CN107800686A - A kind of fishing website recognition methods and device - Google Patents

Abstract

The present invention relates to a kind of fishing website recognition methods and device.This method includes：Detect the resource that other websites whether are embedded in website to be detected；If not being embedded in the resource of other websites, it is non-fishing website to judge website to be detected；Whether if having been inserted into the resource of other websites, judging the domain name of other websites with white list has common factor；If not occuring simultaneously, it is non-fishing website to judge website to be detected；If there is common factor, judge website to be detected for highly doubtful fishing website；Validity decision and domain name credit evaluation are carried out to highly doubtful fishing website, to determine whether website to be detected is fishing website.The present invention, which can make up black list techniques, can not filter the fishing website of the deficiency of emerging fishing website, efficient identification insertion brand website element and resource, the performance of lifting phishing filtering.

Description

Method and device for identifying phishing websites

technical field

The invention belongs to the technical fields of information technology and network security, and in particular relates to a phishing website identification method and device.

Background technique

The term Phishing was coined in 1996 and evolved from the word Fishing. In the process of phishing, attackers use bait (such as email, SMS) to send to a large number of users, expecting a small number of users to "take the bait", and then achieve the purpose of "phishing" (such as stealing users' private information). The International Anti-Phishing Working Group (APWG) defines phishing as: Phishing is a cyber attack method that uses social engineering and technical means to steal consumers' personally identifiable data and financial account credentials. Phishing attacks using social engineering methods often send users deceptive emails and text messages that appear to be from legitimate companies or institutions, luring users to reply to personal sensitive information or click on links inside to visit fake websites, thereby leaking credential information (e.g. username, password) or download malware. Phishing seriously threatens the property and privacy of netizens, and has become one of the biggest security risks on the Internet.

Blacklist technology is widely used and is one of the main phishing filtering technologies. For example, the Google Safe API used in Google Chrome, Mozilla Firefox, and Apple Safari is based on the constantly updated blacklist provided by Google, and by verifying whether a certain URL is in the blacklist, it can be judged whether the URL is a phishing or malicious webpage. The blacklist technology is simple and easy to use, but it has obvious disadvantages: it cannot do anything about phishing websites that are not included in the list, in other words, it cannot filter newly emerging phishing websites.

Contents of the invention

Aiming at the above problems, the present invention provides a method and device for identifying phishing websites, which can make up for the inability of blacklist technology to filter emerging phishing websites, efficiently identify phishing websites embedded with brand website elements and resources, and improve the performance of phishing filtering.

By analyzing the phishing reporting data of PhishTank and China Anti-Phishing Website Alliance, the present invention finds that most phishing websites often directly use resources (Logo, CSS, etc.) of brand websites in order to counterfeit more realistically; When the website is displayed, a query request for the domain name of the brand website will be initiated immediately. The present invention utilizes the above characteristics of phishing websites to identify these phishing websites by analyzing domain name system (DNS) resolution data.

The technical scheme that the present invention adopts is as follows:

A method for identifying a phishing website, comprising the following steps:

Detect whether resources of other websites are embedded in the website to be detected;

If there is no resource embedded in other websites in the website to be detected, it is determined that the website to be detected is a non-phishing website;

If resources of other websites have been embedded in the website to be detected, it is determined whether the domain names of the other websites overlap with the whitelist; if there is no intersection, it is determined that the website to be detected is not a phishing website; if there is an intersection, it is determined that the website to be detected It is a highly suspected phishing website;

Perform legality determination and domain name credit evaluation on the highly suspected phishing website to determine whether the website to be detected is a phishing website.

Further, before detecting whether resources of other websites are embedded in the website to be detected, it is determined whether the domain name of the website to be detected is in the white list, and if it is in the white list, it is directly determined that the website to be detected is a non-phishing website.

Further, by detecting whether the web page source code of the website to be detected is embedded with links to resources of other websites, or detecting whether the browser initiates a DNS query request for other domain names during the process of accessing the website to be detected, it is determined whether the website to be detected is embedded with other resources. resources of the site.

Further, the network behavior of the browser is monitored in real time through the browser plug-in, to capture the network resource query request initiated by the browser during the process of loading the page of the website to be detected, and compare the queried domain name with the domain name of the website to be detected, In this way, it is determined whether to initiate a DNS query request for other domain names.

Further, by setting up a local DNS recursive server and analyzing the DNS query request log, it is judged whether the browser initiates a DNS query request for other domain names during the process of accessing the website to be detected.

Further, by disabling the DNS client cache of the computer, and setting the DNS client to only use the built local DNS recursive server for DNS query, to ensure that the DNS query request log completely records the DNS query request initiated by the browser when loading the page .

Further, a non-existing domain name is selected, and the DNS query request record of the domain name is used as a separate identifier between different webpage query request records in the DNS query request log.

A device for identifying a phishing website, comprising:

A detection unit, configured to detect whether resources of other websites are embedded in the website to be detected;

The first determining unit is configured to determine that the website to be detected is a non-phishing website when no resources of other websites are embedded in the website to be detected;

A whitelist comparison unit, configured to determine whether the domain names of other websites embedded in the website to be detected overlap with the whitelist;

The second determination unit is used to determine that the website to be detected is a non-phishing website when the domain names of the other websites do not overlap with the white list; and when the domain names of the other websites overlap with the white list, determine that the website to be detected is a non-phishing website Highly suspected phishing website;

An evaluation unit, configured to determine the legitimacy and domain name credit evaluation of the highly suspected phishing website;

The third determination unit is configured to determine whether the website to be detected is a phishing website according to the result obtained by the evaluation unit.

Further, the detection unit judges whether resources of other websites are embedded in the website to be detected by detecting whether the source code of the webpage of the website to be detected is embedded with resources of other websites; or, the detection unit is a browser plug-in, By monitoring the browser's network behavior in real time, capture the network resource query request initiated by the browser during the process of loading the page of the website to be detected, and compare the queried domain name with the domain name of the website to be detected to determine whether to initiate a search for other DNS query request of the domain name, so as to determine whether resources of other websites are embedded in the website to be detected.

Further, the detection unit is a local DNS recursive server, which analyzes the DNS query request log to determine whether the browser initiates a DNS query request for other domain names during the process of accessing the website to be detected, thereby judging whether the website to be detected is embedded in other websites. resource.

Compared with the prior art, the beneficial effects of the present invention are as follows:

1. It is easy to implement in the form of a browser plug-in, so as to realize online real-time identification and timely feedback of the results to remind users to avoid being deceived.

2. It can be used together with the blacklist technology to complement each other. Before using the present invention for phishing identification, the domain name of the URL to be detected can be matched with the blacklist, if the domain name exists in the blacklist, the URL can be identified as phishing, and no further identification is necessary, thereby effectively improving the efficiency of identification . On the other hand, if the matching with the blacklist is not successful, and it is identified as phishing after the identification by the present invention, the corresponding domain name can be added to the blacklist to realize the expansion of the blacklist.

3. Easy to expand. For new brand phishing, just add the domain name where the brand resource is located to the white list. The key of the present invention is to maintain a white list with completeness and validity. Compared with the black list, the white list composed of legal brand domain names is relatively more stable and easier to maintain and update.

4. Language is irrelevant. All the steps of the invention do not involve the language types of phishing websites, and can identify counterfeiting of global brands. Therefore, the present invention is not restricted by the language type of the website, and compared with other phishing identification methods, the application range is wider.

Description of drawings

Figure 1 is a schematic diagram of a phishing website.

Figure 2 is a screenshot of the source code fragment of the phishing website shown in Figure 1.

Fig. 3 is a flowchart of a method for identifying a phishing website in an embodiment.

Fig. 4 is a schematic diagram of components of the device for identifying phishing websites in the embodiment.

Detailed ways

The present invention will be described in further detail below through specific embodiments and accompanying drawings.

Phishing is essentially brand counterfeiting. Phishers send false information through emails, instant messaging, etc. to lure users to visit pre-built counterfeit websites to defraud users of their privacy and property. Among them, counterfeit websites, as the most important crime site, are often highly similar to real brand websites visually, in order to deceive users into believing they are real. Today, websites (especially big brand websites) are no longer simple text and pictures, but contain a large number of elements and resources with unique brand styles, including Logo pictures, Favicon pictures, CSS files, JS files, etc.; To confuse the real ones, these resources of the brand website are often directly used, that is, the links to these resources are embedded in the source code of the web page. For example: https://wvw.paypal-limited.com-webapps-security.com is a phishing PayPal (http://www.paypal.com) website, and its effect is shown in Figure 1.

The landing page is almost exactly the same as the landing page of the paypal official website. The screenshot of the source code fragment of the website is shown in Figure 2. It can be seen from the screenshot that the phishing website uses paypal's Favicon image, CSS file and JS file (Note: PayPal's resources are all placed at www.paypalobjects.com). In this way, when a user accesses https://wvw.paypal-limited.com-webapps-security.com/ through a browser, the browser will first initiate a query request for the domain name "com-webapps-security.com", A query request for the domain name "paypalobjects.com" is then initiated. The method of the invention is to efficiently identify the phishing website by fully mining this characteristic of the phishing website.

The flow chart of the phishing website identification method of the present invention is shown in FIG. 3 . For each URL entered by the user, perform the following process:

1. According to the existing whitelist database, determine whether the domain name corresponding to the URL to be detected is in the whitelist. If it is in the whitelist, it means that the URL is not a phishing website, and the identification process is ended; otherwise, perform the second step.

2. Use a browser to initiate a query request for the Domain, visit the server where the Domain is located, load the page, and determine whether to initiate a query request for other domain names (newNomains) during the process. If not, consider that the URL is not Phishing website, end the process; otherwise, proceed to the next step of identification.

3. Determine whether there is a domain name in newDomains that is in the whitelist (that is, whether it intersects with the whitelist). If not, the URL is considered not to be a phishing website; otherwise, the URL is considered to be a highly suspected phishing website for further identification.

4. For highly suspected phishing websites, further conduct legality determination and domain name credit evaluation, and finally determine whether the website is phishing. The legality judgment is to judge whether the domain name of the corresponding brand in the white list used by the suspected phishing website is legal, and the domain name credit evaluation is to score the domain name to judge whether the website domain name is credible.

In the last step, for highly suspected phishing websites, you can further analyze whether the Domain is indexed in the search engine, if the search engine has an index, it is not phishing; and whether the domain name (whiteDomain) matching in the whitelist is registered by the same person, if If yes, it is not phishing; and whether the resolved IP of Domain and whiteDomain is in an AS (Autonomous System) domain, if yes, it is not phishing; if the above conditions are not met, it is considered as phishing.

The key point of the present invention is to confirm whether to embed elements and resource links of the brand website in the web page source code of the URL to be detected, that is, whether to initiate a query request to other domain names (newDomains) when the browser visits the URL. The present invention does not limit the specific implementation manner, and can be realized through various methods such as page content analysis, browser query monitoring, recursive DNS analysis and analysis, and the following will give examples respectively.

1. By analyzing the source code of the web page

The most direct manifestation of using brand website resources in phishing and counterfeiting websites is to embed links to these resources in the source code of web pages. In the source code of a web page, resources such as Logo pictures, Favicon pictures, CSS files, and JS files are generally called through the two attributes of "href" and "src".

Therefore, the present invention analyzes the source code by grabbing the webpage source code of the URL to be detected, and uses regular expressions to extract the two attributes of "href" and "src" in the code segment that calls resources such as Logo, Favicon, CSS, and JS in the source code. These values are the links to call the corresponding resources, and then the domain names corresponding to the links are obtained. Subsequently, compare the domain name of the link calling the resource in the source code with the domain name of the URL to be detected. If there is a situation different from the domain name of the URL to be detected, it is considered that resources of other brand websites are embedded in the URL, that is, it is determined that there is a brand Counterfeiting possible.

2. In the form of browser plug-ins (capturing DNS query requests)

When the browser loads a web page, it needs to request the server to download resources such as JS, CSS, and Image. During this process, a series of actions such as DNS query, sending request, and redirection will be generated. With reference to Chrome DevTools, a browser plug-in can be developed to monitor the browser's network behavior in real time to capture the network resource query requests initiated by the browser during the process of loading the URL page to be detected, and filter out the JS, CSS, and Images. For category query requests, compare the queried domain name with the domain name of the URL to be detected, and determine whether to initiate a newDomains query request, that is, determine whether there is a possibility of phishing.

3. Build a local DNS recursive server and analyze DNS query request logs.

Build a local DNS recursive server and configure it accordingly so that it can record received DNS query requests. In order to ensure that the DNS query request log completely records the DNS query request initiated by the browser when loading the page, disable the DNS client cache of the computer, and set the DNS client to only use the built local DNS recursive server for DNS query.

In the DNS query request log, information in three fields, query time, user IP, and query domain name, is often recorded, and it is impossible to distinguish the record scope of the DNS query request initiated by the browser when loading a web page. For this reason, the present invention selects a non-existing domain name in advance, and uses the DNS query request record of the domain name as a separate identifier between different web page query request records in the log. Before and after each visit to a URL to be detected, the selected domain name is accessed to ensure that when analyzing the DNS query request log, the URL initiated by the webpage to be detected during the loading process can be accurately and completely obtained DNS query request record.

Use regular expressions to match the DNS query request log to get the DNS query request record initiated by the URL page to be detected. The first line of the record is the domain name query request record of the URL, and the rest are the page calls including but not limited to Logo pictures , Favicon pictures, CSS files, JS files and other resources, and further compare whether the domain names of these associated queries are in the white list to determine whether there is a possibility of counterfeiting.

Another embodiment of the present invention provides a phishing website identification device, as shown in Figure 4, comprising:

A detection unit, configured to detect whether resources of other websites are embedded in the website to be detected;

The first determining unit is configured to determine that the website to be detected is a non-phishing website when no resources of other websites are embedded in the website to be detected;

A whitelist comparison unit, configured to determine whether the domain names of other websites embedded in the website to be detected overlap with the whitelist;

The second determination unit is used to determine that the website to be detected is a non-phishing website when the domain names of the other websites do not overlap with the white list; and when the domain names of the other websites overlap with the white list, determine that the website to be detected is a non-phishing website Highly suspected phishing website;

An evaluation unit, configured to determine the legitimacy and domain name credit evaluation of the highly suspected phishing website;

The third determination unit is configured to determine whether the website to be detected is a phishing website according to the result obtained by the evaluation unit.

The detection unit judges whether the resources of other websites are embedded in the website to be detected by detecting whether the web page source code of the website to be detected is embedded with the resource links of other websites; or, the detection unit is a browser plug-in, and monitors The browser's network behavior captures the network resource query request initiated by the browser during the process of loading the page of the website to be detected, and compares the queried domain name with the domain name of the website to be detected to determine whether to initiate DNS for other domain names Query requests, so as to determine whether resources of other websites are embedded in the website to be detected.

The detection unit can also be a local DNS recursive server set up, which analyzes the DNS query request log to determine whether the browser initiates a DNS query request to other domain names in the process of accessing the website to be detected, thereby judging whether other websites are embedded in the website to be detected Resources.

The above embodiments are only used to illustrate the technical solution of the present invention and not to limit it. Those of ordinary skill in the art can modify or equivalently replace the technical solution of the present invention without departing from the spirit and scope of the present invention. The scope of protection should be determined by the claims.

Claims (11)

1. a kind of fishing website recognition methods, it is characterised in that comprise the following steps：

Detect the resource that other websites whether are embedded in website to be detected；

If not being embedded in the resource of other websites in website to be detected, it is non-fishing website to judge website to be detected；

Whether if having been inserted into the resource of other websites in website to be detected, judge the domain name of other websites has with white list Occur simultaneously；If not occuring simultaneously, it is non-fishing website to judge website to be detected；If there is common factor, judge website to be detected for height Doubtful fishing website；

Validity decision and domain name credit evaluation are carried out to the highly doubtful fishing website, with determine website to be detected whether be Fishing website.

2. the method as described in claim 1, it is characterised in that the money of other websites whether is embedded in website to be detected is detected Before source, judge that the domain name of website to be detected whether in white list, if in white list, directly judges website to be detected For non-fishing website.

3. method as claimed in claim 1 or 2, it is characterised in that in the webpage source code by detecting website to be detected whether Whether initiated to other domain names during the link of the resource of embedded other websites, or detection browser access website to be detected DNS query request, to judge the resource of other websites whether is embedded in website to be detected.

4. method as claimed in claim 3, it is characterised in that by detect webpage source code judge it is whether embedding in website to be detected Entering the method for the resource of other websites is：The webpage source code of website to be detected is captured, is extracted in source code and adjusted using regular expression With the value of the two attributes of href, src in the code segment of resource, the link of respective resources is as called, and then obtains linking institute Corresponding domain name；Then the domain name corresponding to the link of resource will be called in source code compared with the domain name of website to be detected, If in the presence of the domain name different from the domain name of website to be detected, then it is assumed that embedded in the resource of other websites in website to be detected.

5. method as claimed in claim 3, it is characterised in that monitor the network row of browser in real time by browser plug-in For to capture the Internet resources inquiry request initiated during browser is loaded into the page of website to be detected, by what is inquired about Domain name is compared with the domain name of website to be detected, so as to judge whether to initiate to ask the DNS query of other domain names.

6. method as claimed in claim 3, it is characterised in that by building local dns recursion server, and analyze DNS and look into Request Log is ask, judges whether initiate to ask the DNS query of other domain names during browser access website to be detected.

7. method as claimed in claim 6, it is characterised in that cached by disabling computer DNS client, and DNS is objective Family end is arranged to that the local dns recursion server progress DNS query built is used only, to ensure that DNS query Request Log is complete Record browser is loaded into the DNS query request initiated during the page.

8. method as claimed in claim 7, it is characterised in that one domain name being not present of selection, the DNS of the domain name will be looked into Request record is ask as the separation mark between different web pages inquiry request record in DNS query Request Log.

A kind of 9. fishing website identification device, it is characterised in that including：

Detection unit, the resource of other websites whether is embedded in website to be detected for detecting；

First identifying unit, during resource for not being embedded in other websites in website to be detected, judge that website to be detected is Non- fishing website；

White list comparing unit, for judging in website to be detected whether the domain name of other embedded websites with white list has friendship Collection；

Second identifying unit, for when the domain name of other websites is not occured simultaneously with white list, judging that website to be detected is Non- fishing website；And domain name and the white list in other websites be when having common factor, judge website to be detected to be highly doubtful Fishing website；

Assessment unit, for carrying out validity decision and domain name credit evaluation to the highly doubtful fishing website；

3rd identifying unit, for the result obtained according to the assessment unit, judge whether website to be detected is fishing website.

10. device as claimed in claim 9, it is characterised in that the detection unit is by detecting the webpage of website to be detected Whether the link of the resource of other websites is embedded in source code, to judge the resource of other websites whether is embedded in website to be detected； Or the detection unit is a browser plug-in, by monitoring the network behavior of browser in real time, capture browser, which is loaded into, to be treated Detect the Internet resources inquiry request initiated during the page of website, and by the domain name inquired about and the domain of website to be detected Name is compared, to judge whether to initiate to ask the DNS query of other domain names, so as to judge whether be embedded in website to be detected The resource of other websites.

11. device as claimed in claim 9, it is characterised in that the detection unit is local dns recursion server, and it is logical Cross analysis DNS query Request Log and judge whether initiate to look into the DNS of other domain names during browser access website to be detected Request is ask, so as to judge the resource of other websites whether is embedded in website to be detected.