JP4429971B2 - Legitimate site verification method, apparatus, and program - Google Patents

Description

  The present invention relates to network security, and more particularly to a phishing countermeasure method.

  With recent developments in network technology, phishing scams steal personal information such as name, age, address, and telephone number, and credit information such as credit card number, ID, and password, using network tools such as email and Web. Has come to occur frequently.

  Phishing scams often start with emails that ask for confirmation or correction of personal information. The e-mail looks as if it was sent by a famous bank or credit card company, and requests the recipient to input / correct personal information on the website, and the URL (Uniform Resource Locator) is described. . Although the URL is a fake URL, the screen of the URL is very similar to a legitimate site, or the address bar is misrepresented so that the user does not notice that it is a phishing site.

  Various techniques have been proposed as countermeasures against such phishing scams.

  CoreStreet's SpoofStick alerts the user by taking a huge display of the name of the site connected to the toolbar of the Web browser, making it easy to understand suspicious sites such as IP addresses only (non- Patent Document 1).

  If you are trying to browse a blacklisted website as a phishing site, or if you are trying to browse an irregular URL site such as just an IP address, DeepExplorer of Deepnet Technologies The technique which calls attention is adopted (nonpatent literature 2).

Netscape 8.0 of Netscape employs a technique of eliminating phishing sites using a blacklist (Non-patent Document 3).
HYPERLINK "http://www.corestreet.com/spoofstick/" http://www.corestreet.com/spoofstick/ (searched on March 15, 2005) http://www.deepnetexplorer.com/ (searched on March 15, 2005) http://browser.netscape.com/nsb/support/relnotes.jsp (searched on March 15, 2005)

  However, with blacklist countermeasures, it is very difficult to discover and register in real time a phishing site that has an average life span of one week.

  Also, even if the URL is only an IP address, it is not necessarily a fraud site, and a user who browses a site that only has an IP address will act ignoring the alert to the URL only by the IP address. It becomes like this.

  An object of the present invention is to provide a legitimate site verification method, apparatus, and program capable of verifying with high probability that a site that a user is trying to browse is not an illegal site such as a phishing site.

The legitimate site verification method of the present invention is:
Extracting the company name from the email received by the user;
Extracting a URL from the email;
Storing the extracted company name and URL as an acquired mail information list in a storage means provided in the legitimate site verification device ;
The company name corresponding to the company name in the acquired mail information list does not exist in the predetermined company list, or the company name exists but the URL in the acquired mail information list is the URL of the company name in the company list. If the URL is the same or the URL extracted from the mail is not related to the company name extracted from the mail, it is connected to the search site if it does not match the content described in the URL relation rule dictionary When the search is performed based on the company name in the acquired mail information list and the URL of the search result and the URL in the acquired mail information list match the same or the contents described in the URL relation rule dictionary, the acquired mail Considering that the relationship between the company name and URL in the information list is valid and extracting the related URL to be registered in the company list;
When the user starts the browser, if the URL to be opened is the same as the URL in the company list or matches the contents described in the URL relation rule dictionary, the URL to be opened is a valid site. If the URL to be opened is not the same as the URL in the company list and does not match the contents described in the URL relation rule dictionary, the URL to be opened is invalid. URL verification step to notify the user that there is a possibility of the site,
Have

  The present invention confirms the legitimacy of a site by performing verification using a search site as a white list.

  When a mail is received, a combination of a character string that is assumed to be a company name in the mail text and a URL described in the mail is acquired. A search is performed by the acquired company name on the search site, and the URL of the site obtained as a result is compared with the acquired URL based on the rules. If the rule matches, the URL is verified as a valid URL related to the company.

  Since it is virtually impossible for a phishing scam site with a short life expectancy to obtain a high ranking on a search site, it can be verified with high probability that the site that the user is trying to browse is not a phishing scam site.

  Even if the URL is a legitimate URL that is directly IP addressed, it can be verified as long as it exists at the top of the search site as the company's site.

  Next, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a block diagram of a valid site verification apparatus according to an embodiment of the present invention.

  The legitimate site verification device is composed of a mail analysis unit 1 and a browser unit 2.

  The mail analysis unit 1 detects the reception of mail (including acquisition of pop3 and imap4) and analyzes the received mail. The morphological analysis unit 11, the company name analysis unit 12, the URL analysis unit 13, and the acquired mail An information list 14, a company list processing unit 15, a company name rule dictionary 16, a URL rule dictionary 17, a URL relation rule dictionary 18, and a company list 19 are included. Here, the mail is the target of processing in the case of HTML mail.

  The morpheme analysis unit 11 performs morpheme analysis on the mail 3 and sends the output result to the company name analysis unit 12.

  The company name analysis unit 12 extracts a noun that is inferred from the company name according to the contents of the company name rule dictionary 16 for the morphological analysis result of the mail 3 and the mail 3. Table 1 shows a notation example using a regular expression as an example of the company name rule dictionary 16.

  The URL analysis unit 13 extracts a part that is inferred from the URL according to the contents of the URL rule dictionary 17 for the mail 3. The URL rule dictionary 17 is described by a regular expression, for example, as an example, “s? Https ?: // [−_.! ~ * ′ () A−zA−Z0-9; // ?: @ & = + $,% #] + "And the like are possible. The combination of the extracted company name and URL is stored in the acquired mail information list 14. A notation example of the acquired mail information list 14 is shown in Table 2.

  The company list processing unit 15 searches whether the company name corresponding to the company name in the acquired mail information list 14 exists in the company list 19. If the company name within the valid period exists in the company list 19, the company list processing unit 15. 19 URLs are compared with the URLs of the acquired mail information list 14. If the two URLs are the same or match the contents described in the URL relation rule dictionary 18, it is determined that the URL is valid as the URL of the company, and the company name is obtained from the acquired mail information list 14. And delete the URL. A description example of the company list 19 is shown in Table 3.

  Further, the URL relation rule dictionary 18 is a rule for determining whether or not the URL extracted from the mail is a URL related to the company name extracted from the mail, for example, the mail in a lower directory of the URL extracted from the search site. If there is a URL extracted from the URL, it is determined to be legitimate, and it is a lower directory of the URL extracted from the search site, but is extracted from the mail under the home directory represented by “˜ (tilde)”. A rule that determines that the URL is invalid when it exists is defined. For example, it is described in a regular expression. Table 4 shows an example.

  On the other hand, if the company name corresponding to the company name in the acquired mail information list 14 does not exist in the company list 19, or the company name exists but there is a URL that is the same or matches the content described in the URL relation rule dictionary 18 If not, the company list processing unit 15 connects to a plurality of search sites 5 existing on the Internet 4 and performs a search by the company name in the acquired mail information list 14. The URL that is within the top n (for example, the top 5) of the search results of the plurality of search sites 5 is compared with the URL associated with the company name in the acquired mail information list 14. If the URL in the top n of the search results in the majority of search sites 5 and the URL of the mail information list 14 are the same or match the contents described in the URL relation rule dictionary 18, the company name and URL The relationship is considered valid and registered in the company list 19. In addition, since the analysis by the robot of the search site 5 is reflected over a relatively long time (much longer than one week, which is the average life of the phishing site), the phishing site bites into the top of the search site 5 It seems very difficult.

  When the user activates the browser by double-clicking on the URL in the mail 3, the URL verification unit 21 of the browser unit 2 displays the URL to be opened and the URL in the company list 19 in accordance with an instruction from the user. Compare. If the URL to be opened is the same as the URL in the company list 19 or matches the content described in the URL relation rule dictionary 18, the URL instructed by the user is valid and the URL in the company list is valid. Notify the user that the company name is valid.

  On the other hand, if the URL to be opened in accordance with the instruction from the user is not the same as the URL in the company list 19 and does not match the content described in the URL relation rule dictionary 18, the URL instructed by the user is Notify the user that there is a possibility of fraud.

  The function of the valid site verification device described above is executed by recording a program for realizing the function on a computer-readable recording medium, and causing the computer to read the program recorded on the recording medium. It may be a thing. The computer-readable recording medium refers to a recording medium such as a flexible disk, a magneto-optical disk, and a CD-ROM, and a storage device such as a hard disk device built in a computer system. Further, the computer-readable recording medium is a medium that dynamically holds the program for a short time (transmission medium or transmission wave) as in the case of transmitting the program via the Internet, and in the computer serving as a server in that case Such as a volatile memory that holds a program for a certain period of time.

1 is a block diagram of a valid site verification device according to an embodiment of the present invention. FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Mail analysis part 2 Browser part 3 Mail 4 Internet 5 Search site 11 Morphological analysis part 12 Company name analysis part 13 URL analysis part 14 Acquisition mail information list 15 Company list processing part 16 Company name rule dictionary 17 URL rule dictionary 18 URL relation rule Dictionary 19 Company List 21 URL Verification Department

Claims (7)

A legitimate site verification method performed by a legitimate site verifier that verifies whether a Web site accessed by a user is a legitimate site ,
A company name extraction step for extracting the company name from the email received by the user;
A URL extracting step of extracting a URL from the mail;
An acquiring mail information list storage step of storing in has been storing means provided to the legitimate site verification apparatus the company name and URL which said extracted as acquired mail information list,
The company name corresponding to the company name in the acquired mail information list does not exist in the predetermined company list, or the company name exists but the URL in the acquired mail information list is the URL of the company name in the company list. If the URL is the same or the URL extracted from the mail is not related to the company name extracted from the mail, it is connected to the search site if it does not match the content described in the URL relation rule dictionary When the search is performed based on the company name in the acquired mail information list and the URL of the search result and the URL in the acquired mail information list match the same or the contents described in the URL relation rule dictionary, the acquired mail Considering that the relationship between the company name and URL in the information list is valid and extracting the related URL to be registered in the company list;
When the user starts the browser, if the URL to be opened is the same as the URL in the company list or matches the contents described in the URL relation rule dictionary, the URL to be opened is a valid site. If the URL to be opened is not the same as the URL in the company list and does not match the contents described in the URL relation rule dictionary, the URL to be opened is invalid. URL verification step to notify the user that there is a possibility of the site,
A legitimate site verification method. The legitimate site verification method according to claim 1, wherein in the company name extraction step, a character string presumed to be a company name is extracted from an e-mail using morphological analysis or a company name list. The legitimate site verification method according to claim 1, wherein in the company name extraction step, a character string that is presumed to be a company name is extracted from the mail based on a regular expression rule. In the related URL extraction step, when a search by the company name is performed at a plurality of search sites, URLs appearing at a plurality of search sites among URLs appearing at the top of the ranking or search sites that have performed a search are displayed. The legitimate site verification method according to any one of claims 1 to 3, wherein URLs that appear higher in a majority of search sites are determined to be URLs related to the company name. The URL relation rule dictionary rule is determined to be valid when the URL extracted from the mail exists in a lower directory of the URL extracted from the search site using the regular expression, and the URL extracted from the search site 5. Any one of the above-mentioned directories is determined to be invalid when a URL extracted from mail exists under a home directory represented by “˜ (tilde)”. Valid site verification method described in 1. A valid site verification device for verifying whether a web site accessed by a user is a valid site,
A company name extraction means for extracting the company name from the email received by the user;
URL extracting means for extracting a URL from the mail;
Storage means for storing the extracted company name and URL as an acquired mail information list;
The company name corresponding to the company name in the acquired mail information list does not exist in the predetermined company list, or the company name exists but the URL in the acquired mail information list is the URL of the company name in the company list. If the URL is the same or the URL extracted from the mail is not related to the company name extracted from the mail, it is connected to the search site if it does not match the content described in the URL relation rule dictionary When the search is performed based on the company name in the acquired mail information list and the URL of the search result and the URL in the acquired mail information list match the same or the contents described in the URL relation rule dictionary, the acquired mail A company list processing means for considering the relationship between the company name and the URL in the information list as valid and registering it in the company list;
When the user starts the browser, if the URL to be opened is the same as the URL in the company list or matches the contents described in the URL relation rule dictionary, the URL to be opened is a valid site. If the URL to be opened is not the same as the URL in the company list and does not match the contents described in the URL relation rule dictionary, the URL to be opened is invalid. URL verification means to notify the user that there is a possibility of the site,
A valid site verification device having A program for causing a computer to execute the legitimate site verification method according to any one of claims 1 to 5.

Images