Fake web addresses and hyperlinks

• US 20060080437A1
• Filed: 10/13/2004
• Published: 04/13/2006
• Est. Priority Date: 10/13/2004
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Lake, John Michael
• Granted Patent: US 8,799,465 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: G06F 16/9558 Details of hyperlinks; Management of linked annotations
• CPC Class Codes: G06F 16/9566 URL specific, e.g. using aliases, detecting broken or misspelled links
• CPC Class Codes: H04L 2101/30 Types of network names
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 61/302 Administrative registration, e.g. for domain names at internet corporation for assigned names and numbers [ICANN]
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A destination address is processed to determine if the destination address is a fake web address or hyperlink. The destination address may be compared with a database of known domain names to see if the domain name is legitimate or illegitimate. The designation address may also be compared to other domain names to see if it is an honest or dishonest transformation of the other domain names. Appropriate action may be taken if the designation address is a dishonest transformation of another domain name.

Claims

1. A method of processing a destination address, the method comprising:

determining if the destination address is a valid address by comparing the destination address with at least one known destination address; and

performing a first function in response to the determination.

2. The method of claim 1, wherein determining if the destination address is a valid address by comparing the destination address with at least one known destination address comprises determining if the destination address is a honest transformation of the at least one known destination address.

3. The method of claim 1, wherein the at least one known destination address is one of a plurality of known legitimate destination addresses.

4. The method of claim 3, wherein performing a first function in response to the determination comprises at least one of issuing a warning or blocking access to the destination address in response to the determination that the destination address is not part of the plurality of known legitimate destination addresses.

5. The method of claim 1, wherein the at least one known destination addresses is one of a plurality of known illegitimate destination addresses.

6. The method of claim 5, wherein performing a first function in response to the determination comprises at least one of issuing a warning or blocking access to the destination address in response to the determination that the destination address is part of the plurality of known illegitimate destination addresses.

7. The method of claim 1, wherein the destination address is a domain name.

8. The method of claim 1, wherein the destination address is an IP address.

9. The method of claim 8, wherein determining if the destination address is a valid address by comparing the destination address with at least one known destination address comprises comparing the destination address with a plurality of known IP addresses and where performing a first function in response to the determination comprises at least one of issuing a warning or blocking access to the destination address in response to the determination that the destination address is part of the plurality of known IP addresses.

10. The method of claim 1, wherein the destination address is an IP address and wherein determining if the destination address is a valid address by comparing the destination address with at least one known destination address comprises performing a reverse lookup of the IP address to determine the domain name of the IP address and comparing the domain name with at least one known domain name.

11. The method of claim 10, wherein comparing the domain name with at least one known domain name comprises determining if the domain name is a dishonest transformation of the at least one known domain name.

12. The method of claim 11, wherein the dishonest transformation comprises visual confusion.

13. The method of claim 12, wherein the visual confusion comprises alphanumeric to alphanumeric visual confusion.

14. The method of claim 12, wherein the visual confusion comprises at least one of a substitution of the letter L with the number one, the number one with the letter L, the letter O with the number zero, the number zero with the letter O, the letter o with the number zero, the number zero with the letter o, the letter B with the number eight, the number eight with the letter B, the letter S with the number eight, the number eight with the letter S, the letter E with the number eight, the number eight with the letter E, the letter E with the number three, the number three with the letter E, the letter F with the number seven, the number seven with the letter F, the letter I with number one, the number one with the letter I, the letter i with the number 1, the number 1 with the letter i, the letter m with the letter n and the letter n with the letter m.

15. The method of claim 11, wherein the dishonest transformation comprises a substitution of the top-level domain.

16. The method of claim 11, wherein determining if the domain name is a dishonest transformation of the at least one known domain name comprises determining if s similarity value between the domain name and the at least one known domain name exceeds a predetermined value.

17. The method of claim 16, wherein the similarity value is determined based on the longest common subsequence between the domain name and the at least one known domain name.

18. The method of claim 1, wherein the destination address is a destination address of a hyperlink having display text and wherein determining if the destination address is a valid address by comparing the destination address with at least one known destination address comprises comparing the destination address of the hyperlink with the display text of the hyperlink.

19. The method of claim 18, wherein comparing the destination address of the hyperlink with the display text of the hyperlink comprises determining if the destination address is a dishonest transformation of the display text.

20. The method of claim 19, wherein the dishonest transformation comprises visual confusion.

21. The method of claim 19, wherein the dishonest transformation comprises a substitution of the top-level domain.

22. The method of claim 19, wherein determining if the destination address is a dishonest transformation of the display text comprises determining if a similarity value between the domain name and the display text exceeds a predetermined value.

23. The method of claim 22, wherein the similarity value is determined based on the longest common subsequence between the domain name and the display text.

24. The method of claim 1, wherein the first function comprises one of issuing a warning or blocking access to the destination address in response to the determination that the destination address is a dishonest transformation of the displayed text.

25. The method of claim 1, wherein the destination address is an IP address and wherein determining if the destination address is a valid address by comparing the destination address with at least one known destination address comprises determining if the IP address comprises at least one IP address associated with the at least one known destination address.

26. The method of claim 1, wherein determining if the destination address is a valid address by comparing the destination address with at least one known destination address comprises determining if the destination address is a dishonest transformation of the at least one known destination addresses.

27. The method of claim 26, wherein the at least one known address is part of a plurality of known addresses and wherein performing a first function in response to the determination comprises adding the destination address to the plurality of known addresses in response to the determination that the destination address is an honest transformation of the at least one known address.

28. The method of claim 26, wherein the at least one known address is part of a plurality of known addresses and further comprising storing the plurality of known addresses remotely.

29. The method of claim 26, wherein the at least one known address is part of a plurality of known addresses and further comprising storing the plurality of known addresses locally.

30. A method of registering a domain name, the method comprising:

comparing the domain name with a plurality of known names;

determining if the domain name is a dishonest transformation of any of the plurality of known names; and

allowing the domain name to be registered if the domain name is not a dishonest transformation of any of the plurality of known names.

31. The method of claim 30, wherein the plurality of known names is a database of trademarks and service marks.

32. The method of claim 30, wherein the plurality of known names is a database of registered domain names.

33. The method of claim 30, wherein the dishonest transformation comprises visual confusion.

34. The method of claim 33, wherein the visual confusion comprises alphanumeric to alphanumeric visual confusion.

35. The method of claim 33, wherein the visual confusion comprises at least one of a substitution of the letter L with the number one, the number one with the letter L, the letter O with the number zero, the number zero with the letter O, the letter o with the number zero, the number zero with the letter o, the letter B with the number eight, the number eight with the letter B, the letter S with the number eight, the number eight with the letter S, the letter E with the number eight, the number eight with the letter E, the letter E with the number three, the number three with the letter E, the letter F with the number seven, the number seven with the letter F, the letter I with number one, the number one with the letter I, the letter i with the number 1, the number 1 with the letter i, the letter m with the letter n and the letter n with the letter m.

36. The method of claim 30, wherein the dishonest transformation comprises a substitution of the top-level domain.

37. The method of claim 30, wherein determining if the domain name is a dishonest transformation of any of the plurality of known names comprises determining if a similarity value between the domain name and any of the plurality of known names exceeds a predetermined value.

38. The method of claim 37, wherein the similarity value is determined based on the longest common subsequence between the domain name and the plurality of known domain names.

39. A method of identifying dishonest domain name transformations, the method comprising:

comparing a domain name with at least one known name; and

determining if the domain name comprises visual confusion with the at least one known name.

40. The method of claim 39, wherein the visual confusion comprises alphanumeric to alphanumeric visual confusion.

41. The method of claim 39, wherein the visual confusion comprises at least one of a substitution of the letter L with the number one, the number one with the letter L, the letter O with the number zero, the number zero with the letter O, the letter o with the number zero, the number zero with the letter o, the letter B with the number eight, the number eight with the letter B, the letter S with the number eight, the number eight with the letter S, the letter E with the number eight, the number eight with the letter E, the letter E with the number three, the number three with the letter E, the letter F with the number seven, the number seven with the letter F, the letter I with number one, the number one with the letter I, the letter i with the number 1, the number 1 with the letter i, the letter m with the letter n and the letter n with the letter m.

42. The method of claim 39, wherein the at least one name is selected from a database of trademarks and service marks.

43. The method of claim 39, wherein the at least one name is selected from a database of registered domain names.

44. The method of claim 39, wherein the at least one name comprises a display name associated with the domain name.

45. A computer program product for processing destination addresses, the computer program product comprising:

a computer readable medium having computer readable program code embodied therein, the computer readable program code comprising;

computer readable program code configured to determine if the destination address is a valid address by comparing the destination address with at least one known destination address; and

computer readable program code configured to perform a first function in response to the determination.

46. The computer program product of claim 45, wherein the computer readable program code configured to determine if the destination address is a valid address by comparing the destination address with at least one known destination address comprises computer readable program code configured to determine if the destination address is a honest transformation of the at least one known destination address.

47. The computer program product of claim 45, wherein the at least one known destination address is one of a plurality of known legitimate destination addresses.

48. The computer program product of claim 45, wherein the at least one known destination addresses is one of a plurality of known illegitimate destination addresses.

49. The computer program product of claim 45, wherein the destination address is a domain name.

50. The computer program product of claim 45, wherein the destination address is an IP address.

51. The computer program product of claim 45, wherein the destination address is an IP address and wherein the computer readable program code configured to determine if the destination address is a valid address by comparing the destination address with at least one known destination address comprises computer readable program code configured to perform a reverse lookup of the IP address to determine the domain name of the IP address and computer readable program code configured to compare the domain name with at least one known domain name.

52. The computer program product of claim 51, wherein the computer readable program code configured to compare the domain name with at least one known domain name comprises computer readable program code configured to determine if the domain name is a dishonest transformation of the at least one known domain name.

53. The computer program product of claim 52, wherein the dishonest transformation comprises visual confusion.

54. The computer program product of claim 53, wherein the visual confusion comprises alphanumeric to alphanumeric visual confusion.

55. The computer program product of claim 53, wherein the visual confusion comprises at least one of a substitution of the letter L with the number one, the number one with the letter L, the letter O with the number zero, the number zero with the letter O, the letter o with the number zero, the number zero with the letter o, the letter B with the number eight, the number eight with the letter B, the letter S with the number eight, the number eight with the letter S, the letter E with the number eight, the number eight with the letter E, the letter E with the number three, the number three with the letter E, the letter F with the number seven, the number seven with the letter F, the letter I with number one, the number one with the letter I, the letter i with the number 1, the number 1 with the letter i, the letter m with the letter n and the letter n with the letter m.

56. The computer program product of claim 52, wherein the dishonest transformation comprises a substitution of the top-level domain.

57. The computer program product of claim 52, wherein the computer readable program code configured to determine if the domain name is a dishonest transformation of the at least one known domain name comprises computer readable program code configured to determine if a similarity value between the domain name and the at least one known domain name exceeds a predetermined percentage.

58. The computer program product of claim 57, wherein the similarity value is determined based on the longest common subsequence between the domain name and the at least one known domain name.

59. The computer program product of claim 45, wherein the destination address is a destination address of a hyperlink having display text and wherein the computer readable program code configured to determine if the destination address is a valid address by comparing the destination address with at least one known destination address comprises computer readable program code configured to compare the destination address of the hyperlink with the display text of the hyperlink.

60. The computer program product of claim 59, wherein the computer readable program code configured to compare the destination address of the hyperlink with the display text of the hyperlink comprises computer readable program code configured to determine if the destination address is a dishonest transformation of the display text.

61. The computer program product of claim 60, wherein the dishonest transformation comprises visual confusion.

62. The computer program product of claim 60, wherein the dishonest transformation comprises a substitution of the top-level domain.

63. The computer program product of claim 60, wherein the computer readable program code configured to determine if the destination address is a dishonest transformation of the display text comprises computer readable program code configured to determine if a similarity value between the domain name and the display text exceeds a predetermined percentage.

64. The computer program product of claim 63, wherein the similarity value is determined based on the longest common subsequence between the domain name and the at display text.

65. The computer program product of claim 45, wherein the destination address is an IP address and wherein the computer readable program code configured to determine if the destination address is a valid address by comparing the destination address with at least one known destination address comprises computer readable program code configured to determine if the IP address is in a range of IP addresses associated with at least one of the plurality of known destination addresses.

66. The computer program product of claim 45, wherein the computer readable program code configured to determine if the destination address is a valid address by comparing the destination address with at least one known destination address comprises computer readable program code configured to determine if the destination address is a dishonest transformation of the at least one known destination addresses.

67. The computer program product of claim 66, wherein the at least one known address is part of a plurality of known addresses and wherein the computer readable program code configured to perform a first function in response to the determination comprises computer readable program code configured to add the destination address to the plurality of known addresses in response to the determination that the destination address is an honest transformation of the at least one known address.

68. The computer program product of claim 66, wherein the at least one known address is part of a plurality of known addresses and further comprising computer readable program code configured to store the plurality of known addresses remotely.

69. The computer program product of claim 66, wherein the at least one known address is part of a plurality of known addresses and further comprising computer readable program code configured to store the plurality of known addresses locally.

70. A computer program product for registering a domain name, the computer program product comprising:

a computer readable medium having computer readable program code embodied therein, the computer readable program code comprising;

computer readable program code configured to compare the domain name with a plurality of known names;

computer readable program code configured to determine if the domain name is a dishonest transformation of any of the plurality of known names; and

computer readable program code configured to allow the domain name to be registered if the domain name is not a dishonest transformation of any of the plurality of known names.

71. The computer program product of claim 70, wherein the plurality of known names is a database of trademarks and service marks.

72. The computer program product of claim 70, wherein the plurality of known names is a database of registered domain names.

73. The computer program product of claim 70, wherein the dishonest transformation comprises visual confusion.

74. The computer program product of claim 73, wherein the visual confusion comprises alphanumeric to alphanumeric visual confusion.

75. The computer program product of claim 73, wherein the visual confusion comprises at least one of a substitution of the letter L with the number one, the number one with the letter L, the letter O with the number zero, the number zero with the letter O, the letter o with the number zero, the number zero with the letter o, the letter B with the number eight, the number eight with the letter B, the letter S with the number eight, the number eight with the letter S, the letter E with the number eight, the number eight with the letter E, the letter E with the number three, the number three with the letter E, the letter F with the number seven, the number seven with the letter F, the letter I with number one, the number one with the letter I, the letter i with the number 1, the number 1 with the letter i, the letter m with the letter n and the letter n with the letter m.

76. The computer program product of claim 70, wherein the dishonest transformation comprises a substitution of the top-level domain.

77. The computer program product of claim 70, wherein the computer readable program code configured to determine if the domain name is a dishonest transformation of any of the plurality of known names comprises computer readable program code configured to determine if a similarity value between the domain name and any of the plurality of known names exceeds a predetermined value.

78. The computer program product of claim 77, wherein the similarity value is determined based on the longest common subsequence between the domain name and the plurality of known domain names.

79. The computer program product of claim 78, wherein the visual confusion comprises alphanumeric to alphanumeric visual confusion.

80. The computer program product of claim 78, wherein the visual confusion comprises at least one of a substitution of the letter L with the number one, the number one with the letter L, the letter O with the number zero, the number zero with the letter O, the letter o with the number zero, the number zero with the letter o, the letter B with the number eight, the number eight with the letter B, the letter S with the number eight, the number eight with the letter S, the letter E with the number eight, the number eight with the letter E, the letter E with the number three, the number three with the letter E, the letter F with the number seven, the number seven with the letter F, the letter I with number one, the number one with the letter I, the letter i with the number 1, the number 1 with the letter i, the letter m with the letter n and the letter n with the letter m.

81. The computer program product of claim 78, wherein the at least one name is selected from a database of trademarks and service marks.

82. The computer program product of claim 78, wherein the at least one name is selected from a database of registered domain names.

83. The computer program product of claim 78, wherein the at least one name comprises a display name associated with the domain name.

78-1. A computer program product for identifying dishonest domain name transformations, the computer program product comprising:

a computer readable medium having computer readable program code embodied therein, the computer readable program code comprising;

computer readable program code configured to compare a domain name with at least one known name; and

computer readable program code configured to determine if the domain name comprises visual confusion with the at least one known name.

84. A system comprising:

a first module configured to determine if a destination address is a valid address by comparing the destination address with at least one known destination address; and

a second module configured to perform a first function in response to the determination.

85. The system of claim 84, wherein the first module is configured to determine if the destination address is a honest transformation of the at least one known destination address

86. The system of claim 84, wherein the at least one known destination address is one of a plurality of known legitimate destination addresses.

87. The system of claim 84, wherein the at least one known destination addresses is one of a plurality of known illegitimate destination addresses.

88. The system of claim 84, wherein the destination address is a domain name.

89. The system of claim 84, wherein the destination address is an IP address.

90. The system of claim 84, wherein the destination address is an IP address and wherein the first module is configured to perform a reverse lookup of the IP address to determine the domain name of the IP address and compare the domain name with at least one known domain name.

91. The system of claim 90, wherein the first module is configured to determine if the domain name is a dishonest transformation of the at least one known domain name.

92. The system of claim 91, wherein the dishonest transformation comprises visual confusion.

93. The system of claim 92, wherein the visual confusion comprises alphanumeric to alphanumeric visual confusion.

94. The system of claim 93, wherein the visual confusion comprises at least one of a substitution of the letter L with the number one, the number one with the letter L, the letter O with the number zero, the number zero with the letter O, the letter o with the number zero, the number zero with the letter o, the letter B with the number eight, the number eight with the letter B, the letter S with the number eight, the number eight with the letter S, the letter E with the number eight, the number eight with the letter E, the letter E with the number three, the number three with the letter E, the letter F with the number seven, the number seven with the letter F, the letter I with number one, the number one with the letter I, the letter i with the number 1, the number 1 with the letter i, the letter m with the letter n and the letter n with the letter m.

95. The system of claim 91, wherein the dishonest transformation comprises a substitution of the top-level domain.

96. The system of claim 91, wherein the first module is configured to determine if a similarity value between the domain name and the at least one known domain name exceeds a predetermined value.

97. The system of claim 96, wherein the similarity value is determined based on the longest common subsequence between the domain name and the at least one known domain name.

98. The system of claim 84, wherein the destination address is a destination address of a hyperlink having display text and wherein the first module is configured to compare the destination address of the hyperlink with the display text of the hyperlink.

99. The system of claim 98, wherein the first module is configured to determine if the destination address is a dishonest transformation of the display text.

100. The system of claim 99, wherein the dishonest transformation comprises visual confusion.

101. The system of claim 98, wherein the dishonest transformation comprises a substitution of the top-level domain.

102. The system of claim 98, wherein the first module is configured to determine if a similarity value between the domain name and the display name exceeds a predetermined value.

103. The system of claim 102, wherein the similarity value is determined based on the longest common subsequence between the domain name and the display name.

104. The system of claim 84, wherein the destination address is an IP address and wherein the first module is configured to determine if the IP address is in a range of IP addresses associated with at least one of the plurality of known destination addresses.

105. The system of claim 84, wherein the first module is configured to determine if the destination address is a dishonest transformation of the at least one known destination addresses.

106. The system of claim 105, wherein the at least one known address is part of a plurality of known addresses and wherein the second module is configured to add the destination address to the plurality of known addresses in response to the determination that the destination address is an honest transformation of the at least one known address.

107. The system of claim 105, wherein the at least one known address is part of a plurality of known addresses and further comprising a third module configured to store the plurality of known addresses remotely.

108. The system of claim 105, wherein the at least one known address is part of a plurality of known addresses and further comprising a third module configured to store the plurality of known addresses locally.

109. The system of claim 84, wherein the system is part of a web browser.

110. The system of claim 84, wherein the system is part of an email program.

111. The system of claim 84, wherein the system is part of a DNS server.

112. The system of claim 84, wherein the second module is part of the first module.

113. A system for registering a domain name comprising:

a first module to compare a domain name with a plurality of known names and to determine if the domain name is a dishonest transformation of any of the plurality of known names; and

a second module to allow the domain name to be registered if the domain name is not a dishonest transformation of any of the plurality of known names.

114. The system of claim 113, wherein the plurality of known names is a database of trademarks and service marks.

115. The system of claim 113, wherein the plurality of known names is a database of registered domain names.

116. The system of claim 113, wherein the dishonest transformation comprises visual confusion.

117. The system of claim 116, wherein the visual confusion comprises alphanumeric to alphanumeric visual confusion.

118. The system of claim 117, wherein the visual confusion comprises at least one of a substitution of the letter L with the number one, the number one with the letter L, the letter O with the number zero, the number zero with the letter O, the letter o with the number zero, the number zero with the letter o, the letter B with the number eight, the number eight with the letter B, the letter S with the number eight, the number eight with the letter S, the letter E with the number eight, the number eight with the letter E, the letter E with the number three, the number three with the letter E, the letter F with the number seven, the number seven with the letter F, the letter I with number one, the number one with the letter I, the letter i with the number 1, the number 1 with the letter i, the letter m with the letter n and the letter n with the letter m.

119. The system of claim 113, wherein the dishonest transformation comprises a substitution of the top-level domain.

120. The system of claim 113, wherein the first module is configured to determine if a similarity value between the domain name and any of the plurality of known names exceeds a predetermined value.

121. The system of claim 120, wherein the similarity value is determined based on the longest common subsequence between the domain name and the plurality of known domain names.

122. A system for identifying dishonest domain name transformations, the system comprising:

a first module configured to compare a domain name with at least one known name and determine if the domain name comprises visual confusion with the at least one known name.

123. The system of claim 122, wherein the visual confusion comprises alphanumeric to alphanumeric visual confusion.

124. The system of claim 123, wherein the visual confusion comprises at least one of a substitution of the letter L with the number one, the number one with the letter L, the letter O with the number zero, the number zero with the letter O, the letter o with the number zero, the number zero with the letter o, the letter B with the number eight, the number eight with the letter B, the letter S with the number eight, the number eight with the letter S, the letter E with the number eight, the number eight with the letter E, the letter E with the number three, the number three with the letter E, the letter F with the number seven, the number seven with the letter F, the letter I with number one, the number one with the letter I, the letter i with the number 1, the number 1 with the letter i,the letter m with the letter n and the letter n with the letter m.

125. The system of claim 122, wherein the at least one name is selected from a database of trademarks and service marks.

126. The system of claim 122, wherein the at least one name is selected from a database of registered domain names.

127. The system of claim 122, wherein the at least one name comprises a display name associated with the domain name.