JP4200453B2 - Fraud prevention program and computer-readable storage medium - Google Patents

Description

  The present invention analyzes the accessed web page to determine the risk of the page being fake, and informs the user of that fact, thereby preventing unauthorized access to the fake web page. The present invention relates to a device and a program.

  Electronic commerce, such as contracts and payments, has become popular using networks such as the Internet, and it is common to enter credit card numbers and passwords at the time of transactions. A technique called phishing scam began to appear.

  A phishing scam pretends to be a legitimate e-mail from a company or a financial institution by sending an e-mail containing a fake URL very similar to a real URL (Uniform Resource Locator) of a company or a financial institution to the user. It is a scam in which a legitimate web page of the company or financial institution is guided to a fake web page that imitates it, and personal information such as a user ID, credit card number, or password is entered, and the personal information is exploited. is there.

  Emails and web pages used for phishing scams are ordinary emails and web pages, which do not contain malicious attack codes that use vulnerabilities in the OS or browser, and can be detected by ordinary antivirus software. Can not.

  Businesses, financial institutions, etc. implement genuine guarantees using electronic signatures to prevent phishing scams. In addition, software that clearly indicates whether or not the company's web page is accessed from the web page is downloaded to protect it from phishing scams.

  Conventional software uses a list of correct web page domain names (hereinafter referred to as white list) and a list of domain names of fake web pages (hereinafter referred to as black lists) prepared in advance. To determine whether it is a safe page or not.

In addition, by embedding the first and second programs in the homepage information, when the homepage has been tampered with and the first program has been deleted, it is detected and distributed together with homepage-related information that it is an unauthorized homepage. In addition, there is disclosed a technique capable of preventing the occurrence of a spoofing site and obtaining information on the spoofing site by distributing information even if a spoofing site appears (see, for example, Patent Document 1). ).
JP 2002-222286 A

  However, the digital signature or software guarantee guarantees that the correct home page is accessed, and cannot be guaranteed except for the page. If the user is guided to a fake page, there is no guarantee such as an electronic signature, and there is no software to protect, the user ID, credit card number, There is a problem that the probability of encountering fraud increases because passwords and personal information are entered.

  Also, the period during which a fake web page exists is usually short and may not be blacklisted. In this case, the user enters information without noticing that the fake web page is flawed, There was a problem of encountering.

  The present invention has been made in view of the above circumstances, and the problem of the present invention is that not only a web page registered as a fake page in advance by examining a web page accessed by a user, but also an unregistered one. It is another object of the present invention to provide a fraud prevention apparatus and program capable of judging the risk of a fake web page and preventing access to the fake web page.

The fraud prevention program for browser software according to one aspect of the present invention is displayed at the stage of connecting to a genuine or fake server 205 or 206 via the Internet network 207 and displaying the accessed web page on the web page display unit 301. record the HTML source of the web page in HTML storage section 302, a step of counting by the link counter 305 the number of link specification that is described read the HTML source from the HTML storage section 302, included in the link specified destination URL of the domain name, links and procedures for counting by the inspection counter 306 the number of domain name that matches the domain name in the whitelist regular domain name has been registered in advance in the storage unit 405, the count value of the test counter 306 settings number divided by the count value of the counter 305 reaches a predetermined When is large, to a procedure for displaying a warning by the warning display unit 307 in place of the web page display unit 301, that causes a computer to execute the 201 and gist.

Further, the fraud prevention program for browser software according to one aspect of the present invention is displayed at the stage of connecting to a genuine or fake server 205 or 206 via the Internet network 207 and displaying the accessed web page on the web page display unit 301. The HTML source of the web page is recorded in the HTML storage unit 302, the HTML source is read from the HTML storage unit 302, the number of link designations described is counted by the link counter 305, and authentication is performed via the Internet network 207. Among the domain names included in the link designation link destination URL connected to the station 202, the domain name whose regular domain name matches the domain name in the white list 203 registered in the storage unit 505 of the certificate authority 202 in advance. The procedure of counting the number by the inspection counter 306 and the inspection counter 30 When the number obtained by dividing the count value by the count value of the link counter 305 is larger than a predetermined set value, a procedure for displaying a warning at a predetermined location on the web page display unit 301 by the warning display unit 307. The gist is that it is executed by the computer 201 .

The computer-readable storage medium of the present invention is connected to the computer 201 via the Internet network 207 to the authentic or fake servers 205 and 206 and displays the accessed web page on the web page display unit 301. The procedure of recording the HTML source of the displayed web page in the HTML storage unit 302, reading the HTML source from the HTML storage unit 302, and counting the number of link designations described by the link counter 305, and the link destination of the link designation Among the domain names included in the URL, the procedure for counting the number of domain names whose regular domain names match the domain names in the white list registered in the storage unit 405 in advance by the inspection counter 306, The number divided by the count value of the link counter 305 is a predetermined number. And recording a browser software fraud prevention program for causing the warning display unit 307 to display a warning at a predetermined location on the web page display unit 301 when the set value is larger than the set value. And

The computer-readable storage medium of the present invention is connected to the computer 201 via the Internet network 207 to the authentic or fake servers 205 and 206 and displays the accessed web page on the web page display unit 301. The HTML source of the displayed web page is recorded in the HTML storage unit 302, the HTML source is read from the HTML storage unit 302, the number of link designations described is counted by the link counter 305, and the Internet network 207 is used. The domain whose legitimate domain name matches the domain name in the white list 203 registered in advance in the storage unit 505 of the certificate authority 202 among the domain names included in the link destination URL specified by the link. A procedure for counting the number of names by the examination counter 306; When the number obtained by dividing the count value of the inspection counter 306 by the count value of the link counter 305 is larger than a predetermined set value, the warning display unit 307 displays a warning at a predetermined location on the web page display unit 301. And a browser software fraud prevention program for executing the procedure .

  According to the present invention, the user can know the danger that the accessed web page is likely to be fake, and will not inadvertently input personal information such as a user ID, credit card number, password, etc. , The possibility of encountering damage such as phishing scams is reduced.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
Usually, a fake web page used for phishing scams or the like only creates a part of a login screen necessary for obtaining personal information of the user, and the other part is often linked to a regular web page. The present invention pays attention to this point, and determines the possibility that the accessed web page is false by the following processing.

  First, it is checked whether or not a legitimate domain name registered in advance is included in the link destination URL specified in the HTML (HyperText Markup Language) source of the web page accessed by the user. Next, the number of URLs of link destinations including registered regular domain names is divided by the number of link designations in the HTML source, and the value is compared with a predetermined set value. If the value obtained by the above method is larger than a preset value, the web page is determined to have a high possibility of a fake web page because it is linked to many legitimate web pages. Warn the user.

FIG. 1 is a diagram for explaining an outline of an embodiment of the present invention.
Check whether each URL in the URL list 101 of the link destination included in the HTML source of the web page accessed by the user includes a regular domain name registered in advance in the certificate authority. The ratio of the number of the URL 102 including the registered regular domain name to the six URLs in the link destination URL list 101 included in the HTML source is calculated. In the case of FIG. co. jp is a regular domain name registered in the white list 203 of the certificate authority 202, and there are four URLs 102 including the regular domain names registered in the white list 203 of the certificate authority 202. Therefore, the ratio is 4 ÷. 6 is 66.7%. A more detailed procedure will be described below using the flowchart of FIG.

FIG. 2 is a block diagram illustrating a configuration of the entire system according to the embodiment of this invention.
The user terminal 201 is connected to a certificate authority 202 having a white list 203 and a black list 204 via the Internet network 207. Further, a genuine server 205 having a regular web page and a fake server 206 having a fake web page are also connected to the user terminal 201 and the certificate authority 202 via the Internet 207.

FIG. 3 is a block diagram showing functions in the embodiment of the present invention.
The user terminal 201 includes a web page display unit 301, an HTML recording unit 302, a link notation search unit 303, a domain name comparison unit 304, a link counter 305, an examination counter 306, and a warning display unit 307. 203 and a black list 204.

  The web page display unit 301 displays the accessed web page, and the HTML recording unit 302 reads and records the HTML source of the page displayed by the web page display unit 301.

  The link notation search unit 303 searches the HTML source of the page displayed by the web page display unit 301 and recorded by the HTML recording unit 302 for a line including a link designation to another web page.

  The domain name comparison unit 304 compares the domain name included in the link destination URL with the domain name registered in the white list 203, and determines whether the domain name included in the link destination URL is included in the white list 203. Determine whether.

Link counter 305 is a counter for counting the number of links, the inspection counter 306 is a counter that counts the number of link destination URL included in the whitelist 203.

The warning display unit 307 displays a warning that the accessed web page is likely to be a fake page.
FIG. 4 is a hardware configuration diagram of the user terminal according to the embodiment of this invention.

  In the embodiment of the present invention, for example, a personal computer is used. A user terminal 201 includes a CPU (Central Processing Unit) 401, a program 402 for executing a fraud prevention process described later, and a memory 402 that stores a control program for controlling and executing each function of the user terminal 201. An input unit 403 for inputting various information, an output unit 404 for outputting various information, a storage unit 405 for storing various information, a recording medium driving unit 406 for driving an external recording medium, and a LAN or Internet network 207 A network connection unit 407 is configured to be connected to the bus 400, and the CPU 401 controls these units.

FIG. 5 is a hardware configuration diagram of the certificate authority according to the embodiment of this invention.
The certificate authority 202 includes a CPU 501, a memory 502, an input unit 503, an output unit 504, a storage unit 505 including a white list 203 and a black list 204, a recording medium driving unit 506, and a network connection unit 507 connected to a bus 500. The CPU 501 controls these units.

FIG. 6 is a diagram illustrating an example of a white list according to the embodiment of this invention.
In FIG. 6, “xxx.co.jp”, “xxxcorp.com”, “xxxnet.co.jp”, and the like are registered as domain names of regular web pages.

FIG. 7 is a diagram illustrating an example of a black list according to the embodiment of this invention.
In FIG. 7, “○○○ .co.jp”, “○ _ ○ corp.com”, “XXmet.co.jp”, etc. are registered as domain names of fake web pages, and at first glance. The domain name is indistinguishable from the domain name of the regular web page shown in FIG.

The white list 203 and the black list 204 are registered by the provider of the certificate authority 202, but can be registered by the user.
In the embodiment of the present invention, a program for implementing the present invention is provided as a plug-in for browser software, and the user installs the plug-in in the user terminal 201 in advance.

Next, the flow of fraud prevention processing when a user accesses a certain web page will be described.
FIG. 8 is a flowchart showing the flow of fraud prevention processing according to the embodiment of the present invention, FIG. 9 shows an example of the HTML source of the embodiment of the present invention, and FIG. 10 shows the implementation of the present invention. It is a figure which shows the example of the warning display of the form.

First, in step 801 in FIG. 8, it is determined whether the domain name of the accessed web page is included in the white list 203.
If it is determined that the web page is included in the white list 203 (step 801: YES), since the web page is a regular web page, a logo corresponding to the white list 203 is acquired from the certificate authority 202 in step 802. In step 803, the user is informed that it is safe by displaying the acquired logo at a predetermined position of the browser, and the process ends.

  If it is determined that the domain name of the accessed web page is not included in the white list 203 (step 801: NO), it is determined in step 804 whether the domain name of the accessed web page is included in the black list 204. To do.

  If it is determined that the web page is included in the black list 204 (step 804: YES), the web page is a fake web page, so in step 805, a warning is displayed on the browser to alert the user, or other Transfer to a secure web page and finish the process.

  When it is determined that the domain name of the accessed web page is not included in the black list 204, that is, when an unknown page that is not registered in the white list 203 or the black list 204 is accessed (step 804: NO) The risk of the page is judged by the following procedure.

First, in step 806, the HTML source of the page accessed at the stage of displaying the page is read and recorded in the HTML recording unit 302.
In step 807, the values of the check counter, link counter, and row counter are initialized (in this embodiment, zero).

In step 808, the value of the row counter that designates the row to be read in step 809 is incremented by one.
In step 809, one line of the HTML source having the line number designated by the line counter is read out.

In step 810, it is determined whether the link designation is included in one line read in step 809.
If it is determined that the link specification is not included (step 810: NO), for example, if the link specification is not included as in the first line of the HTML source example shown in FIG. Proceed to 815.

  On the other hand, when it is determined that the link designation is included (step 810: YES), for example, when the link designation is included as in the 21st line of the example of the HTML source shown in FIG. The link counter value for checking the number of link designations in the HTML source is incremented by 1. In step 812, the domain name included in the link destination URL (for example, URL 901 in FIG. 9) is the certificate authority 202. The certificate authority 202 is inquired whether it is included in the white list 203. It is also possible to branch depending on whether the URL description of the link destination is an absolute path or a relative path. In this case, a branching procedure is inserted before the step 811, and if the description of the URL of the link destination is an absolute path, If it is a relative path, the process proceeds to step 815.

  An absolute path is a URL that is described from the beginning, such as URL 901, and a relative path is a link that specifies the position of a link destination with reference to the position of the link source. In the case of a relative path, the URL of the link destination Is described as “./page1/” and does not include the domain name.

  In step 813, it is determined whether the domain name included in the link destination URL (for example, URL 901 in FIG. 9) is included in the white list 203 of the certificate authority 202.

  If it is determined that the link destination URL is not included in the white list 203 (step 813: NO), the process proceeds to step 815 without doing anything. On the other hand, if it is determined that it is included in the white list 203 (step 813: YES), the value of the inspection counter is incremented by 1 in step 814.

  In step 815, it is determined whether or not the one line read in step 809 is the last line of the HTML source read in step 806. If it is not the last line (step 815: NO), the process returns to step 808. Read the next line and repeat the steps to determine if it contains a link designation and if so, whether it contains a registered domain name.

  On the other hand, if the one line read in step 809 is the last line of the HTML source read in step 806 (step 815), the determination as to whether the link designation is included and the determination as to whether it includes the registered domain name are completed. So go to step 816.

  In step 816, the inspection counter incremented in step 814 is divided by the link counter incremented in step 811 (inspection counter / link counter is calculated).

In step 817, the value divided in step 816 (inspection counter / link counter value) is compared with a predetermined set value (for example, 80%).
If it is determined in step 817 that the value of the inspection counter / link counter is larger than the set value (step S817: YES), that is, the link destination in the HTML source read in step 806 is registered in the white list 203. If there is a large percentage of links to the domain name page, it is likely that the accessed web page is a fake page, and in step 818, a warning display 1001 like the example shown in FIG. Display in place. On the other hand, if it is equal to or smaller than the predetermined value, the process proceeds to step 819.

Next, in step 819, it is determined whether the value of the link counter is a predetermined number (for example, 3) or more.
If it is determined in step 819 that the number is less than the predetermined number (step 819: NO), that is, if the number of links in the HTML source read in step 806 is small, in step 820, for example, “There is a suspicion of a fake site. A message such as “Caution” because the amount of information is so small that it cannot be determined is displayed at a predetermined location on the browser.

  Although the embodiments of the present invention have been described with reference to the drawings, the present invention can also have a white list and black list similar to the white list 203 and black list 204 in the user terminal 201. is there.

  In that case, the white list and the black list similar to the white list 203 and the black list 204 in FIGS. 1, 2 and 3 are also held in the user terminal 201, and the hardware configuration diagram of the user terminal 201 is shown in FIG. The storage unit 405 has a white list and a black list. Then, the process is executed according to the flowchart of FIG. 8 as in the above embodiment, but the white list of the certificate authority 202 is determined whether it is included in the white list 203 or the black list 204 in steps 801, 804 and 812. 203 and the black list 204 and the white list and black list of the user terminal 201 are performed.

  Further, the present invention compares the HTML source of the accessed page with the HTML source of the web page of the domain name included in the link destination URL included in the HTML source for determining whether the web page is a fake web page. It is also possible to calculate whether or not the web page is a fake web page.

  The fake web page established in the fake server 206 is not only opened by a person (scammers) who want to exploit the user's personal information, but also by another third party not owned by the scammers. The present invention can be applied even when the root authority of a person's server is illegally acquired and opened.

  The embodiment to which the present invention is applied has been described above. However, the user terminal to which the present invention is applied is not limited to the above-described embodiment, as long as the function is executed. Needless to say, it may be a device, a system composed of a plurality of devices, an integrated device, or a system that performs processing via a network such as a LAN or a WAN.

  That is, the present invention is not limited to the embodiments described above, and various configurations can be taken without departing from the scope of the present invention.

It is a figure for demonstrating the outline | summary of embodiment of this invention. It is a block diagram which shows the structure of the whole system of embodiment of this invention. It is a block diagram which shows the function in embodiment of this invention. It is a hardware block diagram of the user terminal of embodiment of this invention. It is a hardware block diagram of the certification authority of the embodiment of the present invention. It is a figure which shows the example of the white list of embodiment of this invention. It is a figure which shows the example of the black list of embodiment of this invention. It is a flowchart which shows the flow of the fraud prevention process of embodiment of this invention. It is an example of the HTML source of the embodiment of the present invention. It is a figure which shows the example of the warning display of embodiment of this invention.

Explanation of symbols

101 URL list 102 URL
201 User terminal 202 Certificate authority 203 White list 204 Black list 205 Authentic server 206 Fake server 207 Internet network 301 Web page display unit 302 HTML recording unit 303 Link notation search unit 304 Domain name comparison unit 305 Link counter 306 Inspection counter 307 Warning display unit 400, 500 Bus 401, 501 CPU
402, 502 Memory 403, 503 Input unit 404, 504 Output unit 405, 505 Storage unit 406, 506 Recording medium drive unit 407, 507 Network connection unit 901 URL
1001 Warning display

Claims (5)

At the stage of connecting to a genuine or fake server via the Internet network and displaying the accessed web page on the web page display unit, the HTML source of the displayed web page is recorded in the HTML storage unit, and the HTML storage unit stores the HTML source from the HTML storage unit. a step of counting the number of link specification that is read the HTML source described by the link counter,
A procedure for counting the number of domain names that match the domain names in the white list whose regular domain names are registered in advance in the storage unit among the domain names included in the link-designated link destination URL by an inspection counter ;
If the number obtained by dividing the count value of the link counter a count value of said test counter is greater than a predetermined set value, the warning display unit to the procedure displays a warning in place of the web page display unit ,
An anti-fraud program for browser software that allows a computer to execute An HTML source of a web page displayed at the stage of connecting to a genuine or fake server via the Internet network and displaying the accessed web page on the web page display unit is recorded in the HTML storage unit, and the HTML storage unit stores the HTML source from the HTML storage unit. A procedure for reading the source and counting the number of specified links specified by the link counter;
Connect to the certificate authority via the Internet, and out of the domain names included in the link destination URL specified by the link, the regular domain name matches the domain name in the white list previously registered in the storage part of the certificate authority A procedure for counting the number of domain names to be checked by a check counter;
A procedure for displaying a warning at a predetermined location on the web page display unit when the number obtained by dividing the count value of the inspection counter by the count value of the link counter is larger than a predetermined set value; ,
An anti-fraud program for browser software that allows a computer to execute The computer according to claim 1 or 2, further comprising a step of causing the computer to execute a procedure for displaying a message indicating that the warning credibility is low when the number obtained by dividing the count value of the inspection counter by the count value of the link counter is less than a predetermined number. The browser software fraud prevention program described. At the stage where the computer is connected to a genuine or fake server via the Internet network and the accessed web page is displayed on the web page display unit, the HTML source of the displayed web page is recorded in the HTML storage unit, and this HTML storage A procedure for counting the number of link designations described by reading out the HTML source from the link counter and a domain name included in the link destination URL of the link designation is registered in advance in the storage unit. The number of domain names that match the domain names in the white list is counted by the check counter, and the number obtained by dividing the count value of the check counter by the count value of the link counter is greater than a predetermined set value. In such a case, the warning display unit displays a warning at a predetermined location on the web page display unit. Computer readable storage medium storing a fraud prevention program browser software for, to execution. At the stage where the computer is connected to a genuine or fake server via the Internet network and the accessed web page is displayed on the web page display unit, the HTML source of the displayed web page is recorded in the HTML storage unit, and this HTML storage A procedure for counting the number of link designations described by reading the HTML source from the link section, and connecting to a certificate authority via the Internet network, and among the domain names included in the link designation URL of the link designation, The procedure of counting the number of domain names whose regular domain names match the domain names in the white list previously registered in the storage unit of the certificate authority by the check counter, and the count value of the check counter When the number divided by the count value is larger than the preset value, the warning display Computer readable storage medium storing a fraud prevention program browser software for executing a procedure for displaying the tell in place of the web page display unit.

Images