Method for evaluating and accessing a network address

• US 8,201,259 B2
• Filed: 12/13/2006
• Issued: 06/12/2012
• Est. Priority Date: 12/23/2005
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Pietraszek, Tadeusz, Vanden Berghe, Chris
• Primary Examiner(s): Chea, Philip
• Assistant Examiner(s): Shepperd, Eric W
• Application Number:
  US12/158,773
• Publication Number:
  US 20090094677A1
• Time in Patent Office: 2,008 Days
• Field of Search: 726/26, 726/30, 713/152, 713/168
• US Class Current: 726/26
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

The invention relates to a method for evaluating or accessing a network address, comprising the steps of: receiving a network address (50); generating derivatives (60) of the received network address (50); assigning a trust level to the generated derivatives (60) and the received network address (50); comparing the trust levels of the derivatives (60) with the trust level of the received network address (50); and issuing a response based on the comparison.

Claims

1. A method for a computer having at least one processing device for evaluating a network address, comprising the steps of the at least one processing device:

receiving a network address;

generating a plurality of derivatives of the received network address;

assigning a trust level value to each of the generated derivatives and a trust level value to the received network address;

comparing the trust level values of each of the derivatives with the trust level value of the received network address; and

issuing a response based on the comparison.

2. The method according to claim 1, wherein the received network address is an address of a webpage.

3. The method according to claim 1, wherein the received network address is a Uniform Resource Identifier (URI), in particular a Uniform Resource Locator (URL).

4. The method according to claim 1, wherein the derivatives are generated by means of at least two different methods.

5. The method according to claim 1, wherein derivatives which are optically similar to the received network address are generated by means of Optical Character Recognition (OCR).

6. The method according to claim 1, wherein derivatives which are structurally similar to the received network address are generated by at least one of adding and/or removing prefixes, postfixes, punctuation marks and/or other common network address elements.

7. The method according to claim 1, wherein derivatives which are editorially similar to the received network address are generated by means of compensating for typing errors.

8. The method according to claim 1, wherein derivatives are generated by means of changing a top level domain.

9. The method according to claim 1,

wherein the assigning a trust level value is based on at least a first property and a second property of the generated derivatives and the received network address.

10. The method according to claim 9, wherein a first weighing coefficient is assigned to the first property and a second weighing coefficient is assigned to the second property and wherein the trust level value assignment is based on a weighed combination of the first and the second property by means of the first and the second weighing coefficient.

11. The method according to claim 9, wherein the assigning a trust level value is assigned by means of a combination of at least two of the following properties of the received network address and the derivatives:

a validity of the received network address and the derivatives,

a rank of the received network address and the derivatives,

a host location of the received network address and the derivatives,

a creation date of the received network address and the derivatives,

a character set of the received network address and the derivatives,

belonging to a whitelist with trusted network addresses and/or

belonging to a blacklist with untrusted network addresses.

12. The method according to claim 1, wherein the response is based on a difference between the trust level value of the received network address and the trust level values of the derivatives.

13. The method according to claim 1, wherein the response comprises the received network address or content located at the received network address respectively, if a difference between the trust level value of the received network address and the trust level values of the derivatives is greater than a predetermined threshold level or

the response indicates that the received network address is untrustworthy, if a relative difference between the trust level value of the received network address and the trust level values of the derivatives is smaller than or equal to a predetermined threshold level.

14. The method according to claim 1, wherein the method is performed within a proxy server, within a browser or within a Domain Name System (DNS)-server of a computer system.

15. The method of claim 1 further comprising requesting a network address.

16. A computer program stored on a non-transitory computer readable medium and comprising instructions for a computer to execute a method for evaluating a network address, the method comprising the steps of:

receiving a network address;

generating a plurality of derivatives of the received network address;

assigning a trust level value to each of the generated derivatives and a trust level value to the received network address;

comparing the trust level values of the derivatives with the trust level value of the received network address; and

issuing a response based on the comparison.

17. A computer system, having at least one processor for executing components, for evaluating a network address comprising:

a receiving component for receiving a network address; and

a processing component for generating a plurality of derivatives of the received network address, for assigning a trust level value to each of the generated derivatives and a trust level value to the received network address, for comparing the trust level values of the derivatives with the trust level value of the received network address and for issuing a response based on the comparison.

18. A method for deploying computing infrastructure, comprising integrating computer readable code into a computer system, wherein the code in combination with the computer system is capable of performing the following:

requesting a network address;

generating a plurality of derivatives of the requested network address;

assigning a trust level value to each of the generated derivatives and a trust level value to the generated derivatives and the requested network address;

comparing the trust level values of the derivatives with the trust level value of the requested network address; and

issuing a response based on the comparison.

19. A method for performing an analysis of the network communication traffic of a business entity, the method comprising the steps of:

compiling a list of network addresses accessed by the business entity;

generating a plurality of derivatives of the accessed network addresses;

assigning a trust level value to each of the generated derivatives and a trust level value to the generated derivatives and the accessed network addresses;

comparing the trust level values of the derivatives with the trust level value of the accessed network addresses; and

compiling a list of accessed network addresses with low trustworthiness based on the comparison.