishing detection using certificates associated with uniform resource locators
US8438386B2 (en) System and method for developing a risk profile for an internet service
US10176318B1 (en) Authentication information update based on fraud detection
US20220180368A1 (en) Risk Detection, Assessment, And Mitigation Of Digital Third-Party Fraud
WO2016201994A1 (zh) 域名可信度确定的方法及装置
Bhakta et al. Semantic analysis of dialogs to detect social engineering attacks
WO2015096528A1 (zh) 网络购物环境安全性检测方法及装置
WO2014063520A1 (zh) 一种判断钓鱼网站的方法及装置
US20210344693A1 (en) URL risk analysis using heuristics and scanning
WO2020000749A1 (zh) 一种越权漏洞检测方法及装置
US20210203693A1 (en) Phishing detection based on modeling of web page content
US20150067772A1 (en) Apparatus, method and computer-readable storage medium for providing notification of login from new device
US11470114B2 (en) Malware and phishing detection and mediation platform
Qazi Application Programming Interface (API) Security in Cloud Applications
CN108377275B (zh) 基于神经网络算法的网络安全防护方法
Baranov et al. Securing information resources using web application firewalls
Mourtaji et al. Perception of a new framework for detecting phishing web pages

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16810735

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16810735

Country of ref document: EP

Kind code of ref document: A1