WO2017036043A1 - 钓鱼页面检测方法及系统 - Google Patents

钓鱼页面检测方法及系统 Download PDF

Info

Publication number
WO2017036043A1
WO2017036043A1 PCT/CN2015/099898 CN2015099898W WO2017036043A1 WO 2017036043 A1 WO2017036043 A1 WO 2017036043A1 CN 2015099898 W CN2015099898 W CN 2015099898W WO 2017036043 A1 WO2017036043 A1 WO 2017036043A1
Authority
WO
WIPO (PCT)
Prior art keywords
page
phishing
current page
determining
server
Prior art date
Application number
PCT/CN2015/099898
Other languages
English (en)
French (fr)
Inventor
杨念
耿志峰
苏晓东
Original Assignee
百度在线网络技术（北京）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 百度在线网络技术（北京）有限公司 filed Critical 百度在线网络技术（北京）有限公司
Priority to KR1020177015129A priority Critical patent/KR102026544B1/ko
Priority to EP15902847.1A priority patent/EP3214817B1/en
Priority to US15/533,925 priority patent/US10367849B2/en
Priority to JP2017530712A priority patent/JP6487555B2/ja
Publication of WO2017036043A1 publication Critical patent/WO2017036043A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1483—Countermeasures against malicious traffic service impersonation, e.g. phishing, pharming or web spoofing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/95—Retrieval from the web
    • G06F16/954—Navigation, e.g. using categorised browsing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present application relates to an Internet page. Specifically, the present application relates to a method and system for detecting a phishing page.
  • the scam method includes asking the visitor to submit private information such as account number and password, and tricking the user into filling in identity information, bank account and other information. The other is to imitate Taobao, ICBC, etc. online. Pay the webpage to defraud the user's bank card information or Alipay account.
  • the frequent occurrence of phishing websites poses great harm to the privacy and property security of Internet users.
  • the existing method for detecting a phishing page has the defects of short time-effect and narrow application range, and cannot effectively protect the security of the user's network environment.
  • the present application provides methods and systems for detecting phishing pages based on feedback on probe data.
  • a method for detecting a phishing page includes: intercepting user data that a current page attempts to submit to a server; constructing the same probe data as the user data structure, wherein the content of the probe data Different from the content of the user data; submitting the probe data to the server; and according to the server The response of the end determines whether the current page is a phishing page.
  • determining whether the current page is a phishing page according to the response of the server may include: determining that the response of the server is that the detection data passes the authentication; and determining that the current page is a phishing page.
  • determining whether the current page is a phishing page according to the response of the server may include: determining that the response of the server is that the probe data fails authentication; and constructing the same as the user data structure And the second probe data whose content is different from the user data and the probe data; submitting the second probe data to the server end; and when the response of the server end is that the second probe data is authenticated The current page is determined to be a phishing page.
  • the method may further include: determining whether the current page is a suspected phishing page; and intercepting the current page attempting to submit to the server only when determining that the current page is a suspect phishing page User data.
  • determining that the current page is a suspected phishing page may include: determining that the user data that the current page attempts to submit to the server end is plaintext.
  • determining that the current page is a suspected phishing page may include: determining a website address of the official website of the current page according to the content of the current page; and determining the URL of the current page and the determined The official website's URL is inconsistent when determining the current page when the suspected phishing page.
  • the user data may include a username and a password.
  • the method may further include: displaying the official website to the user based on determining that the current page is a phishing page.
  • the method may further include: performing a risk prompting on the user based on determining that the current page is a phishing page; receiving feedback from the user on the risk prompt; and generating a phishing website according to the feedback a database; and determining, by the phishing website database, whether the current page is a phishing website before the intercepting user data that the current page attempts to submit to the server.
  • a system for detecting a phishing page is provided
  • the intercepting device is configured to intercept user data that the current page attempts to submit to the server;
  • the probe data constructing device is configured to construct the same probe data as the user data structure, wherein the content of the probe data and the user data The content is different;
  • the submitting device is configured to submit the probe data to the server; and
  • the determining means is configured to determine, according to the response of the server, whether the current page is a phishing page.
  • the phishing page detection method and system provided by the present application can determine whether the current page is a phishing page by intercepting and replacing the user data submitted by the client to the server and determining the response of the server, thereby accurately and instantly detecting the phishing page, thereby Provides a secure network environment that effectively protects the user's property and privacy.
  • 1 is an exemplary system architecture of an embodiment of a phishing page detection method or system to which the present application may be applied;
  • FIG. 2 illustrates a phishing page detecting method according to an embodiment of the present application
  • Figure 3 shows a phishing page
  • FIG. 4 illustrates a phishing page detecting method according to an embodiment of the present application
  • FIG. 5 illustrates a phishing page detecting method according to an embodiment of the present application
  • FIG. 6 illustrates a phishing page detecting method according to an embodiment of the present application
  • FIG. 7 illustrates a phishing page detecting method according to an embodiment of the present application
  • Figure 8 is a schematic block diagram of a phishing page detection system in accordance with the present application.
  • FIG. 9 is a schematic structural diagram of a computer system suitable for implementing a client device or a server end of an embodiment of the present application.
  • FIG. 1 illustrates an exemplary system architecture 100 of an embodiment of a phishing page detection method and system to which the present application may be applied.
  • system architecture 100 can include client devices 101, 102, 103, network 104, and server 105.
  • Network 104 is used to provide a medium for communication links between client devices 101, 102, 103 and server 105.
  • Network 104 may include various types of connections, such as wired, wireless communication links, fiber optic cables, and the like.
  • the user can interact with the server 105 over the network 104 using the client devices 101, 102, 103 to log in to the website or send and receive messages and the like.
  • client devices 101, 102, and 103 can interact with the server 105 over the network 104 using the client devices 101, 102, 103 to log in to the website or send and receive messages and the like.
  • Various web browsers or client applications can be installed on the client devices 101, 102, and 103.
  • Client devices 101, 102, 103 can be a variety of electronic devices including, but not limited to, smartphones, tablets, laptop portable computers, desktop computers, and the like.
  • Server 105 may be a server that provides various services, such as logins to web pages, applications or bank accounts, payment operations, and the like.
  • terminal devices, networks, and servers in Figure 1 is merely illustrative. Depending on the implementation needs, there can be any number of client devices, networks, and servers.
  • the phishing page detection method provided by the embodiment of the present application may be separately executed by the client device 101, 102, 103, or may be jointly performed by the client device 101, 102, 103 and the server 105. Accordingly, the phishing page detection system is generally disposed in the clients 101, 102, and 103.
  • phishing page detection method 200 in accordance with one embodiment of the present application is illustrated.
  • step 202 the user data submitted by the current page to the server side is intercepted; in step 204, the same probe data as the user data structure is constructed, wherein the content of the probe data and the content of the user data are constructed. Different; in step 206, the probe data is submitted to the server; and in step 208, according to the response of the server Determine whether the current page is a phishing page.
  • user data may include various user-related fields such as, but not limited to, a username, a registered mailbox, a cell phone number, and a password such as a password and a login verification code.
  • FIG. 3 exemplarily shows a schematic diagram of a phishing page in which the login page includes fields of "account number" and "password", so in the embodiment shown in FIG. 3, the user data includes two fields of account number and password. .
  • POST action may include, for example, constructing data according to content filled in by the user and submitting the constructed data to the server using, for example, an HTTP protocol.
  • an electronic device submits an operation of the data packet to the server, for example, the POST operation is intercepted.
  • the electronic device e.g., client 101, 102, 103 in Figure 1 constructs probe data that is identical to the intercepted user data structure but of different content.
  • probe data with the same user name but different passwords according to the user data, and to construct probe data whose user name and password are different from the user data.
  • the length of each field of the constructed probe data may correspond to the length of each field of the user data.
  • the electronic device e.g., client 101, 102, 103 in FIG. 1 submits the constructed probe data to the server (e.g., server 105 in FIG. 1), for example, via the POST method.
  • step 208 the electronic device (eg, client 101, 102, 103 in FIG. 1) determines whether the current page is a phishing page based on a response from the server (eg, server 105 in FIG. 1). In the following, the determination of the corresponding phishing page based on the different responses of the server side will be specifically discussed.
  • the response from the server is that the probe data is authenticated.
  • step 408 it is determined that the server-side response is that the probe data is authenticated; and in step 410, the current page is determined to be a phishing page.
  • the response of the probe data to the authentication of the server may be that the page displays the words "login successful” and "unblocked successfully". Since the probe data includes various fields forged according to the user data, the official data may not be authenticated for the official website. Therefore, at this time, it can be determined that the current page is a phishing page.
  • the response from the server is that the probe data has not passed the authentication.
  • Some phishing pages will prompt the user to enter the second time after the user inputs the account information and password, and the user will be prompted for the second time. This prompt will cause the user to check the information entered by the user, thereby improving the success rate of the fishing. Therefore, the present application proposes a method of secondary detection of a page.
  • FIG. 5 illustrates a phishing page detection method 500 according to an embodiment of the present application.
  • steps 502-506 of method 500 are the same as steps 202-206 of method 200, and thus are not described herein.
  • step 508 it is determined that the response of the server is that the probe data fails the authentication; in step 510, the second probe data having the same user data structure and different content from the user data and the probe data is constructed; in step 512, the first The second probe data is submitted to the server; in step 514, it is determined whether the response of the server is authenticated by the second probe data; and in step 516, the current page is determined to be a phishing page based on the determination result in step 514 being "YES". .
  • multiple probes such as third or fourth probes can be further performed in a similar manner.
  • FIG. 6 illustrates a phishing page detection method 600 according to an embodiment of the present application.
  • steps 602-606 of method 600 are the same as steps 200-206 of method 200, and thus are not described herein.
  • the method 600 further includes: Step 601: Determine whether the current page is a suspected phishing page.
  • determining that the current page is a suspected phishing page may It is executed by judging whether the user data submitted by the current page to the server side is plaintext. If the user data submitted by the current page to the server is plaintext, that is, the data of the user monitored in the browser is consistent with the data of the POST, it may be determined that the current page is a suspected phishing page.
  • determining that the current page is a suspected phishing page may also be performed by: determining a website address of an official website of the current page according to the content of the current page; and determining the current website URL and the determined official website The website's URL is inconsistent when determining the current page when the suspected phishing page.
  • the page title contains the word "XX login”
  • the "value" of the "input” tag in the web page structure is set to the words “account”, "password”, etc., or the button with the word “login” on the page, the page is considered For a login page.
  • the URL of the current page may be compared with the official website address of the QQ mailbox.
  • the current page is determined to be Suspected phishing page.
  • the method may further include: displaying the official website to the user based on determining that the current page is a phishing page.
  • the current page of the user is a phishing website that forges an electronic bank of an ICBC.
  • the official website of an ICBC can be presented to the user.
  • FIG. 7 illustrates a phishing page detecting method 700 according to an embodiment of the present application, including: step 702, performing a risk prompting on a user based on determining that a current page is a phishing page; and step 704, receiving feedback from a user on a risk prompt; Step 706: Generate a phishing website database according to the feedback; and step 708, before intercepting the user data submitted by the current page to the server, determine whether the current page is a phishing website through the phishing website database.
  • each feedback from each user can be uploaded to the cloud, and these feedbacks can be compared and analyzed to form a page determined to be a phishing page into a phishing website database. Therefore, in the next phishing page detection, the current page may be compared with the phishing website database, and if there is a matching record, the current page is directly determined to be a phishing page. On the contrary, if If there is no current page in the phishing website database, the various methods described above are performed. If it is determined in the next method execution that the current page is a phishing page, the user feeds back and uploads the URL of the current page to the cloud, so that the current page determined to be the phishing page is added to the phishing website database.
  • the present application provides an embodiment of a phishing page detection system corresponding to the method embodiment shown in FIG. 2, the system 800
  • the device can be specifically applied to various electronic devices.
  • phishing page detection system 800 also includes some other well-known structures, such as processors, memories, etc., which are not shown in FIG. 8 in order to unnecessarily obscure the embodiments of the present disclosure.
  • the system 800 can include: an intercepting device 810 configured to intercept user data that the current page attempts to submit to the server; the probe data constructing device 820 configured to construct the same probe data as the user data structure, wherein the probe data The content is different from the content of the user data; the submitting device 830 is configured to submit the probe data to the server; and the determining device 840 is configured to determine whether the current page is a phishing page according to the response of the server.
  • the specific operations regarding the intercepting device 810, the probe data constructing device 820, the submitting device 830, and the determining device 840 are respectively the same as the steps 202-208 of the above-described method 200, and thus detailed description thereof will be omitted.
  • the intercepting device 810, the probe data constructing device 820, the submitting device 830, and the determining device 840 may be located at the client, for example, embedded as a plug-in in the user's browser, or as a firewall software. Installed on the customer's computer.
  • the phishing page detection system 800 may further include an official website presentation device configured to present the official website to the user based on determining that the current page is a phishing page.
  • the phishing page detection system 800 may further include: a phishing website library generating device configured to: perform a risk prompting on the user based on determining that the current page is a phishing page; and receive the risk from the user Feedback of the prompt; generating a phishing website database based on the feedback; and attempting to serve to the current page Before the user data submitted by the terminal, the phishing website database determines whether the current page is a phishing website.
  • a phishing website library generating device configured to: perform a risk prompting on the user based on determining that the current page is a phishing page; and receive the risk from the user Feedback of the prompt; generating a phishing website database based on the feedback; and attempting to serve to the current page Before the user data submitted by the terminal, the phishing website database determines whether the current page is a phishing website.
  • the phishing website library generating device corresponds to the method 700 described above, and thus will not be described herein.
  • FIG. 9 a block diagram of a computer system 900 suitable for use in implementing a client device or server side of an embodiment of the present application is shown.
  • computer system 900 includes a central processing unit (CPU) 901 that can be loaded into a program in random access memory (RAM) 903 according to a program stored in read only memory (ROM) 902 or from storage portion 908. And perform various appropriate actions and processes.
  • RAM random access memory
  • ROM read only memory
  • various programs and data required for the operation of the system 900 are also stored.
  • the CPU 901, the ROM 902, and the RAM 903 are connected to each other through a bus 904.
  • An input/output (I/O) interface 905 is also coupled to bus 904.
  • the following components are connected to the I/O interface 905: an input portion 906 including a keyboard, a mouse, etc.; an output portion 907 including, for example, a cathode ray tube (CRT), a liquid crystal display (LCD), and the like, and a storage portion 908 including a hard disk or the like. And a communication portion 909 including a network interface card such as a LAN card, a modem, or the like. The communication section 909 performs communication processing via a network such as the Internet.
  • Driver 910 is also connected to I/O interface 905 as needed.
  • a removable medium 911 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory or the like is mounted on the drive 910 as needed so that a computer program read therefrom is installed into the storage portion 908 as needed.
  • an embodiment of the present disclosure includes a computer program product comprising a computer program tangibly embodied on a machine readable medium, the computer program comprising program code for executing the method illustrated in the flowchart.
  • the computer program can be downloaded and installed from the network via the communication portion 909, and/or installed from the removable medium 911.
  • each block of the flowchart or block diagram can represent a module, a program segment, or a portion of code, the module, the program segment, or a portion of code comprising one or more An executable instruction that implements the specified logic functions.
  • the functions noted in the blocks may also occur in a different order than that illustrated in the drawings. For example, two successively represented blocks may in fact be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending upon the functionality involved.
  • each block of the block diagrams and/or flowcharts, and combinations of blocks in the block diagrams and/or flowcharts can be implemented in a dedicated hardware-based system that performs the specified function or operation. Or it can be implemented by a combination of dedicated hardware and computer instructions.
  • the units involved in the embodiments of the present application may be implemented by software or by hardware.
  • the described unit may also be provided in the processor, for example, as a processor including an intercepting unit, a probe data construction unit submitting unit, and a determining unit.
  • the names of these units do not constitute a limitation on the unit itself under certain circumstances.
  • the interception unit may also be described as "a unit for intercepting user data that the current page attempts to submit to the server side".
  • the present application further provides a computer readable storage medium, which may be a computer readable storage medium included in the apparatus described in the foregoing embodiment, or may exist separately, not A computer readable storage medium that is assembled into a terminal.
  • the computer readable storage medium stores one or more programs that are used by one or more processors to perform the phishing page detection method described in this application.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • Databases & Information Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Remote Sensing (AREA)
  • Data Mining & Analysis (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Radar, Positioning & Navigation (AREA)
  • Information Transfer Between Computers (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

本申请提供了一种钓鱼页面检测方法和系统，所述方法包括：拦截当前页面试图向服务器端提交的用户数据；构造与所述用户数据结构相同的探测数据，其中所述探测数据的内容与所述用户数据的内容不同；将所述探测数据提交到所述服务器端；以及根据所述服务器端的响应判定所述当前页面是否为钓鱼页面。通过使用本申请提供的钓鱼页面检测方法和系统，用户能够即时并精准地判断当前页面是否是钓鱼页面，从而更好地保护隐私和财产。

Description

钓鱼页面检测方法及系统
相关申请的交叉引用
本申请要求于2015年08月28日提交的中国专利申请号为“201510542777.5”的优先权，其全部内容作为整体并入本申请中。
技术领域
本申请涉及互联网页面，具体地，本申请涉及钓鱼页面的检测方法和系统。
背景技术
随着互联网数据的爆炸性增长，窃取用户提交的银行帐号、密码等私密信息的钓鱼网站也越来越多。钓鱼网站的页面与真实网站界面完全一致，诈骗方式包括以中奖为诱饵要求访问者提交账号和密码等隐私信息，欺骗用户填写身份信息、银行账户等信息；另一种是模仿淘宝、工行等在线支付网页，骗取用户银行卡信息或支付宝账户。钓鱼网站的频繁出现给网路用户的隐私和财产安全带来极大的危害。然而，目前存在的检测钓鱼页面的方法具有时效短、应用范围窄的缺陷，不能有效地保障用户的网络环境的安全。
发明内容
鉴于现有技术中的上述缺陷或不足，期望能够提供一种更有效更精确的钓鱼页面检测方案。为了实现上述一个或多个目的，本申请提供了基于对探测数据的反馈来检测钓鱼页面的方法和系统。
根据本申请的一个方面，提供了一种检测钓鱼页面的方法，包括：拦截当前页面试图向服务器提交的用户数据；构造与所述用户数据结构相同的探测数据，其中，所述探测数据的内容与所述用户数据的内容不同；将所述探测数据提交到所述服务器端；以及根据所述服务器 端的响应判定所述当前页面是否为钓鱼页面。
根据本申请的一种实施方式，根据所述服务器端的响应判定所述当前页面是否为钓鱼页面可以包括：确定所述服务器端的响应为所述探测数据通过认证；以及判定所述当前页面为钓鱼页面。
根据本申请的一种实施方式，根据所述服务器端的响应判定所述当前页面是否为钓鱼页面可以包括：确定所述服务器端的响应为所述探测数据未通过认证；构造与所述用户数据结构相同且内容与所述用户数据和所述探测数据均不同的第二探测数据；将所述第二探测数据提交到所述服务器端；以及当所述服务器端的响应为所述第二探测数据通过认证时判定所述当前页面为钓鱼页面。
根据本申请的一种实施方式，上述方法还可以包括：判定所述当前页面是否是疑似钓鱼页面；以及仅在确定所述当前页面是疑似钓鱼页面时拦截所述当前页面试图向服务器端提交的用户数据。
根据本申请的一种实施方式，判定当前页面是疑似钓鱼页面可以包括：确定所述当前页面试图向所述服务器端提交的所述用户数据为明文。
根据本申请的一种实施方式，判定当前页面是疑似钓鱼页面可以包括：根据所述当前页面的内容确定所述当前页面的官方网站的网址；以及当确定所述当前页面的网址与所确定的官方网站的网址时不一致判定所述当前页面时疑似钓鱼页面。
根据本申请的一种实施方式，所述用户数据可以包括用户名和口令。
根据本申请的一种实施方式，上述方法还可以包括：基于判定所述当前页面为钓鱼页面，将所述官方网站展现给用户。
根据本申请的一种实施方式，上述方法还可以包括：基于判定所述当前页面为钓鱼页面对用户进行风险提示；接收来自所述用户对所述风险提示的反馈；根据所述反馈生成钓鱼网站数据库；以及在所述拦截当前页面试图向服务器端提交的用户数据之前，通过所述钓鱼网站数据库判断所述当前页面是否是钓鱼网站。
根据本申请的另一个方面，提供了一种检测钓鱼页面的系统，包 括：拦截装置，配置为拦截当前页面试图向服务器端提交的用户数据；探测数据构造装置，配置为构造与所述用户数据结构相同的探测数据，其中所述探测数据的内容与所述用户数据的内容不同；提交装置，配置为将所述探测数据提交到所述服务器端；以及判定装置，配置为根据所述服务器端的响应判定所述当前页面是否为钓鱼页面。
本申请提供的钓鱼页面检测方法和系统通过拦截并替换客户端向服务器端提交的用户数据以及判断服务器端的响应来判断当前页面是否是钓鱼页面，能够实现精准并即时地检测钓鱼页面，从而为用户提供了安全的网络环境，进而有效地保护了用户的财产和隐私。
附图说明
通过阅读参照以下附图所作的对非限制性实施例所作的详细描述，本申请的其它特征、目的和优点将会变得更明显：
图1是可以应用本申请的钓鱼页面检测方法或系统的实施例的示例性系统架构；
图2示出了根据本申请一个实施方式的钓鱼页面检测方法；
图3示出了一钓鱼页面；
图4示出了根据本申请的一种实施方式的钓鱼页面检测方法；
图5示出了根据本申请的一种实施方式的钓鱼页面检测方法；
图6示出了根据本申请的一种实施方式的钓鱼页面检测方法；
图7示出了根据本申请的一种实施方式的钓鱼页面检测方法；
图8示意性地示出了根据本申请的钓鱼页面检测系统的框图；以及
图9是适于用来实现本申请实施例的客户端设备或服务器端的计算机系统的结构示意图。
具体实施方式
下面结合附图和实施例对本申请作进一步的详细说明。可以理解的是，此处所描述的具体实施例仅仅用于解释相关发明，而非对该发明的限定。另外还需要说明的是，为了便于描述，附图中仅示出了与 有关发明相关的部分。
需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。下面将参考附图并结合实施例来详细说明本申请。
图1示出了可以应用本申请的钓鱼页面检测方法和系统的实施例的示例性系统架构100。
如图1所示，系统架构100可以包括客户端设备101、102、103，网络104和服务器105。网络104用以在客户端设备101、102、103和服务器105之间提供通信链路的介质。网络104可以包括各种连接类型，例如有线、无线通信链路或者光纤电缆等等。
用户可以使用客户端设备101、102、103通过网络104与服务器105交互，以登录网站或收发消息等。客户端设备101、102、103上可以安装有各种网页浏览器或客户端应用。
客户端设备101、102、103可以是各种电子设备，包括但不限于智能手机、平板电脑、膝上型便携计算机和台式计算机等等。
服务器105可以是提供各种服务的服务器，例如网页、应用或银行账号的登录以及付款操作等。
应该理解，图1中的终端设备、网络和服务器的数目仅仅是示意性的。根据实现需要，可以具有任意数目的客户端设备、网络和服务器端。
需要说明的是，本申请实施例所提供的钓鱼页面检测方法可以由客户端设备101、102、103单独执行，或者也可以由客户端设备101、102、103和服务器105共同执行。相应地，钓鱼页面检测系统一般设置于客户端101、102、103中。
继续参考图2，示出了根据本申请一个实施方式的钓鱼页面检测方法200。
如图2所示，在步骤202中，当前页面试图向服务器端提交的用户数据被拦截；在步骤204中，构造与用户数据结构相同的探测数据，其中，探测数据的内容与用户数据的内容不同；在步骤206中，将探测数据提交到服务器端；以及在步骤208中，根据服务器端的响应判 定当前页面是否为钓鱼页面。
根据本申请的一种实施方式，用户数据可以包括各种与用户相关的字段，例如但不限制于用户名、注册邮箱、手机号、以及诸如密码和登录验证码的口令。
例如，图3示例性地示出了一个钓鱼页面的示意图，其中，登录页面包括“账号”和“密码”的字段，因此在图3所示的实施例中用户数据包括账号和密码两个字段。
以图3所示的情况为例，当用户填入了用户名字段和口令字段后，点击“登录”会触发一个向服务器递交数据包的操作。通常，用户数据是通过POST动作来提交至服务器的。该POST动作例如可以包括：根据用户填写的内容构造数据以及将构造的数据利用例如HTTP协议提交到服务器端。
在步骤202中，电子设备(例如图1中的客户端101、102、103)向服务器递交数据包的操作，例如POST操作被拦截。接下来在步骤204中，电子设备(例如图1中的客户端101、102、103)构造与拦截的用户数据结构相同但内容不同的探测数据。
以图3所示的情况为例，可以根据用户数据构造用户名相同但口令不同的探测数据，也可以构造用户名和口令均与用户数据不同的探测数据。
为了防止被钓鱼网站识破探测，所构造的探测数据的各个字段的长度可以与用户数据的各个字段的长度分别对应。在步骤206中，电子设备(例如图1中的客户端101、102、103)将构造的探测数据例如通过POST方法被提交到服务器端(例如图1中的服务器105)。
在步骤208中，电子设备(例如图1中的客户端101、102、103)根据服务器端(例如图1中的服务器105)的响应判定当前页面是否为钓鱼页面。下面，将具体讨论根据服务器端的不同响应来进行相对应的钓鱼页面的判断。
情况一，服务器端的响应为探测数据通过认证。
图4示出了根据本申请的一种实施方式的钓鱼页面检测方法400，如图4所示，方法400的步骤402-406与方法200的步骤202-206相 同，因此不在此赘述。在步骤408中，确定服务器端的响应为探测数据通过认证；以及在步骤410中，判定当前页面为钓鱼页面。
例如，探测数据通过了服务器的认证的响应可以是页面显示“登录成功”、“解封成功”等字样。由于探测数据包括根据用户数据伪造的各个字段，对于官方网站来说，该探测数据必然不能通过认证。因此，此时可以判定当前页面为钓鱼页面。
情况二，服务器端的响应为探测数据未通过认证。
一些钓鱼页面会在用户输入账号信息和密码后提示信息有误，引导用户进行第二次输入，通过这个提示会造成用户对其输入的信息进行核查，从而提高钓鱼的成功率。因此，本申请提出了一种对页面进行二次探测的方法。
图5示出了根据本申请的一种实施方式的钓鱼页面检测方法500，如图5所示，方法500的步骤502-506与方法200的步骤202-206相同，因此不在此赘述。在步骤508中，确定服务器端的响应为探测数据未通过认证；在步骤510中，构造与用户数据结构相同且内容与用户数据和探测数据均不同的第二探测数据；在步骤512中，将第二探测数据提交到服务器端；在步骤514中，判定当服务器端的响应是否为第二探测数据通过认证；以及在步骤516中，基于步骤514中的判定结果为“是”确定当前页面为钓鱼页面。
为了进一步保障网络环境安全，可以通过类似的方法进一步执行诸如第三或第四次探测的多次探测。
在实际应用中，为了避免每次登录均进行钓鱼页面探测给用户带来不便，还可以在探测当前页面是否是钓鱼页面之前预先判断当前页面是否是疑似钓鱼页面，并且仅在当前页面是疑似钓鱼页面时执行上述的方法200、400和500。
图6示出了根据本申请的一种实施方式的钓鱼页面检测方法600，如图6所示，方法600的步骤602-606与方法200步骤202-206相同，因此不在此赘述。在步骤602之前，方法600还包括：步骤601，判断当前页面是否是疑似钓鱼页面。
根据本申请的一种实施方式，判断当前页面是疑似钓鱼页面可以 通过判断当前页面试图向服务器端提交的用户数据是否为明文来执行。若当前页面试图向服务器端提交的用户数据为明文，即在浏览器中监测到的用户的数据和POST的数据一致，则可确定当前页面是疑似钓鱼页面。
根据本申请的一种实施方式，判定当前页面是疑似钓鱼页面还可以通过以下步骤来执行：根据当前页面的内容确定当前页面的官方网站的网址；以及当确定当前页面的网址与所确定的官方网站的网址时不一致判定当前页面时疑似钓鱼页面。
此外，还可以首先判断当前页面是否是登录页面。例如，如发现页面标题含有“XX登录”字样、网页结构中的“input”标签的“value”设置成“账号”、“密码”等字样或页面含有“登录”字样的按钮，则认为该页面为一个登录页面。
接下来，例如，当前页面显示内容包括“QQ邮箱”相关的内容，则可以将当前页面的网址与QQ邮箱的官方网址相比对，当比对结果为二者不相符时，确定当前页面为疑似钓鱼页面。
根据本申请的一种实施方式，上述方法还可以进一步包括：基于判定当前页面为钓鱼页面，将官方网站展现给用户。例如，用户的当前页面为伪造某工商银行的电子银行的钓鱼网站，在通过上述200、400、500或600判定当前页面为钓鱼页面后，可以将某工商银行的官方网站展现给用户。
图7示出了根据本申请的一种实施方式的钓鱼页面检测方法700，包括：步骤702，基于判定当前页面为钓鱼页面对用户进行风险提示；步骤704，接收来自用户对风险提示的反馈；步骤706，根据反馈生成钓鱼网站数据库；以及步骤708，在拦截当前页面试图向服务器端提交的用户数据之前，通过钓鱼网站数据库判断当前页面是否是钓鱼网站。
例如，可以将每个用户的每次反馈上传到云端，并对这些反馈进行对比分析，以将被确定为钓鱼页面的页面形成为钓鱼网站数据库。从而在接下来的钓鱼页面探测中，可以先将当前页面与钓鱼网站数据库相比对，若有匹配记录则直接认定当前页面为钓鱼页面。相反，若 钓鱼网站数据库中没有当前页面，则执行上述的各种方法。如果在接下来的方法执行中判定当前页面为钓鱼页面，则用户将当前页面的网址反馈并上传到云端，从而被判定为钓鱼页面的当前页面被添加至钓鱼网站数据库。
进一步参考图8，作为对上述各图所示方法的实现，本申请提供了一种钓鱼页面检测系统的一个实施例，该装置实施例与图2所示的方法实施例相对应，该系统800的装置具体可以应用于各种电子设备中。
本领域技术人员可以理解，上述钓鱼页面检测系统800还包括一些其他公知结构，例如处理器、存储器等，为了不必要地模糊本公开的实施例，这些公知的结构在图8中未示出。
如图8所示，系统800可包括：拦截装置810，配置为拦截当前页面试图向服务器端提交的用户数据；探测数据构造装置820，配置为构造与用户数据结构相同的探测数据，其中探测数据的内容与用户数据的内容不同；提交装置830，配置为将探测数据提交到服务器端；以及判定装置840，配置为根据服务器端的响应判定当前页面是否为钓鱼页面。关于拦截装置810、探测数据构造装置820、提交装置830和判定装置840的具体操作分别与上述的方法200的步骤202-208相同，因此省略其详细描述。
此外，根据本申请的一种实施方式，拦截装置810、探测数据构造装置820、提交装置830和判定装置840可以位于客户端，例如，作为插件内嵌在用户的浏览器中，或作为防火墙软件安装在客户的计算机中。
根据本申请的一种实施方式，钓鱼页面检测系统800还可以包括官网呈现装置，配置为基于判定所述当前页面为钓鱼页面，将所述官方网站呈现给用户。
根据本申请的一种实施方式，钓鱼页面检测系统800还可以包括钓鱼网站库生成装置，配置为：基于判定所述当前页面为钓鱼页面对用户进行风险提示；接收来自所述用户对所述风险提示的反馈；根据所述反馈生成钓鱼网站数据库；以及在所述拦截当前页面试图向服务 器端提交的用户数据之前，通过所述钓鱼网站数据库判断所述当前页面是否是钓鱼网站。
该钓鱼网站库生成装置对应于上文中所描述的方法700，因此不在此赘述。
下面参考图9，其示出了适于用来实现本申请实施例的客户端设备或服务器端的计算机系统900的结构示意图。
如图9所示，计算机系统900包括中央处理单元(CPU)901，其可以根据存储在只读存储器(ROM)902中的程序或者从存储部分908加载到随机访问存储器(RAM)903中的程序而执行各种适当的动作和处理。在RAM 903中，还存储有系统900操作所需的各种程序和数据。CPU 901、ROM 902以及RAM 903通过总线904彼此相连。输入/输出(I/O)接口905也连接至总线904。
以下部件连接至I/O接口905：包括键盘、鼠标等的输入部分906；包括诸如阴极射线管(CRT)、液晶显示器(LCD)等以及扬声器等的输出部分907；包括硬盘等的存储部分908；以及包括诸如LAN卡、调制解调器等的网络接口卡的通信部分909。通信部分909经由诸如因特网的网络执行通信处理。驱动器910也根据需要连接至I/O接口905。可拆卸介质911，诸如磁盘、光盘、磁光盘、半导体存储器等等，根据需要安装在驱动器910上，以便于从其上读出的计算机程序根据需要被安装入存储部分908。
特别地，根据本公开的实施例，上文参考流程图描述的过程可以被实现为计算机软件程序。例如，本公开的实施例包括一种计算机程序产品，其包括有形地包含在机器可读介质上的计算机程序，所述计算机程序包含用于执行流程图所示的方法的程序代码。在这样的实施例中，该计算机程序可以通过通信部分909从网络上被下载和安装，和/或从可拆卸介质911被安装。
附图中的流程图和框图，图示了按照本申请各种实施例的系统、方法和计算机程序产品的可能实现的体系架构、功能和操作。在这点上，流程图或框图中的每个方框可以代表一个模块、程序段、或代码的一部分，所述模块、程序段、或代码的一部分包含一个或多个用于 实现规定的逻辑功能的可执行指令。也应当注意，在有些作为替换的实现中，方框中所标注的功能也可以以不同于附图中所标注的顺序发生。例如，两个接连地表示的方框实际上可以基本并行地执行，它们有时也可以按相反的顺序执行，这依所涉及的功能而定。也要注意的是，框图和/或流程图中的每个方框、以及框图和/或流程图中的方框的组合，可以用执行规定的功能或操作的专用的基于硬件的系统来实现，或者可以用专用硬件与计算机指令的组合来实现。
描述于本申请实施例中所涉及到的单元可以通过软件的方式实现，也可以通过硬件的方式来实现。所描述的单元也可以设置在处理器中，例如，可以描述为：一种处理器包括拦截单元、探测数据构造单元提交单元和判定单元。其中，这些单元的名称在某种情况下并不构成对该单元本身的限定，例如，拦截单元还可以被描述为“用于拦截当前页面试图向服务器端提交的用户数据的单元”。
作为另一方面，本申请还提供了一种计算机可读存储介质，该计算机可读存储介质可以是上述实施例中所述装置中所包含的计算机可读存储介质；也可以是单独存在，未装配入终端中的计算机可读存储介质。所述计算机可读存储介质存储有一个或者一个以上程序，所述程序被一个或者一个以上的处理器用来执行描述于本申请的钓鱼页面检测方法。
以上描述仅为本申请的较佳实施例以及对所运用技术原理的说明。本领域技术人员应当理解，本申请中所涉及的发明范围，并不限于上述技术特征的特定组合而成的技术方案，同时也应涵盖在不脱离所述发明构思的情况下，由上述技术特征或其等同特征进行任意组合而形成的其它技术方案。例如上述特征与本申请中公开的(但不限于)具有类似功能的技术特征进行互相替换而形成的技术方案。

Claims (20)

  1. 一种钓鱼页面检测方法，包括：
    拦截当前页面试图向服务器端提交的用户数据；
    构造与所述用户数据结构相同的探测数据，其中所述探测数据的内容与所述用户数据的内容不同；
    将所述探测数据提交到所述服务器端；以及
    根据所述服务器端的响应判定所述当前页面是否为钓鱼页面。
  2. 如权利要求1所述的方法，其中根据所述服务器端的响应判定所述当前页面是否为钓鱼页面包括：
    确定所述服务器端的响应为所述探测数据通过认证；以及
    判定所述当前页面为钓鱼页面。
  3. 如权利要求1所述的方法，其中根据所述服务器端的响应判定所述当前页面是否为钓鱼页面包括：
    确定所述服务器端的响应为所述探测数据未通过认证；
    构造与所述用户数据结构相同且内容与所述用户数据和所述探测数据均不同的第二探测数据；
    将所述第二探测数据提交到所述服务器端；以及
    当所述服务器端的响应为所述第二探测数据通过认证时判定所述当前页面为钓鱼页面。
  4. 如权利要求1所述的方法，还包括：
    确定所述当前页面是疑似钓鱼页面；以及
    在确定所述当前页面是疑似钓鱼页面时拦截所述当前页面试图向服务器端提交的用户数据。
  5. 如权利要求4所述的方法，其中，判定当前页面是疑似钓鱼页面包括：
    确定所述当前页面试图向所述服务器端提交的所述用户数据为明文。
  6. 如权利要求4所述的方法，其中，判定当前页面是疑似钓鱼页面包括：
    根据所述当前页面的内容确定所述当前页面的官方网站的网址；以及
    当确定所述当前页面的网址与所确定的官方网站的网址时不一致判定所述当前页面时疑似钓鱼页面。
  7. 如权利要求1-6中任意一项所述的方法，其中，所述用户数据包括用户名和口令。
  8. 如权利要求1-6中任意一项所述的方法，还包括：
    基于判定所述当前页面为钓鱼页面，将所述官方网站展现给用户。
  9. 如权利要求1-6中任意一项所述的方法，还包括：
    基于判定所述当前页面为钓鱼页面对用户进行风险提示；
    接收来自所述用户对所述风险提示的反馈；
    根据所述反馈生成钓鱼网站数据库；以及
    在所述拦截当前页面试图向服务器端提交的用户数据之前，通过所述钓鱼网站数据库判断所述当前页面是否是钓鱼网站。
  10. 一种钓鱼页面检测系统，包括：
    拦截装置，配置为拦截当前页面试图向服务器端提交的用户数据；
    探测数据构造装置，配置为构造与所述用户数据结构相同的探测数据，其中所述探测数据的内容与所述用户数据的内容不同；
    提交装置，配置为将所述探测数据提交到所述服务器端；以及
    判定装置，配置为根据所述服务器端的响应判定所述当前页面是否为钓鱼页面。
  11. 如权利要求10所述的系统，其中所述判定装置被配置为：
    确定所述服务器端的响应为所述探测数据通过认证；以及
    判定所述当前页面为钓鱼页面。
  12. 如权利要求10所述的系统，其中：
    所述探测数据构造装置还被配置为基于所述判定装置确定所述服务器端的响应为所述探测数据未通过认证，构造与所述用户数据结构相同且内容与所述用户数据和所述探测数据均不同的第二探测数据；
    所述提交装置还被配置为将所述第二探测数据提交到所述服务器端；以及
    所述判定装置还被配置为当所述服务器端的响应为所述第二探测数据通过认证时判定所述当前页面为钓鱼页面。
  13. 如权利要求10所述的系统，还包括：
    疑似钓鱼页面判定装置，配置为判定所述当前页面是否是疑似钓鱼页面。
  14. 如权利要求13所述的系统，其中，所述疑似钓鱼页面判定装置配置为：确定所述当前页面试图向所述服务器端提交的所述用户数据是否为明文。
  15. 如权利要求13所述的系统，其中，，所述疑似钓鱼页面判定装置配置为：
    根据所述当前页面的内容确定所述当前页面的官方网站的网址；以及
    确定所述当前页面的网址与所确定的官方网站的网址是否一致。
  16. 如权利要求10-15中任意一项所述的系统，其中，所述用户数据包括用户名和口令。
  17. 如权利要求10-15中任意一项所述的系统，还包括：
    官网呈现装置，配置为基于判定所述当前页面为钓鱼页面，将所述官方网站呈现给用户。
  18. 如权利要求10-15中任意一项所述的系统，还包括钓鱼网站库生成装置，配置为：
    基于判定所述当前页面为钓鱼页面对用户进行风险提示；
    接收来自所述用户对所述风险提示的反馈；
    根据所述反馈生成钓鱼网站数据库；以及
    在所述拦截当前页面试图向服务器端提交的用户数据之前，通过所述钓鱼网站数据库判断所述当前页面是否是钓鱼网站。
  19. 一种设备，包括：
    处理器；和
    存储器，
    所述存储器中存储有能够被所述处理器执行的计算机可读指令，在所述计算机可读指令被执行时，所述处理器执行权利要求1至9中任一项所述的方法。
  20. 一种非易失性计算机存储介质，所述计算机存储介质存储有能够被处理器执行的计算机可读指令，当所述计算机可读指令被处理器执行时，所述处理器执行权利要求1至9中任一项所述的方法。
PCT/CN2015/099898 2015-08-28 2015-12-30 钓鱼页面检测方法及系统 WO2017036043A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
KR1020177015129A KR102026544B1 (ko) 2015-08-28 2015-12-30 피싱 웹 페이지 검출 방법 및 시스템
EP15902847.1A EP3214817B1 (en) 2015-08-28 2015-12-30 Phishing page detection method and device
US15/533,925 US10367849B2 (en) 2015-08-28 2015-12-30 Method and system for detecting phishing page
JP2017530712A JP6487555B2 (ja) 2015-08-28 2015-12-30 フィッシングページの検出方法及びシステム

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510542777.5A CN105141610A (zh) 2015-08-28 2015-08-28 钓鱼页面检测方法及系统
CN201510542777.5 2015-08-28

Publications (1)

Publication Number Publication Date
WO2017036043A1 true WO2017036043A1 (zh) 2017-03-09

Family

ID=54726818

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/099898 WO2017036043A1 (zh) 2015-08-28 2015-12-30 钓鱼页面检测方法及系统

Country Status (6)

Country Link
US (1) US10367849B2 (zh)
EP (1) EP3214817B1 (zh)
JP (1) JP6487555B2 (zh)
KR (1) KR102026544B1 (zh)
CN (1) CN105141610A (zh)
WO (1) WO2017036043A1 (zh)

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105141610A (zh) 2015-08-28 2015-12-09 百度在线网络技术（北京）有限公司 钓鱼页面检测方法及系统
US9843602B2 (en) * 2016-02-18 2017-12-12 Trend Micro Incorporated Login failure sequence for detecting phishing
US11316895B1 (en) * 2016-10-20 2022-04-26 United Services Automobile Association (Usaa) Method of generating and using credentials to detect the source of account takeovers
US10419477B2 (en) * 2016-11-16 2019-09-17 Zscaler, Inc. Systems and methods for blocking targeted attacks using domain squatting
CN109257751A (zh) * 2018-11-14 2019-01-22 四川长虹电器股份有限公司 一种伪基站短信中钓鱼链接的处理系统
US11233820B2 (en) 2019-09-10 2022-01-25 Paypal, Inc. Systems and methods for detecting phishing websites
US11595435B2 (en) 2020-03-09 2023-02-28 EC-Council International Limited Methods and systems for detecting phishing emails using feature extraction and machine learning
CN112559993B (zh) * 2020-12-24 2024-02-02 RealMe重庆移动通信有限公司 身份认证方法、装置、系统及电子设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070192853A1 (en) * 2004-05-02 2007-08-16 Markmonitor, Inc. Advanced responses to online fraud
CN101978376A (zh) * 2008-03-19 2011-02-16 网圣公司 用于抵御信息窃取软件的方法及系统
CN103516693A (zh) * 2012-06-28 2014-01-15 中国电信股份有限公司 鉴别钓鱼网站的方法与装置
US20140041024A1 (en) * 2012-08-01 2014-02-06 Bank Of America Corporation Method and Apparatus for Baiting Phishing Websites
CN105141610A (zh) * 2015-08-28 2015-12-09 百度在线网络技术（北京）有限公司 钓鱼页面检测方法及系统

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2006221242A (ja) * 2005-02-08 2006-08-24 Fujitsu Ltd 認証情報詐取防止システム、プログラム及び方法
KR100670826B1 (ko) * 2005-12-10 2007-01-19 한국전자통신연구원 인터넷 개인 정보 보호 방법 및 그 장치
JP2007334759A (ja) * 2006-06-16 2007-12-27 Oki Electric Ind Co Ltd 情報漏洩防止装置、方法及びプログラム
US20080244715A1 (en) * 2007-03-27 2008-10-02 Tim Pedone Method and apparatus for detecting and reporting phishing attempts
US9130986B2 (en) 2008-03-19 2015-09-08 Websense, Inc. Method and system for protection against information stealing software
JP5661290B2 (ja) * 2010-01-26 2015-01-28 ヤフー株式会社 情報処理装置及び方法
US9083733B2 (en) * 2011-08-01 2015-07-14 Visicom Media Inc. Anti-phishing domain advisor and method thereof
US9111090B2 (en) * 2012-04-02 2015-08-18 Trusteer, Ltd. Detection of phishing attempts
US8839369B1 (en) * 2012-11-09 2014-09-16 Trend Micro Incorporated Methods and systems for detecting email phishing attacks
JP5753302B1 (ja) * 2014-08-25 2015-07-22 株式会社 ディー・エヌ・エー ウェブページへのアクセスを警告するためのプログラム、方法、及びシステム

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070192853A1 (en) * 2004-05-02 2007-08-16 Markmonitor, Inc. Advanced responses to online fraud
CN101978376A (zh) * 2008-03-19 2011-02-16 网圣公司 用于抵御信息窃取软件的方法及系统
CN103516693A (zh) * 2012-06-28 2014-01-15 中国电信股份有限公司 鉴别钓鱼网站的方法与装置
US20140041024A1 (en) * 2012-08-01 2014-02-06 Bank Of America Corporation Method and Apparatus for Baiting Phishing Websites
CN105141610A (zh) * 2015-08-28 2015-12-09 百度在线网络技术（北京）有限公司 钓鱼页面检测方法及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3214817A4 *

Also Published As

Publication number Publication date
KR102026544B1 (ko) 2019-09-27
KR20170101905A (ko) 2017-09-06
JP2018504677A (ja) 2018-02-15
CN105141610A (zh) 2015-12-09
EP3214817A4 (en) 2018-01-24
EP3214817A1 (en) 2017-09-06
EP3214817B1 (en) 2019-01-30
US20180205758A1 (en) 2018-07-19
JP6487555B2 (ja) 2019-03-20
US10367849B2 (en) 2019-07-30

Similar Documents

Publication Publication Date Title
WO2017036043A1 (zh) 钓鱼页面检测方法及系统
US9378345B2 (en) Authentication using device ID
US10460097B2 (en) Malicious client detection based on usage of negotiable protocols
US10299118B1 (en) Authenticating a person for a third party without requiring input of a password by the person
US9098689B2 (en) Efficiently throttling user authentication
US10523699B1 (en) Privilege escalation vulnerability detection using message digest differentiation
US8615794B1 (en) Methods and apparatus for increased security in issuing tokens
US9369480B2 (en) Systems and methods for automating blind detection of computational vulnerabilities
US10505980B2 (en) Secured user credential management
WO2019037417A1 (zh) 网页数据爬取方法、装置、网页数据爬取平台及存储介质
EP3149888B1 (en) Processing and verifying digital certificate
US9544317B2 (en) Identification of potential fraudulent website activity
US9003540B1 (en) Mitigating forgery for active content
US10666656B2 (en) Systems and methods for protecting users from malicious content
US20210397682A1 (en) Secure Service Interaction
US9210155B2 (en) System and method of extending a host website
US11240225B1 (en) Single sign-on techniques
US11374915B1 (en) Security challenge bypass
CN108141434B (zh) 经由设备通知提供多因素认证凭证
CN107294920A (zh) 一种反向信任登录方法和装置
US20220414226A1 (en) Systems and methods for dynamic detection of vulnerable credentials
US9225689B2 (en) Hardware security agent for network communications
WO2023041800A1 (en) Website verification with proof of origin

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15902847

Country of ref document: EP

Kind code of ref document: A1

REEP Request for entry into the european phase

Ref document number: 2015902847

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 20177015129

Country of ref document: KR

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 15533925

Country of ref document: US

ENP Entry into the national phase

Ref document number: 2017530712

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE