Method for Detecting and Remediating Misleading Hyperlinks

• US 20080172738A1
• Filed: 01/11/2007
• Published: 07/17/2008
• Est. Priority Date: 01/11/2007
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Bates, Cary Lee, Illg, Jason J., Carey, James Edward
• Application Number:
  US11/622,082
• Publication Number:
  US 20080172738A1
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 16/9566 URL specific, e.g. using aliases, detecting broken or misspelled links
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 2101/30 Types of network names
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A method for verifying the validity of a hyperlink, and determining whether the domain name of the website that the user is directed to is valid. In one embodiment, the method identifies a hyperlink, a URL within the hyperlink and a domain name within the URL. The identified domain name is then assigned a page rank parameter. If the page rank parameter is below a threshold value, then the method compares the identified domain name to a list of well-known or high page rank domain names. A similarity parameter is then assigned to the identified domain name to indicate if the hyperlink is misleading. If the link is misleading, the method may implement some configurable remedial action, such as alerting the user or disabling the hyperlink.

Claims

1. A method comprising:

identifying a hyperlink within an electronic document, wherein the hyperlink includes a domain name; and

automatically taking remedial action against use of the hyperlink if the domain name is determined to be associated with a page rank value that is less than a threshold value and if the domain name is determined to have one or more misleading character substitution, addition, or deletion relative to another domain name that is associated with a page rank value greater than the threshold value.

2. The method of claim 1, wherein the domain name is determined to be associated with a page rank value that is less than a threshold value, by the steps of:

assigning a predetermined page rank value associated with the identified domain name if the identified domain name is present in a list of domain names having predetermined page rank values; and

assigning a page rank parameter as a function of the page rank value of the identified domain name and page rank values of domain names on the list if the identified domain name is not present in the list.

3. The method of claim 1, wherein the domain name is determined to have one or more misleading character substitution, addition, or deletion, by the steps of:

identifying differences between the identified domain name and at least one of the listed domain names; and

finding each of the identified differences in a list of misleading character substitutions, additions, and deletions.

4. The method of claim 3, wherein the identified domain name is determined to have one or more misleading character if the identified domain name would be match one of the listed domain names in the absence of the one or more misleading character substitution, addition, or deletion.

5. The method of claim 1, further comprising:

comparing the similarity of the link label to the identified domain name.

6. The method of claim 1, wherein the remedial action includes notifying the user that the hyperlink has a high likelihood of being misleading.

7. The method of claim 1, wherein the remedial action includes blocking the hyperlink.

8. The method of claim 3, wherein step of identifying differences further comprises:

identifying characters in the identified domain name which are in a different font or language than other characters in the domain name.

9. A computer program product including instructions embodied on a computer readable medium for determining the validity of a hyperlink, the instructions comprising:

instructions for identifying a hyperlink within an electronic document, wherein the hyperlink includes a domain name;

instructions for automatically taking remedial action against use of the hyperlink if the domain name is determined to be associated with a page rank value that is less than a threshold value and if the domain name is determined to have one or more misleading character substitution, addition, or deletion relative to another domain name that is associated with a page rank value greater than the threshold value.

10. The computer program product of claim 9, wherein the domain name is determined to be associated with a page rank value that is less than a threshold value, by the instructions further comprising:

instructions for assigning a predetermined page rank value associated with the identified domain name if the identified domain name is present in a list of domain names having predetermined page rank values; and

instructions for assigning a page rank parameter as a function of the page rank value for the identified domain name and a page rank value for domain names on the list if the identified domain name is not present in the list.

11. The computer program product of claim 9, wherein the domain name is determined to have one or more misleading character substitution, addition, or deletion, by the instructions further comprising:

instructions for identifying differences between the identified domain name and at least one of the listed domain names; and

instructions for finding each of the identified differences in a list of misleading character substitutions, additions, and deletions.

12. The computer program product of claim 11, wherein the identified domain name is determined to have one or more misleading character if the identified domain name would be match one of the listed domain names in the absence of the one or more misleading character substitution, addition, or deletion.

13. The computer program product of claim 9, further comprising:

instructions for comparing the similarity of the link label to the identified domain name.

14. The computer program product of claim 9, wherein the remedial action includes notifying the user that the hyperlink has a high likelihood of being misleading.

15. The computer program product of claim 9, wherein the remedial action includes

instructions for blocking the hyperlink.

16. The computer program product of claim 11, wherein the instructions for identifying differences further comprises:

instructions for identifying characters in the identified domain name which are in a different font or language than other characters in the domain name.