Phishing attack prevention method, recording medium and device for performing the method

Abstract

The present invention relates to a phishing attack prevention method in a phishing attack prevention device for protecting a user browser from phishing attacks by phishing websites that use a fingerprint-based concealment technique, and includes the steps of connecting to a uniform resource locator (URL) through the user browser, setting fingerprint-based cloaking in the user browser to disguise the user browser as a crawler, and receiving web page content from the phishing website corresponding to the URL. This not only protects the user from an initial visit to an unknown phishing website, but also returns a harmless web page to the user, thereby protecting the user from phishing attacks.

Description

[Technical Field]

[0001] The present invention relates to a phishing attack prevention method for protecting a user browser from phishing attacks, and a recording medium and device for carrying out the method. [Background technology]

[0002] In research to protect existing websites, many anti-phishing techniques have been proposed, such as URL (Uniform Resource Locator)-based phishing detection and web content analysis techniques.

[0003] For example, commercial URL blacklists such as Google Safe Browsing and Microsoft Smart Screen support the phishing prevention ecosystem on the backend.

[0004] The ecosystem uses machine learning classifiers to enable a phishing prevention system to warn users if the website they visit is suspicious.

[0005] However, this ecosystem has the drawback that it can accurately classify phishing websites only when the anti-phishing system searches for phishing content, i.e., it cannot accurately classify phishing websites when it does not search for phishing content.

[0006] Therefore, modern phishing techniques exploit the shortcomings of such traditional anti-phishing systems by hiding the anti-phishing system and slowing or deactivating browser detection.

[0007] Cloaking, one of the techniques used to hide the phishing prevention systems of these latest phishing technologies, exists in two categories: client-side and server-side.

[0008] First, client-side cloaking technology runs JavaScript in the user's browser to distinguish visitors and display other web page content, leaving a fingerprint on the browser.

[0009] Server-side cloaking technology analyzes HTTP requests to identify visits to anti-phishing elements. While this type of server-side cloaking technology has the problem of not working properly with the small amount of information provided by the server-side cloaking site, it can easily distinguish between legitimate user HTTP requests and those of anti-phishing systems using a relatively large amount of information.

[0010] Therefore, fingerprint-based cloaking techniques are widely used in advanced phishing websites. Figure 1 shows the general working process of server-side fingerprint-based cloaking in such advanced phishing websites.

[0011] As shown in Figure 1, fingerprint-based cloaking techniques utilize the hostname, IP address, User-Agent HTTP header, or Referrer HTTP header to identify visitors when they use a browser to visit a phishing website.

[0012] Additionally, if an HTTP request is determined to be from a phishing prevention system, the phishing web server's cloaking code will leave a fingerprint in the HTTP request profile and respond with other web page content.

[0013] Figure 2 shows a simplified PHP code snippet of fingerprint-based cloaking that identifies IP, hostname, and user agent in a phishing kit.

[0014] As phishing techniques continue to evolve, the number of identified fingerprints increases, resulting in a 404 Page Not Found error response when the hostname, IP address, or user agent matches. Therefore, a visit to a phishing prevention system triggers a fingerprint-based cloaking technique on the phishing server, as shown in Figures 1 and 2, and the phishing prevention system is limited in that it cannot search for phishing content, resulting in false positives or delayed detections. [Prior art documents] [Patent documents]

[0015] [Patent Document 1] Korean Patent Publication No. 10-2008-0072978 Summary of the Invention [Problem to be solved by the invention]

[0016] The present invention has been made to solve such problems, and its purpose is to provide a phishing attack prevention method that can not only protect users from their first visit to an unknown phishing website, but also return harmless web pages to the user to protect them from phishing attacks, as well as a recording medium and device for carrying out this method. [Means for solving the problem]

[0017] To achieve the above object, a phishing attack prevention method according to one embodiment of the present invention is a phishing attack prevention method in a phishing attack prevention device for protecting a user browser from phishing attacks by phishing websites that use fingerprint-based concealment techniques, and includes the steps of connecting to a URL (Uniform Resource Locator) through the user browser, setting fingerprint-based cloaking in the user browser to disguise the user browser as a crawler, and receiving web page content from the phishing website corresponding to the URL.

[0018] In addition, the step of disguising the crawler may include the steps of comparing the URL with a pre-established blacklist, blocking the connection to the URL if the URL is included in the blacklist, and querying a pre-established fingerprint database to check the past history of the URL if the URL is not included in the blacklist.

[0019] In addition, in the step of disguising the crawler, the step of checking the past history confirms that a phishing attack on the URL has been successfully prevented. Na If not, the user browser's profile is maintained to disguise the user browser as the crawler, but if no history of successfully preventing phishing attacks against the URL is confirmed, the user browser's profile can be changed to disguise the user browser as the crawler.

[0020] Also, changing the profile of the user browser may be changing a bot profile included in the profile of the user browser based on a pre-established anti-phishing bot profile database.

[0021] In addition, after the step of disguising the crawler, the method may further include a step of requesting a HyperText Transfer Protocol (HTTP) containing the maintained or modified user browser profile from the server side of the phishing website.

[0022] In addition, the phishing attack prevention method may further include, after the step of receiving the web page content, classifying the web page content as phishing content using a classification engine running in the background, and updating the fingerprint database using the connected URL, the changed user browser profile, and the classification result of the web page content.

[0023] Meanwhile, a recording medium according to an embodiment of the present invention for achieving the above object is a computer-readable recording medium having recorded thereon a computer program for performing a method for preventing phishing attacks according to an embodiment of the present invention.

[0024] Meanwhile, to achieve the above object, a phishing attack prevention device according to one embodiment of the present invention is a phishing attack prevention device for protecting a user browser from phishing attacks by phishing websites that use fingerprint-based concealment techniques, and includes a communication unit that connects to a URL via the user browser and receives web page content from the phishing website corresponding to the URL, and a control unit that sets fingerprint-based cloaking in the user browser to disguise the user browser as a crawler.

[0025] The control unit may also include a comparison unit that compares the URL with a pre-established blacklist, a blocking unit that blocks access to the URL if the URL is included in the blacklist, and a history checking unit that queries a pre-established fingerprint database to check the past history of the URL if the URL is not included in the blacklist.

[0026] In addition, the control unit may further include a profile management unit that, if the history confirmation unit confirms a history of successfully preventing a phishing attack on the URL, maintains the profile of the user browser and disguises the user browser as the crawler, and, if the history of successfully preventing a phishing attack on the URL is not confirmed, changes the profile of the user browser and disguises the user browser as the crawler.

[0027] The profile management unit can also change the bot profile included in the user browser profile based on a pre-established anti-phishing bot profile database.

[0028] In addition, the control unit may disguise the crawler and then request a HyperText Transfer Protocol (HTTP) containing the maintained or modified user browser profile from the server side of the phishing website.

[0029] In addition, the control unit may further include a classification unit that classifies phishing content from the web page content using a classification engine that runs in the background after the step of receiving the web page content, and the control unit may update the fingerprint database using the connected URL, the changed user browser profile, and the classification result of the web page content. [Effects of the Invention]

[0030] According to one aspect of the present invention described above, by providing a method for preventing phishing attacks, a recording medium and an apparatus for performing the method, it is possible to not only protect a user from their first visit to an unknown phishing website, but also to protect the user from phishing attacks by returning a harmless web page to the user. [Brief explanation of the drawings]

[0031] [Figure 1] FIG. 1 illustrates the general working process of server-side fingerprint-based cloaking on a phishing website. [Figure 2] FIG. 1 shows a simplified PHP code snippet of fingerprint-based cloaking that checks IP, hostname and User-Agent in a phishing kit. [Figure 3] 1 is a diagram illustrating the configuration of a phishing attack prevention device according to an embodiment of the present invention; [Figure 4] 2 is a flowchart illustrating a method for preventing phishing attacks according to an embodiment of the present invention. [Figure 5] 2 is a flowchart illustrating a method for preventing phishing attacks according to an embodiment of the present invention in more detail. [Figure 6a] This is the content that phishing content shows when visited by a basic browser. [Figure 6b] 1 is the content shown by a browser according to the present invention when visiting a phishing website. [Figure 6c] 1 is the content shown by a browser according to the present invention when visiting a phishing website. [Figure 7a] FIG. 10 is a diagram comparing a basic browser and a browser according to the present invention when visiting a general website. [Figure 7b] FIG. 10 is a diagram comparing a basic browser and a browser according to the present invention when visiting a general website. [Figure 8a]10A and 10B are diagrams illustrating pop-up permission results in a basic browser and a browser according to the present invention. [Figure 8b] 10A and 10B are diagrams illustrating pop-up permission results in a basic browser and a browser according to the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0032] The following detailed description of the present invention refers to the accompanying drawings, which show, by way of illustration, specific embodiments in which the invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention. It should be understood that various embodiments of the present invention, although different from one another, are not necessarily mutually exclusive. For example, a particular shape, structure, and characteristic described herein in connection with one embodiment may be implemented in other embodiments without departing from the spirit and scope of the invention. It should also be understood that the location or arrangement of individual components in each disclosed embodiment may be modified without departing from the spirit and scope of the invention. Therefore, the following detailed description is not to be taken in a limiting sense, and the scope of the present invention is limited only by the appended claims, along with the full scope of equivalents to which the claims, if properly interpreted, are entitled. Like reference numerals in the figures refer to the same or similar functionality throughout the various aspects.

[0033] The components according to the present invention are defined by functional divisions rather than physical divisions, and can be defined by the functions they perform. Each component may be implemented as hardware or as program code and a processing unit that executes the respective functions, or the functions of two or more components may be included in one component. Therefore, it should be noted that the names given to the components in the following embodiments are not intended to physically distinguish each component, but are intended to suggest the representative functions performed by each component, and the technical concept of the present invention is not limited by the names of the components.

[0034] In the following, preferred embodiments of the present invention will be described in more detail with reference to the drawings.

[0035] FIG. 3 is a diagram illustrating the configuration of a phishing attack prevention device 100 according to an embodiment of the present invention.

[0036] The phishing attack prevention device 100 (hereinafter referred to as the device) according to this embodiment is provided to protect a user browser from phishing attacks by phishing websites that utilize fingerprint-based concealment techniques.

[0037] To this end, the device 100 according to the present embodiment may include a communication unit 110, a storage unit 130, and a control unit 150. Software (application) for performing the phishing attack prevention method may be installed and executed in the device 100, and the communication unit 110, the storage unit 130, and the control unit 150 may be controlled by the software (application) for performing the phishing attack prevention method.

[0038] In this case, the device 100 may be a separate terminal or a module that is part of a terminal. The communication unit 110, the storage unit 130, and the control unit 150 may be formed as an integrated module or as one or more modules. However, conversely, each component may be formed as a separate module.

[0039] The device 100 may be mobile or fixed. The device 100 may be in the form of a server or engine and may be referred to by other terms such as a device, apparatus, terminal, user equipment (UE), mobile station (MS), wireless device, or handheld device. The device 100 may execute or create various software based on an operating system (OS), i.e., a system. Here, an operating system is a system program that enables software to use the device's hardware, and may include mobile computer operating systems such as Android OS, iOS, Windows Mobile OS, Sea OS, Symbian OS, and BlackBerry OS, as well as computer operating systems such as Windows, Linux, UNIX, MAC, AIX, and HP-UX.

[0040] First, the communication unit 110 is provided for transmitting and receiving various types of information.

[0041] The communication unit 110 according to this embodiment allows a user to connect to a URL via a user browser.

[0042] Additionally, the communication unit 110 can receive web page content from a phishing website corresponding to a URL input via a user browser.

[0043] A program for performing a phishing attack prevention method is recorded in the storage unit 130. In addition, the storage unit 130 temporarily or permanently stores data processed by the control unit 150 and may include a volatile storage medium or a non-volatile storage medium, but the scope of the present invention is not limited thereto.

[0044] The storage unit 130 also stores data accumulated while the phishing attack prevention method is being performed.

[0045] Such a storage unit 130 may include a fingerprint database unit 131 and an anti-phishing bot profile database.

[0046] Fingerprint database unit 131 can be provided to store a URL history, which is a history of URL processing, and can be updated based on information processed by control unit 150.

[0047] Such a fingerprint database unit 131 can operate locally so as not to share the visit history between users in order to protect personal information.

[0048] Additionally, the fingerprint database unit 131 may be configured to share URL history via a centralized server while maintaining user personal information.

[0049] Alternatively, an anti-phishing bot profile database component 133 may be provided to store information that allows a user's browser profile to be modified.

[0050] Here, a profile can be defined as a set of fingerprintable attributes and their corresponding values. For example, a profile might include a bot's User-Agent string, an empty Referrer, or an AWS IP address. Such a profile is used to generate appropriate HTTP requests to target websites.

[0051] Thus, each time a phishing website, or phisher, adds a new fingerprint to the fingerprint-based concealment, such attributes can be stored in the anti-phishing bot profile database portion 133 .

[0052] That is, the anti-phishing bot profile database unit 133 can store a profile that allows a user browser to disguise itself as a crawler. Such a profile that allows a user browser to disguise itself as a crawler can be extracted and stored from the phishing kit shown in FIG.

[0053] The storage unit 130 may also store a blacklist maintained by the anti-phishing system. Of course, this is merely an example, and the blacklist maintained by the anti-phishing system may also be received in real time via the communication unit 110.

[0054] Meanwhile, the control unit 150 is provided to control the entire process of providing the phishing attack prevention method.

[0055] In addition, the control unit 150 can set fingerprint-based cloaking in the user browser to disguise the user browser as a crawler.

[0056] To this end, the control unit 150 may include a comparison unit 151 , a blocking unit 153 , a history checking unit 155 , and a profile management unit 157 .

[0057] The comparison unit 151 can compare a URL to be accessed via a user browser with a blacklist.

[0058] Furthermore, the blocking unit 153 can block the connection of the URL if the URL is included in the blacklist.

[0059] If the URL is included in the blacklist, the blocking unit 153 can output a phishing route that can improve discrimination and completely block access.

[0060] If the URL is not included in the blacklist, the past history checking unit 155 can query the fingerprint database unit 131 to check the past history of the URL.

[0061] If the past history checking unit 155 confirms that a phishing attack against the URL has been successfully prevented, the profile management unit 157 maintains the user browser profile as the profile used in the past and disguises the user browser as a crawler.

[0062] In addition, if the profile management unit 157 does not confirm a history of successfully preventing phishing attacks on the URL, it can disguise the user browser as a crawler by modifying the user browser's profile to trigger fingerprint-based cloaking on the phishing website.

[0063] The profile management unit 157 may change the profile to disguise the user browser as a crawler by changing the bot profile included in the user browser's profile based on the anti-phishing bot profile database unit 133.

[0064] Specifically, the profile management unit 157 can modify or change profile items such as the User-Agent HTTP header.

[0065] Anti-phishing crawlers typically include the words "bot" and "crawler" or company names such as "Google" and "Facebook" in the User-Agent HTTP header, as shown in Table 1 below.

[0066] [Table 1]

[0067] Table 1 is an exemplary table showing a list of the top 10 sensitive words displayed as a result of analyzing at least one phishing kit as shown in Figure 2. Therefore, the profile management unit 157 can pre-prepare trigger words automatically extracted from the phishing kits listed in Table 1 and modify the profile using these to disguise the user browser as a crawler.

[0068] Additionally, the profile management unit 157 according to this embodiment may be configured to allow more trigger words that modify the user profile depending on the anti-phishing crawler, bot, and server-side cloaking status.

[0069] The profile management unit 157 can also modify or change the Referrer HTTL header. Typically, potential victim users connect to phishing websites through phishing lures. Thus, the phisher can block all visits without the phishing lures.

[0070] Therefore, the profile management unit 157 can selectively utilize a proxy server to disguise the user's IP address.

[0071] More specifically, according to the results of analyzing the phishing kit as shown in Table 1 above, the phisher inferred that some anti-phishing crawlers use AWS EC2, and therefore the proxy server of AWS EC2 is deemed useful, so the profile management unit 157 can utilize the proxy server.

[0072] In this case, the profile manager 157 can proxy the request through a disguised IP address, and the proxy server can help avoid fingerprint-based cloaked phishing websites.

[0073] In addition, the profile management unit 157 can add one of the trigger words from the anti-phishing bot profile database unit 133 to the User-Agent string according to the popularity ranking in Table 1 during the process of modifying the profile.

[0074] Furthermore, the profile management unit 157 can not use trigger words that have not been successful for the same URL, and can set the reference page to none (removing the header).

[0075] Additionally, the profile manager 157 can selectively reroute requests to a proxy server in one of the most blocked IP ranges when changing the IP / hostname.

[0076] Therefore, the control unit 150 can disguise the user browser as a crawler via the profile management unit 157, and then request a HyperText Transfer Protocol (HTTP) containing the browser profile from the server side of the phishing website.

[0077] This allows the control unit 150 to receive an HTTP response from the server.

[0078] The control unit 150 may further include a classification unit 159 .

[0079] The categorization unit 159 can receive web page content via an HTTP request and then categorize the phishing content using a categorization engine that runs in the background.

[0080] Specifically, after receiving web page content, the control unit 150 can check whether there is any suspicious content using a classification engine running in the background to prevent page rendering delays.

[0081] The reason why the classification unit 159 classifies the suspicious content in this manner is to check whether the profile changed by the profile management unit 157 is effective in inducing cloaking.

[0082] In addition, the control unit 150 can update the fingerprint database unit 131 using the accessed URL, the changed user browser profile, and the classification result of the web page content.

[0083] The following describes four possibilities that may occur when the device 100 according to this embodiment receives an HTTP response after disguising the user browser as a crawler.

[0084] First, the server is benign and responds with benign content; second, the server is benign and responds with suspicious content; third, the server is malicious and responds with benign content (e.g., an error page or a redirect to a benign website); and fourth, the server is malicious and responds with suspicious content.

[0085] The criteria for determining this is the presence or absence of features such as login forms, sensitive (phishing) words such as usernames and passwords, and submit buttons. If these features are absent, it can be considered that a phishing attack has been successfully prevented.

[0086] For example, if the user visits the harmless paypal.com URL for the first time without knowing whether the URL is harmless or harmful, the user changes their profile in the profile management unit 157 and receives a response from paypal, so the web page still contains username and password fields. In this case, the device 100 may be deemed to have not successfully prevented the phishing attack because it still contains sensitive words.

[0087] Similarly, if a user visits a PayPal phishing page such as paypal-certify.com that does not include cloaking, the device 100 will change its profile but will still receive the phishing web page, and the control unit 150 may be deemed unsuccessful in preventing the phishing attack for the same reasons described above.

[0088] If it is the first of the four possibilities above (harmless server and content), then the device 100 can be considered successful in preventing the phishing attack, as there is no security risk to the user.

[0089] The second (innocent server and suspicious content) may occur when a user visits an innocent website that contains phishing-like features, such as a login form, sensitive words, and a submit button. Such websites are often indistinguishable from phishing websites. Therefore, device 100 may classify all unknown websites with login forms as suspicious and consider the phishing attack unsuccessful. Thus, device 100 may determine the suspicious content classification as suspicious and indicate the variant as a failure.

[0090] On the other hand, in the third case (malicious server and harmless content), the server is malicious using a concealment technique and determines that a URL visit via the device 100 is a visit from an anti-phishing bot. Therefore, in this case, the phishing website returns an error web page or redirects the visit to a benign website. As a result, the device 100 can successfully prevent the user from viewing the phishing content by triggering fingerprint-based cloaking technology on the phishing website.

[0091] In the fourth case (rogue server and suspicious content), the phishing website may not perform fingerprint-based cloaking or the profile may not trigger fingerprint-based cloaking.

[0092] In the former case, the device 100 may be considered to have failed to prevent the phishing attack because it cannot trigger any cloaking actions, but in this case, the phishing website may be quickly detected in the phishing prevention system, as will be described later in conjunction with Figures 6-8.

[0093] In the latter case, device 100 can store a failed profile to aid in future visits to that URL in order to trigger fingerprint-based cloaking. From the browser's perspective, this case is the same as the second case (benign server and suspicious content), so it cannot simply block the URL since it cannot know whether the server is malicious or benign.

[0094] FIG. 4 is a flowchart illustrating a method for preventing phishing attacks according to one embodiment of the present invention. The method for preventing phishing attacks according to one embodiment of the present invention is performed on substantially the same configuration as the phishing attack device 100 shown in FIG. 3, so the same components as those in the phishing attack device 100 of FIG. 3 are given the same reference numerals and repeated descriptions will be omitted.

[0095] The method for preventing phishing attacks includes the steps of connecting to a URL (S110), disguising a user browser as a crawler (S130), and receiving web page content (S150).

[0096] In the step of connecting to the URL (S110), the communication unit 110 can connect to the URL via the user browser.

[0097] In the step of disguising the user browser as a crawler (S130), the control unit 150 sets fingerprint-based cloaking in the user browser to disguise the user browser as a crawler.

[0098] In the step of disguising the user browser as a crawler (S130), the control unit 150 can compare the URL with a blacklist that is prepared in advance.

[0099] Furthermore, in the step of disguising the user browser as a crawler (S130), the control unit 150 can block the connection of the URL if the URL is included in the blacklist.

[0100] In addition, in the step (S130) of disguising the user browser as a crawler, if the URL is not included in the blacklist, the control unit 150 can query the pre-established fingerprint database unit 131 to check the past history of the URL.

[0101] In addition, in the step of disguising the user browser as a crawler (S130), if the control unit 150 checks the past history and finds that a phishing attack against a URL has been successfully prevented, the control unit 150 can maintain the user browser's profile as a profile that has been successfully used in phishing attacks, thereby disguising the user browser as a crawler.

[0102] In addition, in the step of disguising the user browser as a crawler (S130), if the control unit 150 does not confirm a history of successfully preventing a phishing attack against the URL, the control unit 150 may change the profile of the user browser to disguise the user browser as a crawler.

[0103] In addition, changing the profile of the user browser in the step (S130) of disguising the user browser as a crawler may be the control unit 150 changing the bot profile included in the profile of the user browser based on the anti-phishing bot profile database unit 133 that is provided in advance.

[0104] In addition, the phishing attack prevention method according to this embodiment may further include a step in which, after the step of disguising the user browser as a crawler (S130), the control unit 150 requests a HyperText Transfer Protocol (HTTP) including the maintained or changed user browser profile from the server side of the phishing website.

[0105] In the step of receiving web page content (S150), the control unit 150 can receive the web page content from the phishing website corresponding to the URL.

[0106] In addition, the phishing attack prevention method may further include, after receiving the web page content (S150), classifying the phishing content and updating the fingerprint database unit 131.

[0107] The step of classifying the phishing content may be a step in which the control unit 150 classifies the phishing content from among the web page contents using a classification engine that runs in the background.

[0108] In addition, the step of updating the fingerprint database unit 131 may involve updating the fingerprint database using the URL accessed by the control unit 150, the changed user browser profile, and the classification result of the web page content.

[0109] FIG. 5 is a flowchart for more specifically explaining a method for preventing phishing attacks according to an embodiment of the present invention.

[0110] First, the device 100 can connect to a URL using a browser (S210).

[0111] Additionally, the device 100 can use a commercial URL blacklist, such as Google safe Browsing or Microsoft SmartScreen, in real time to determine whether the URL is included in the blacklist (S220).

[0112] If the URL is included in the blacklist (S220-Yes), the device 100 can block the connection to the URL (S225).

[0113] On the other hand, if the URL is not included in the blacklist (S220-No), the device 100 queries the fingerprint database unit 131 to see if the URL has been processed before (S230).

[0114] If there is a history of processing the URL and the device 100 has successfully prevented a phishing attack in the past (S230-Yes), the device 100 may maintain a profile based on the processing history (S235).

[0115] If there is no history of processing the URL or if the phishing attack was not prevented (S230-No), the device 100 can change the profile using the profile information stored in the anti-phishing bot profile database unit 133 (S240).

[0116] Thereafter, the device 100 can make an HTTP request to the phishing website server via the maintained or modified profile (S245).

[0117] The device 100 can then receive web page content from the phishing website as a response to the HTTP.

[0118] Additionally, the device 100 may use a classification engine running in the background to check for suspicious content (S255).

[0119] The method for preventing phishing attacks of the present invention may be implemented in the form of program instructions that can be executed by various computer components and recorded on a computer-readable recording medium, which may include, alone or in combination, program instructions, data files, data structures, and the like.

[0120] The program instructions contained on the computer-readable recording medium may be those specially designed and constructed for the purposes of the present invention, or they may be of the type well known and available to those skilled in the computer software arts.

[0121] Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical recording media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, and flash memory.

[0122] Examples of program instructions include not only machine code produced by a compiler, but also high-level language code that can be executed by a computer using an interpreter, etc. The hardware devices may be configured to operate as one or more software modules to perform processes according to the present invention, and vice versa.

[0123] 6 to 8 are diagrams for explaining the effect of the phishing attack prevention method according to one embodiment of the present invention.

[0124] In order to evaluate the phishing attack prevention method of the present invention, the device 100 was implemented in a Chrome browser extension program. The evaluation was carried out from three perspectives: effectiveness, latency, and functional impact.

[0125] This perspective demonstrates the feasibility of the method framework in practice, as it successfully circumvents sophisticated phishing websites, introduces negligible latency to the user's search, and causes no damage.

[0126] To test the effectiveness of our phishing attack prevention method, we used malicious and benign datasets.

[0127] More specifically, to evaluate the effectiveness, in the malicious dataset, we used the APWG (Anti-Phishing Working Group) URL feed, a curated dataset of reported phishing URLs, to visit 160,728 live phishing websites from November 2020 to July 2021. We then utilized another 8,474 live phishing websites in the APWG dataset to evaluate the effectiveness of IP changes, i.e., profile changes.

[0128] On the other hand, in order to evaluate the impact of the phishing attack prevention method of the present invention on benign websites, we collected a benign domain dataset of 60,848 domains randomly selected from 629,843 domains on the Alexa Top One Million Domain List.

[0129] In addition, the efficiency of the phishing attack prevention method was evaluated by visiting the same phishing website using a basic browser and a browser (hereinafter referred to as the present browser) that reflects an application for performing the phishing attack prevention method of the present invention.

[0130] Phishing URL visits using the base browser and this browser were taken from the APWG dataset.

[0131] To reduce the impact of trigger word selection on the results, for each URL, the browser used a profile with 407 trigger words, any trigger word without a referrer header and IP proxy. A simple profile was used because cloaking is triggered when a cloaking rule is matched by phishing kit behavior analysis.

[0132] We also evaluated the effectiveness of each trigger word, evaluated the effectiveness of IP address proxies, and recorded the content and URL of the last visited web page each time a URL was visited.

[0133] As a result, from November 2020 to July 2021, APWG conducted experiments on 160,728 phishing URLs, and 132,247 (82.28%) were found to contain no malicious content in this browser.

[0134] Furthermore, if the HTTP response of this browser (1) differed from the web page displayed in the basic browser and (2) did not contain suspicious content such as "phishing" words or incorrect formats, it was considered normal by re-realizing the CANTINA+ content function.

[0135] FIG. 6 illustrates the difference in response web page content between visits to a cloaked phishing website via a basic browser and a visit via the browser.

[0136] The content in Figure 6a is what the phishing content shows when visited by a basic browser.

[0137] On the other hand, when the browser modified the HTTP profile to include any trigger words and removed the referrer header, the phishing website displayed the error web page shown in Figure 6b.

[0138] In addition, other phishing websites redirected visitors to harmless URLs instead of returning error pages. In this way, the browser received the web page content shown in Figure 6c, demonstrating successful evasion.

[0139] The results show that the present invention can disguise users as anti-phishing entities through fingerprint-based cloaking techniques and prevent users from phishing content on phishing sites.

[0140] Additionally, users are not exposed to phishing attacks because they view harmless content (error pages or harmless URLs), which can prevent them from becoming victims of phishing attacks in advance, even if it is their first time visiting a phishing URL.

[0141] Below, we describe the results of evaluating the effectiveness of each trigger word in actually triggering fingerprint-based cloaking techniques.

[0142] The trigger words were retrieved by the phishing kit analysis in Figure 2, and all trigger words were tested by visiting each phishing website using another profile configured with trigger words, no referrer header, and no IP proxy.

[0143] For the purposes of evaluation, each profile contains only one trigger word, so one profile means one trigger word.

[0144] Similar to the effectiveness evaluation, the websites were visited and compared using a basic browser, and the evaluation was performed on 916 phishing websites.

[0145] As a result, we confirmed that 725 phishing websites displayed different web pages between the current browser and the basic browser due to one or more trigger words.

[0146] Across 725 cloaked phishing websites, each trigger word has a different evasion function.

[0147] Table 2 below shows the top 10 trigger words that successfully avoided phishing content.

[0148] [Table 2]

[0149] As can be seen from Table 2, the word "bot" is the most frequently used word to avoid phishing websites. In other words, 99.31% of cloaked phishing websites can be avoided by adding "bot" to the User-Agent. Compared to the popularity ranking in Table 1, it is also the most frequently blocked word in the phishing kits investigated by the inventors of this invention.

[0150] Indeed, we have confirmed the effectiveness of this word as it is popular in phishing kits. Similarly, "amazonaws," "phishtank," and "google" are also frequently used in phishing kits.

[0151] What's interesting is that the combination of "bot" and "amazonaws" can induce cloaking on all phishing websites that use fingerprint-based cloaking techniques.

[0152] The results show that trigger words can effectively evade phishing websites through fingerprint-based cloaking techniques.

[0153] Also, a small number of trigger words can help you avoid many hidden phishing websites.

[0154] In addition, this phishing attack prevention method achieved an evasion rate of over 80% by modifying both the User-Agent and Referrer headers.To this end, evaluation was conducted through three different browsers visiting the same dataset of phishing websites: (1) a UA browser, which is a browser that only modifies the User-Agent string (UA), (2) a REF browser, which is a browser that only modifies the Referrer, and (3) a general browser.

[0155] In this evaluation, 4,905 phishing websites were visited using the three browsers mentioned above, and the analysis then compared the web page content of each website in the UA browser and the REF browser with the web page content of the regular browsers, respectively.

[0156] Therefore, it is possible to track the number of web pages in the UA browser or REF browser that do not contain suspicious content.

[0157] Of the phishing websites visited, the UA browser avoided 4,028, while the REF browser avoided 16. Because a limited number of phishing kits include Referrer checking, the browser was able to avoid a small number of phishing websites by changing only the Referrer.

[0158] Consider the referrer an option in this browser, as phishers can subsequently check the referrer in their phishing kits.

[0159] Combining the Referrer and User-Agent headers can avoid 82.44% of phishing websites. These results show that our browser's ability to change only the User-Agent header can avoid even more phishing websites than changing only the Referrer header.

[0160] Meanwhile, the present invention can successfully avoid phishing content on over 80% of phishing websites by changing the User-Agent and Referrer headers, and the efficiency of IP address modification was analyzed.

[0161] Therefore, we performed another experiment with this browser profile that had the basic User-Agent and Referrer headers, but proxied the connection through a server with an Amazon AWS IP address.

[0162] The proxy server option may affect personal information, so this option is generally disabled. Users can choose to use this function in this browser only if they have read, understood, and agreed to the contents regarding personal information. In this experiment, 8,474 phishing websites were used, and the websites were visited using both the basic browser and this browser (only the IP address was changed depending on the profile).

[0163] The web page content of each phishing website was then compared between the two visits to detect whether the browser's web pages contained any suspicious content.Of the phishing sites visited, the browser avoided 88.98% (7,540) through a proxy server.

[0164] Therefore, the browser can avoid phishing websites that implement IP, User-Agent, or Referrer cloaking. Phishers can design new cloaking techniques in the future, but the present invention is designed as an extensible framework so that fingerprinting functionality can be added.

[0165] Next, we considered the impact of this browser on users' experience when they visit benign websites.

[0166] By design, the browser can introduce latency into HTTP requests through database queries, HTTP profile modifications, and returned content inspection. We conducted experiments to measure the latency of the browser from three perspectives: database queries, profile modifications, and content inspection.

[0167] We use exthouse as a test bench to analyze the impact of browser extensions on web performance, which includes five key measurements:

[0168] (1) TTI (Time to Interactive): The time it takes for the page to fully interact with the extension; (2) First Input Delay (FIDΔ): The time from when the user first interacts with the website to when the browser can actually start processing the event handler in response to that interaction; (3) Scripting Time (ScriptingΔ): The time it takes for JavaScript to be executed in the extension; (4) Long Task (Added Long Task): This value indicates the total number of long tasks added by the extension, where a long task is defined as work that blocks the main thread for more than 50ms; (5) Additional CPU Consumption (Additional CPU Time): The additional CPU consumption of the extension for each URL visited by the browser.

[0169] The lower the factor, the better the performance.

[0170] exthouse also generates a score for the extension, with a higher score indicating better performance of the extended program.

[0171] [Table 3]

[0172] Table 3 shows the external scores of the top 10 Chrome extensions and our browser (Spartacus) when visiting benign and malicious websites.

[0173] We tested this extension on 100 websites, half benign and half malicious, and used the average as the metric. The browser (Spartacus) achieved a score of 100 based on a 20ms FID, 0 script delta, and 800ms TTI when visiting benign websites. It can be seen that the metrics for the browser (Spartacus) visiting malicious websites also exceed those of other popular extensions.

[0174] Even though it takes longer to interact with malicious websites, the browser (Spartacus) still takes less time than other extensions because it takes time to change profiles. For example, Avira Browser Safety (ABS), an extension that warns users when a website is unsafe, adds long work and additional CPU time when visiting malicious websites.

[0175] The evaluation results show that the browser (Spartacus) adds minimal overhead to web browsing.

[0176] Testing has shown that the browser (Spartacus) outperforms popular Chrome extensions and has a negligible impact on website performance compared to other extensions.

[0177] It is also important that the phishing attack prevention method of the present invention minimizes the negative impact on innocent URL visits, which may include website accessibility, correct display of website layout, and correct website functionality.

[0178] To evaluate the functionality of benign websites, for each URL, the browser used a profile without any trigger words, referrer headers, and IP proxies.

[0179] Specifically, we evaluated whether our framework negatively impacts access to websites or website layouts by automatically analyzing the results of large-scale crawling of benign domains.

[0180] To do this, we randomly sampled 60,848 (9.66%) of the 629,843 URLs on the Alexa Top One Million Domain List and visited them using both the default browser and the standard browser.

[0181] We visited the site using two browsers with existing sessions similar to the user's browser, and compared the HTML similarity of the resulting web page screenshots and visited URLs. The results are shown in Table 4 below.

[0182] [Table 4]

[0183] 0.25% (150) use other layouts and 0.20% (124) block access to this browser.

[0184] First, we manually inspected the results to see why the browser displayed a different layout than the base browser. We found that while screenshots and HTML differed between visits to the browser, these differences did not affect the use of the website.

[0185] Figures 7 and 8 show common differences in browser rendering between the base browser visit and the actual browser visit. For example, a web page renders differently in terms of screenshot similarity between the base browser visit shown in Figure 7a and the actual browser visit shown in Figure 7b.

[0186] Here, the differences between FIG. 7a and FIG. 7b are the button shapes, different background colors and content spacing.

[0187] Referring to Figure 8, in the basic browser of Figure 8a, a window requesting permission to use cookies pops up, but in the visit via the main browser of Figure 9b, the pop-up is not allowed.

[0188] The cookie request popup missing in this browser in Figure 8b is not due to an extension; the popup only appeared three times in 10 visits with other basic browsers.

[0189] Meanwhile, to further evaluate the potential impact of the present invention on non-malicious websites, an experiment was conducted in which 629,843 non-malicious websites on the Alexa Top One Million Domain List were visited.

[0190] Through experiments, we found that only 3,023 (0.48%) of harmless websites were blocked or displayed a different web page layout in this browser.

[0191] This result confirms previous findings that most harmless websites do not block the browser's visits and do not deliver web page content to the browser that differs from normal visits.

[0192] And some benign websites are built on web hosting services such as Cloudflare and Akamai, which include security mechanisms such as DDoS prevention and crawling prevention.

[0193] Therefore, to ensure users can successfully visit such websites with the protection of the browser, we used the browser to visit 5,000 Cloudflare-based and 5,000 Akamai-based harmless websites.

[0194] A total of 99.86% of 10,000 websites were successfully visited, and 14 good sites could not be accessed.

[0195] This is mainly due to the use of traffic filtering mechanisms by website owners via CDNs, and we have confirmed that with such a low false positive rate, users can successfully visit most benign websites hosted on CDNs.

[0196] Incorrectly avoided harmless websites can be reported to the browser provider, who can then check them asynchronously and force the browser to visit the website using a basic profile.

[0197] Although various embodiments of the present invention have been illustrated and described above, the present invention is not limited to the specific embodiments described above, and various modifications may be made by a person having ordinary skill in the art to which the invention pertains without departing from the gist of the present invention as claimed in the claims, and these modifications should not be understood separately from the technical idea or perspective of the present invention. [Explanation of symbols]

[0198] 100 Phishing Attack Prevention Device 110 Communications Department 130 Storage section 131 Fingerprint Database Department 133 Anti-phishing bot profile database section 150 control section 151 Comparison Section 153 Breaker 155 Past History Check Section 157 Profile Management Department 159 Classification Department

Claims

1. A phishing attack prevention method in a phishing attack prevention device for protecting a user browser from phishing attacks by phishing websites that utilize fingerprint-based concealment techniques, comprising: connecting to a Uniform Resource Locator (URL) via the user browser; Setting fingerprint-based cloaking in the user browser to disguise the user browser as a crawler; receiving web page content from the phishing website corresponding to the URL; phishing attack prevention methods, including

2. The step of disguising the crawler includes: comparing the URL with a pre-established blacklist; If the URL is included in the blacklist, blocking the connection of the URL; If the URL is not included in the blacklist, querying a pre-established fingerprint database to check the past history of the URL; The method of claim 1 , comprising:

3. In the step of disguising the crawler, If the step of checking the past history confirms that a phishing attack on the URL has been successfully prevented, the step of maintaining a profile of the user browser disguises the user browser as the crawler; The method of claim 2, further comprising: modifying a profile of the user browser to disguise the user browser as the crawler if a history of successfully preventing a phishing attack on the URL is not confirmed.

4. modifying the user browser profile, The method for preventing phishing attacks according to claim 3, further comprising: modifying a bot profile included in the user browser profile based on a pre-established anti-phishing bot profile database.

5. 4. The method for preventing phishing attacks according to claim 3, further comprising the step of requesting a HyperText Transfer Protocol (HTTP) including the maintained or modified user browser profile from the server side of the phishing website after the step of disguising the crawler.

6. The phishing attack prevention method includes: After receiving the web page content, classifying the web page content as phishing content using a classification engine running in the background; The method of claim 5 , further comprising: updating the fingerprint database with the connected URL, the modified user browser profile, and the classification result of the web page content.

7. 10. A computer-readable recording medium having recorded thereon a computer program for carrying out the method for preventing phishing attacks according to claim 1.

8. A phishing attack prevention device for protecting a user browser from phishing attacks by phishing websites that utilize fingerprint-based concealment techniques, comprising: a communication unit that connects to a URL via the user browser and receives web page content from a phishing website corresponding to the URL; a control unit that sets fingerprint-based cloaking in the user browser to disguise the user browser as a crawler; phishing attack prevention device, including

9. The control unit a comparison unit that compares the URL with a pre-established blacklist; a blocking unit that blocks a connection to the URL when the URL is included in the blacklist; a history checking unit that checks the history of the URL by querying a pre-established fingerprint database if the URL is not included in the blacklist; The phishing attack prevention device of claim 8, comprising:

10. The control unit If the history checking unit checks that a phishing attack on the URL has been successfully prevented, the user browser is disguised as the crawler by maintaining a profile of the user browser; 10. The phishing attack prevention device of claim 9, further comprising a profile management unit that changes the profile of the user browser to disguise the user browser as the crawler if a history of successfully preventing a phishing attack on the URL is not confirmed.

11. The profile management unit The phishing attack prevention device of claim 10, further comprising: modifying a bot profile included in the user browser profile based on a pre-established anti-phishing bot profile database.

12. The control unit The phishing attack prevention device according to claim 10, wherein after the crawler is disguised, a HyperText Transfer Protocol (HTTP) including the maintained or modified user browser profile is requested from the server side of the phishing website.

13. The control unit The method further includes a classification unit that classifies the web page content into phishing content using a classification engine that runs in the background after receiving the web page content, The control unit The phishing attack prevention device according to claim 12 , further comprising: updating the fingerprint database with the connected URL, the modified user browser profile, and the classification result of the web page content.

Images