METHOD FOR EVALUATING AND ACCESSING A NETWORK ADDRESS

• US 20090094677A1
• Filed: 12/13/2006
• Published: 04/09/2009
• Est. Priority Date: 12/23/2005
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Pietraszek, Tadeusz, Vanden Berghe, Chris
• Granted Patent: US 8,201,259 B2
• Time in Patent Office: Days
• US Class Current: 726/2
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

The invention relates to a method for evaluating or accessing a network address, comprising the steps of: receiving a network address (50); generating derivatives (60) of the received network address (50); assigning a trust level to the generated derivatives (60) and the received network address (50); comparing the trust levels of the derivatives (60) with the trust level of the received network address (50); and issuing a response based on the comparison.

Claims

1. A method for evaluating a network address, comprising the steps of:

receiving a network address;

generating derivatives of the received network address;

assigning a trust level to the generated derivatives and the received network address;

comparing the trust levels of the derivatives with the trust level of the received network address; and

issuing a response based on the comparison.

2. The method according to claim 1, wherein the received network address is the address of a webpage.

3. The method according to claim 1, wherein the received network address is a Uniform Resource Identifier (URI), in particular a Uniform Resource Locator (URL).

4. The method according to claim 1, wherein the derivatives are generated by means of at least two different methods.

5. The method according to claim 1, wherein derivatives which are optically similar to the received network address are generated by means of Optical Character Recognition (OCR).

6. The method according to claim 1, wherein derivatives which are structurally similar to the received network address are generated by at least one of adding and/or removing prefixes, postfixes, punctuation marks, and/or other common network address elements.

7. The method according to claim 1, wherein derivatives which are editorially similar to the received network address are generated by means of compensating for typing errors.

8. The method according to claim 1, wherein derivatives are generated by means of changing the top level domain.

9. The method according to claim 1, wherein the trust level assignment is based on at least a first property and a second property of the generated derivatives and the received network address.

10. The method according to claim 9, wherein a first weighing coefficient is assigned to the first property and a second weighing coefficient is assigned to the second property and wherein the trust level assignment is based on a weighed combination of the first and the second property by means of the first and the second weighing coefficient.

11. The method according to claim 9, wherein the trust level is assigned by means of a combination of at least two of the following properties of the received network address and the derivatives:

the validity of the received network address and the derivatives,

the rank of the the received network address and the derivatives,

the host location of the received network address and the derivatives,

the creation date of the received network address and the derivatives,

the character set of the received network address and the derivatives,

belonging to a whitelist with trusted network addresses and/or

belonging to a blacklist with untrusted network addresses.

12. The method according to claim 1, wherein the response is based on the difference between the trust level of the received network address and the trust level of the derivatives.

13. The method according to claim 1, wherein

the response comprises the received network address or content of the received network address respectively, if the difference between the trust level of the received network address and the trust level of the derivatives is greater than a predetermined threshold level or

the response indicates that the received network address is untrustworthy, if the relative difference between the trust level of the received network address and the trust level of the derivatives is smaller than or equal to a predetermined threshold level.

14. The method according to claim 1, wherein the method is performed within a proxy server, within a browser or within a Domain Name System (DNS)-server of a computer system.

17. The method of claim 1 further comprising:

requesting a network address.

15. A computer program stored on a computer readable medium and comprising instructions for a computer to execute a method for evaluating a network address, the method comprising the steps of:

receiving a network address;

generating derivatives of the received network address;

assigning a trust level to the generated derivatives and the received network address;

comparing the trust levels of the derivatives with the trust level of the received network address; and

issuing a response based on the comparison.

16. A computer system for evaluating a network address comprising:

a receiving component for receiving a network address; and

a processing component for generating derivatives of the received network address, for assigning a trust level to the generated derivatives and the received network address, for comparing the trust levels of the derivatives with the trust level of the received network address and for issuing a response based on the comparison.

18. A method for deploying computing infrastructure, comprising integrating computer readable code into a computer system, wherein the code in combination with the computer system is capable of performing the following:

requesting a network address;

generating derivatives of the requested network address;

assigning a trust level to the generated derivatives and the requested network address;

comparing the trust levels of the derivatives with the trust level of the requested network address; and

issuing a response based on the comparison.

19. A method for performing an analysis of the network communication traffic of a business entity, the method comprising the steps of:

compiling a list of network addresses accessed by the business entity;

generating derivatives of the accessed network addresses;

assigning a trust level to the generated derivatives and the accessed network addresses;

comparing the trust levels of the derivatives with the trust level of the accessed network addresses; and

compiling a list of accessed network addresses with low trustworthiness based on the comparison.