Apparatus and method for blocking phishing web page access

• US 20070118528A1
• Filed: 08/21/2006
• Published: 05/24/2007
• Est. Priority Date: 11/23/2005
• Status: Abandoned Application

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: Jang, Jong Soo, Nam, Taek Yong, Jeong, Chi Yoon, Choi, Su Gil, Han, Seung Wan
• Application Number:
  US11/507,330
• Publication Number:
  US 20070118528A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

An apparatus and a method for blocking access to a phishing web page are provided. The apparatus includes a media collection unit collecting media having a function of connecting to a web page, a management unit managing phishing information comprising at least one of location information on phishing web pages, location information on web pages targeted for phishing, and features of the phishing web pages, a phishing determination unit determining whether a collected medium is connected to a phishing web page and a phishing blocking unit blocking a link connecting to the phishing web page by editing the medium determined to connect to the phishing web page by the phishing determination unit. According to the present invention, damage caused by phishing can be prevented, even when a web page or an e-mail provided by a web site or an e-mail server includes a link connecting to a phishing web page.

Claims

1. An apparatus for blocking access to a phishing web page, comprising:

a media collection unit collecting media having a function of connecting to a web page;

a management unit of phishing information managing phishing information comprising at least one of location information on phishing web pages, location information on web pages targeted for phishing, and features of the phishing web pages;

a phishing determination unit determining whether a collected medium is connected to a phishing web page based on a match of location information on a web page connected through the collected medium and the location information on the phishing web page or a web page targeted for phishing included in the phishing information or a similarity of a feature of the web page connected through the collected media and a feature included in the phishing information; and

a phishing blocking unit blocking access to a link connecting to the phishing web page by editing the medium determined to connect to the phishing web page by the phishing determination unit.

2. The apparatus of claim 1, wherein the phishing determination unit determines whether the collected medium is connected to the phishing web page by determining whether an actual IP address of location information indicated in the collected medium and an IP address connected according to the location information indicated in the collected medium are the same.

3. The apparatus of claim 1, wherein

the phishing information comprises names of web pages targeted for phishing, and

the phishing determination unit determines whether the collected medium is connected to a phishing web page by determining whether location information on a web page to be connected according to the indicated name is the same as the location information on the web page targeted for phishing included in the phishing information, when names targeted for phishing included in the phishing information are indicated in the collected medium.

4. The apparatus of claim 1, wherein

the phishing information comprises features of media enticing users to a phishing web page, and

the phishing determination unit determines whether the collected medium is connected to a phishing web page by determining whether the feature of the collected media is the same as the feature of a medium enticing users to phishing included in the phishing information.

5. The apparatus of claim 1, wherein

the phishing information comprises features of web pages targeted for phishing, and

the phishing determination unit determines whether the collected medium is connected to a phishing web page based on a similarity between the feature of the connected web page through the collected media and the web pages targeted for phishing included in the phishing information.

6. The apparatus of claim 1 or 5, wherein the determination of the similarity in the phishing determination unit is determined by the similarities between images included in a feature of the web page connected through the collected medium and included in features included in the phishing information based on at least one of size, location, name, and file format.

7. The apparatus of claim 1, wherein the media collection unit collects only e-mails that e-mail holders have agreed to are collected.

8. The apparatus of claim 1, wherein the phishing blocking unit removes a phrase or a link connecting to a phishing web page from the medium determined to be connected to the phishing web page or the determined medium.

9. The apparatus of claim 1, wherein the phishing information management unit adds to the phishing information new phishing information extracted from the web page or e-mail determined to be connected to the phishing web page for an update.

10. A method of blocking access to a phishing web page, the method comprising:

(a) storing phishing information comprising at least one of location information on phishing web pages, location information on web pages targeted for phishing, and features of phishing web pages;

(b) collecting media having a function of connecting to a web page;

(c) determining whether a collected medium is connected to a phishing web page based on a match of location information on a web page connected through the collected medium and location information on the phishing web pages or the web pages targeted for phishing included in the phishing information or a similarity of a feature of the web page connected through the collected media and a feature included in the phishing information;

(d) blocking access to a link connecting to the phishing web page by editing the medium determined to connect to the phishing web page by the phishing determination unit.

11. The method of claim 10, wherein (c) comprises determining whether the collected medium is connected to the phishing web page by determining whether an actual IP address of location information indicated in the medium is the same as an IP address connected according to the location information indicated in the medium.

12. The method of claim 10, wherein

the phishing information comprises names targeted for phishing, and

(c) determines whether the collected medium is connected to a phishing web page by determining whether location information on a web page to be connected according to the indicated name is the same as the location information on the web pages targeted for phishing included in the phishing information, when names targeted for phishing included in the phishing information are indicated in the collected medium.

13. The method of claim 10, wherein

the phishing information comprises features of the collected media enticing users to a phishing web page, and

wherein the (c) comprises determining whether the collected medium is connected to a phishing web page by determining whether the feature of the collected media is the same as a feature of a medium enticing users to phishing included in the phishing information.

14. The method of claim 10, wherein

the phishing information comprises features of web pages targeted for phishing, and

(c) determines whether the collected medium is connected to a phishing web page based on a similarity between a feature of the connected web page through the collected media and the web pages targeted for phishing included in the phishing information.

15. The method of claim 10 or 14, wherein the similarity is determined by determining similarities between images included in a feature of the web page connected through the collected medium and included in features included in the phishing information based on at least one of size, location, name, and file format.

16. The method of claim 10, wherein (b) only e-mails that e-mail holders have agreed to are collected.

17. The method of claim 10, wherein (d) comprises removing a phrase or a link connecting to a phishing web page from the medium determined to be connected to the phishing web page or determined medium.

18. The method of claim 10, further comprising adding to the phishing information new phishing information extracted from the web page or e-mail determined to be connected to the phishing web page for an update.

19. A computer readable medium having embodied thereon a computer program for the method of claim 10.