Fake web addresses and hyperlinks

• US 8,799,465 B2
• Filed: 10/13/2004
• Issued: 08/05/2014
• Est. Priority Date: 10/13/2004
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Lake, John Michael
• Primary Examiner(s): Gillis, Brian J
• Application Number:
  US10/964,342
• Publication Number:
  US 20060080437A1
• Time in Patent Office: 3,583 Days
• Field of Search: 709/225, 709/227, 726/22
• US Class Current: 709/225
• CPC Class Codes: G06F 16/9558 Details of hyperlinks; Management of linked annotations
• CPC Class Codes: G06F 16/9566 URL specific, e.g. using aliases, detecting broken or misspelled links
• CPC Class Codes: H04L 2101/30 Types of network names
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 61/302 Administrative registration, e.g. for domain names at internet corporation for assigned names and numbers [ICANN]
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A destination address is processed to determine if the destination address is a fake web address or hyperlink. The destination address may be compared with a database of known domain names to see if the domain name is legitimate or illegitimate. The designation address may also be compared to other domain names to see if it is an honest or dishonest transformation of the other domain names. Appropriate action may be taken if the designation address is a dishonest transformation of another domain name.

Claims

1. A computer-implemented method of processing a destination address, the method comprising:

receiving, within a computer hardware device, the destination address;

determining that the destination address is a domain name;

comparing the domain name with a database of legitimate domain names;

determining that the domain name does not match an entry in the database of legitimate domain names;

analyzing the domain name to determine that the domain name is a dishonest transformation of a legitimate domain name by determining a similarity value between the domain name and the legitimate domain name exceeds a predetermined value, the similarity value being based upon a longest common subsequence between the domain name and the legitimate domain name;

classifying the destination address as a fraudulent address; and

taking an appropriate action in response to classifying the destination address as a fraudulent address.

2. The method of claim 1, wherein

the appropriate action includes at least one of

issuing a warning, and

blocking access to the destination address.

3. The method of claim 1, further comprising

determining if the domain name is one of a plurality of known illegitimate domain names;

and

upon determining that the domain name is one of the plurality of known illegitimate domain names, classifying the destination address as a fraudulent address.

4. The method of claim 1, wherein

the dishonest transformation comprises visual confusion.

5. The method of claim 4, wherein

the visual confusion comprises alphanumeric to alphanumeric visual confusion.

6. The method of claim 4, wherein

the visual confusion comprises at least one of a substitution of

the letter L with the number one, the number one with the letter L,

the letter O with the number zero, the number zero with the letter O,

the letter o with the number zero, the number zero with the letter o,

the letter B with the number eight, the number eight with the letter B,

the letter S with the number eight, the number eight with the letter S,

the letter E with the number eight, the number eight with the letter E,

the letter E with the number three, the number three with the letter E,

the letter F with the number seven, the number seven with the letter F,

the letter I with number one, the number one with the letter I,

the letter i with the number 1, the number 1 with the letter i,

the letter m with the letter n, and the letter n with the letter m.

7. The method of claim 1, wherein

the dishonest transformation comprises a substitution of a top-level domain of the legitimate domain name.

8. The method of claim 1, further comprising

comparing the destination address of a hyperlink with display text of the hyperlink.

9. The method of claim 8, wherein

the destination address is classified as dishonest transformation upon the destination address of the hyperlink being a dishonest transformation of the display text.

10. The method of claim 9, wherein

the dishonest transformation comprises visual confusion.

11. The method of claim 9, wherein

the dishonest transformation comprises a substitution of a top-level domain of the destination address of the hyperlink.

12. The method of claim 9, wherein

the destination address of the hyperlink is a dishonest transformation of the display text upon a similarity value between the destination address of the hyperlink and the display text exceeding a predetermined value.

13. The method of claim 12, wherein

the similarity value is based upon a longest common subsequence between the destination address of the hyperlink and the display text.

14. A computer-readable memory having stored thereon computer-readable program instructions for processing a destination address, the computer-readable program instructions, upon being executed by a computer, causing the computer to perform the operations comprising:

receiving the destination address;

determining that the destination address is a domain name;

comparing the domain name with a database of legitimate domain names;

determining that the domain name does not match an entry in the database of legitimate domain names;

analyzing the domain name to determine that the domain name is a dishonest transformation of a legitimate domain name by determining a similarity value between the domain name and the legitimate domain name exceeds a predetermined value, the similarity value being based upon a longest common subsequence between the domain name and the legitimate domain name;

classifying the destination address as a fraudulent address; and

taking an appropriate action in response to classifying the destination address as a fraudulent address.

15. The computer-readable memory of claim 14, wherein

the appropriate action includes at least one of

issuing a warning, and

blocking access to the destination address.

16. The computer-readable memory of claim 14, further comprising

determining if the domain name is one of a plurality of known illegitimate domain names;

and

upon determining that the domain name is one of the plurality of known illegitimate domain names, classifying the destination address as a fraudulent address.

17. The computer-readable memory of claim 14, wherein

the dishonest transformation comprises visual confusion.

18. The computer-readable memory of claim 17, wherein

the visual confusion comprises alphanumeric to alphanumeric visual confusion.

19. The computer-readable memory of claim 17, wherein

the visual confusion comprises at least one of a substitution of

the letter L with the number one, the number one with the letter L,

the letter O with the number zero, the number zero with the letter O,

the letter o with the number zero, the number zero with the letter o,

the letter B with the number eight, the number eight with the letter B,

the letter S with the number eight, the number eight with the letter S,

the letter E with the number eight, the number eight with the letter E,

the letter E with the number three, the number three with the letter E,

the letter F with the number seven, the number seven with the letter F,

the letter I with number one, the number one with the letter I,

the letter i with the number 1, the number 1 with the letter i,

the letter m with the letter n, and the letter n with the letter m.

20. The computer-readable memory of claim 14, wherein

the dishonest transformation comprises a substitution of a top-level domain of the legitimate domain name.

21. The computer-readable memory of claim 14, further comprising

comparing the destination address of a hyperlink with display text of the hyperlink.

22. The computer-readable memory of claim 21, wherein

the destination address is classified as a dishonest transformation upon the destination address of the hyperlink being a dishonest transformation of the display text.

23. The computer-readable memory of claim 22, wherein

the dishonest transformation comprises visual confusion.

24. The computer-readable memory of claim 22, wherein

the dishonest transformation comprises a substitution of a top-level domain of the destination address of the hyperlink.

25. The computer-readable memory of claim 22, wherein

the destination address of the hyperlink is a dishonest transformation of the display text upon a similarity value between the destination address of the hyperlink and the display text exceeding a predetermined value.

26. The computer-readable memory of claim 25, wherein

the similarity value is based upon a longest common subsequence between the destination address of the hyperlink and the display text.

27. A computer hardware device for processing a destination address, comprising a processor configured to perform the following steps:

receiving the destination address;

determining that the destination address is a domain name;

comparing the domain name with a database of legitimate domain names;

determining that the domain name does not match an entry in the database of legitimate domain names;

analyzing the domain name to determine that the domain name is a dishonest transformation of a legitimate domain name by determining a similarity value between the domain name and the legitimate domain name exceeds a predetermined value, the similarity value being based upon a longest common subsequence between the domain name and the legitimate domain name;

classifying the destination address as a fraudulent address; and

taking an appropriate action in response to classifying the destination address as a fraudulent address.

28. The computer hardware device of claim 27, wherein

the appropriate action includes at least one of

issuing a warning, and

blocking access to the destination address.

29. The computer hardware device of claim 27, wherein the processor is further configured to perform the steps comprising

determining if the domain name is one of a plurality of known illegitimate domain names;

and

upon determining that the domain name is one of the plurality of known illegitimate domain names, classifying the destination address as a fraudulent address.

30. The computer hardware device of claim 27, wherein

the dishonest transformation comprises visual confusion.

31. The computer hardware device of claim 30, wherein

the visual confusion comprises alphanumeric to alphanumeric visual confusion.

32. The computer hardware device of claim 30, wherein

the visual confusion comprises at least one of a substitution of

the letter L with the number one, the number one with the letter L,

the letter O with the number zero, the number zero with the letter O,

the letter o with the number zero, the number zero with the letter o,

the letter B with the number eight, the number eight with the letter B,

the letter S with the number eight, the number eight with the letter S,

the letter E with the number eight, the number eight with the letter E,

the letter E with the number three, the number three with the letter E,

the letter F with the number seven, the number seven with the letter F,

the letter I with number one, the number one with the letter I,

the letter i with the number 1, the number 1 with the letter i,

the letter m with the letter n, and the letter n with the letter m.

33. The computer hardware device of claim 27, wherein

the dishonest transformation comprises a substitution of a top-level domain of the legitimate domain name.

34. The computer hardware device of claim 27, wherein

comparing the destination address of a hyperlink with display text of the hyperlink.

35. The computer hardware device of claim 34, wherein

the destination address is classified as a dishonest transformation upon the destination address of the hyperlink being a dishonest transformation of the display text.

36. The computer hardware device of claim 35, wherein

the dishonest transformation comprises visual confusion.

37. The computer hardware device of claim 35, wherein the processor is further configured to perform the step of

the dishonest transformation comprises a substitution of a top-level domain of the destination address of the hyperlink.

38. The computer hardware device of claim 35, wherein

the destination address of the hyperlink is a dishonest transformation of the display text upon a similarity value between the destination address of the hyperlink and the display text exceeding a predetermined value.

39. The computer hardware device of claim 38, wherein

the similarity value is based upon a longest common subsequence between the destination address of the hyperlink and the display text.

40. A computer-implemented method of processing a domain name to be registered, the method comprising:

receiving, within a computer hardware device, the domain name;

comparing the domain name with a database of registered domain names to that the domain name has not already been registered;

analyzing the domain name to determine that the domain name is a dishonest transformation of a registered domain name by determining a similarity value between the domain name and the registered domain name exceeds a predetermined value, the similarity value being based upon a longest common subsequence between the domain name and the registered domain name; and

disallowing the domain name from being registered.

41. The method of claim 40, wherein

the database of registered domain names includes a database of trademarks and service marks.

42. The method of claim 40, wherein

the dishonest transformation comprises visual confusion.

43. The method of claim 42, wherein

the visual confusion comprises alphanumeric to alphanumeric visual confusion.

44. The method of claim 42, wherein

the visual confusion comprises at least one of a substitution of

the letter L with the number one, the number one with the letter L,

the letter O with the number zero, the number zero with the letter O,

the letter o with the number zero, the number zero with the letter o,

the letter B with the number eight, the number eight with the letter B,

the letter S with the number eight, the number eight with the letter S,

the letter E with the number eight, the number eight with the letter E,

the letter E with the number three, the number three with the letter E,

the letter F with the number seven, the number seven with the letter F,

the letter I with number one, the number one with the letter I,

the letter i with the number 1, the number 1 with the letter i,

the letter m with the letter n, and the letter n with the letter m.

45. The method of claim 42, wherein

the dishonest transformation comprises a substitution of a top-level domain of the legitimate domain name.

46. A computer-readable memory having stored thereon computer-readable program instructions for processing a domain name to be registered, the computer-readable program instructions, upon being executed by a computer, causing the computer to perform the operations comprising

receiving the domain name;

comparing the domain name with a database of registered domain names to determine that the domain name has not already been registered;

analyzing the domain name to determine that the domain name is a dishonest transformation of a registered domain name by determining a similarity value between the domain name and the registered domain name exceeds a predetermined value, the similarity value being based upon a longest common subsequence between the domain name and the registered domain name; and

disallowing the domain name from being registered.

47. The computer-readable memory of claim 46, wherein

the database of registered domain names includes a database of trademarks and service marks.

48. The computer-readable memory of claim 46, wherein

the dishonest transformation comprises visual confusion.

49. The computer-readable memory of claim 48, wherein

the visual confusion comprises alphanumeric to alphanumeric visual confusion.

50. The computer-readable memory of claim 48, wherein

the visual confusion comprises at least one of a substitution of

the letter L with the number one, the number one with the letter L,

the letter O with the number zero, the number zero with the letter O,

the letter o with the number zero, the number zero with the letter o,

the letter B with the number eight, the number eight with the letter B,

the letter S with the number eight, the number eight with the letter S,

the letter E with the number eight, the number eight with the letter E,

the letter E with the number three, the number three with the letter E,

the letter F with the number seven, the number seven with the letter F,

the letter I with number one, the number one with the letter I,

the letter i with the number 1, the number 1 with the letter i,

the letter m with the letter n, and the letter n with the letter m.

51. The computer-readable memory of claim 46, wherein

the dishonest transformation comprises a substitution of a top-level domain of the legitimate domain name.

52. A computer hardware device for processing a domain name to be registered, comprising a processor configured to perform the following steps:

receiving the domain name;

comparing the domain name with a database of registered domain names to determine that the domain name has not already been registered;

analyzing the domain name to determine that the domain name is a dishonest transformation of a registered domain name by determining a similarity value between the domain name and the registered domain name exceeds a predetermined value, the similarity value being based upon a longest common subsequence between the domain name and the registered domain name; and

disallowing the domain name from being registered.

53. The computer hardware device of claim 52, wherein

the database of registered domain names includes a database of trademarks and service marks.

54. The computer hardware device of claim 52, wherein

the dishonest transformation comprises visual confusion.

55. The computer hardware device of claim 54, wherein

the visual confusion comprises alphanumeric to alphanumeric visual confusion.

56. The computer hardware device of claim 54, wherein

the visual confusion comprises at least one of a substitution of

the letter L with the number one, the number one with the letter L,

the letter O with the number zero, the number zero with the letter O,

the letter o with the number zero, the number zero with the letter o,

the letter B with the number eight, the number eight with the letter B,

the letter S with the number eight, the number eight with the letter S,

the letter E with the number eight, the number eight with the letter E,

the letter E with the number three, the number three with the letter E,

the letter F with the number seven, the number seven with the letter F,

the letter I with number one, the number one with the letter I,

the letter i with the number 1, the number 1 with the letter i,

the letter m with the letter n, and the letter n with the letter m.

57. The computer hardware device of claim 52, wherein

the dishonest transformation comprises a substitution of a top-level domain of the legitimate domain name.