Information processing apparatus, determination method, and program

Abstract

To provide an information processor or the like capable of contributing to efficient discovery of a phishing site without preparing information related to a regular site in advance.SOLUTION: The information processing device includes an information acquisition unit configured to acquire suspected site information, an element extraction unit configured to extract a predetermined element in the suspected site information, and a similarity determination unit configured to calculate a similarity of a character string between a predetermined domain of a URL in the predetermined element and a predetermined domain of a URL in the suspected site information or a similarity of a character string between all or any of the predetermined elements and determine whether or not a site related to the suspected site information is a phishing site based on whether or not the similarity is within a preset numerical range.SELECTED DRAWING: Figure 11

Description

[Technical Field]

[0001] The present invention relates to an information processing device, Determination method and program Regarding. [Background technology]

[0002] In recent years, phishing sites (fake sites) that resemble legitimate web pages and domains have become increasingly sophisticated, making it difficult to distinguish them from legitimate websites and domains. Criminals attempt to steal personal information such as authentication credentials and credit card information through phishing sites. In particular, phishing sites that resemble websites operated by legitimate companies pose a problem in that their existence increases the reputation risk of legitimate companies. Therefore, in order to take down and eradicate such phishing sites, a system is needed that can search for and detect phishing sites on the Internet.

[0003] As a mechanism for searching and detecting phishing sites, for example, there is a method of determining whether a site to be inspected (suspected phishing site) is a phishing site by comparing the similarity between pre-registered information about legitimate sites (e.g., feature vectors, CSS (Cascading Style Sheets), logo images, etc.) and information about the site to be inspected (suspected phishing site) (see, for example, Patent Document 1, Non-Patent Documents 1 and 2). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] International Publication No. 2020 / 044469 [Non-patent literature]

[0005] [Non-Patent Document 1] J. Mao, W. Tian, ​​P. Li, T. Wei and Z. Liang, "Phishing-Alarm: Robust and Efficient Phishing Detection via Page Component Similarity", in IEEE Access, vol. 5, pp. 17020-17030, 2017. [Non-patent document 2] O. Asudeh and M. Wright, POSTER: Phishing Website Detection with a Multiphase Framework to Find Visual Similarity. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS '16). ACM, New York, NY, USA, 1790-1792. 2016. Summary of the Invention [Problem to be solved by the invention]

[0006] The following analysis is provided by the present inventors.

[0007] However, the methods described in Patent Document 1 and Non-Patent Documents 1 and 2 require the preparation or definition of information related to legitimate sites in advance, and therefore cannot be said to be an efficient method for finding phishing sites that proliferate indiscriminately on the Internet.

[0008] The main object of the present invention is to provide an information processing device, a phishing site detection method, and a program that can contribute to efficiently detecting phishing sites without having to prepare information related to legitimate sites in advance. [Means for solving the problem]

[0009] An information processing device according to a first aspect includes an information acquisition unit configured to acquire suspect site information, an element extraction unit configured to extract specified elements from the suspect site information, and a similarity determination unit configured to calculate the similarity of character strings between a specified domain of a URL in the specified element and a specified domain of a URL in the suspect site information, or the similarity of character strings between all or any of the specified elements, and determine whether the site related to the suspect site information is a phishing site based on whether the similarity is within a predetermined numerical range. Furthermore, as a further embodiment of the first aspect, there is provided an information processing device including an extraction unit that extracts from an email a first element that is at least part of information representing a link destination and a second element that is written in a position different from the information representing the link destination, and a determination unit that determines whether the email is a phishing email based on the similarity between the first element and the second element.

[0010] A phishing site detection method according to a second aspect is a phishing site detection method that uses hardware resources to detect phishing sites, and includes the steps of acquiring suspect site information, extracting specified elements from the suspect site information, calculating the string similarity between a specified domain of the URL in the specified element and a specified domain of the URL of the suspect site information, or calculating the string similarity between all or any of the specified elements, and determining whether the site related to the suspect site information is a phishing site based on whether the similarity is within a predetermined numerical range. Furthermore, as a further embodiment of the second aspect, there is provided a determination method executed by a computer having one or more processors and a storage device that stores instructions to be executed by the one or more processors, the determination method including the steps of extracting from an email a first element that is at least part of information representing a link destination and a second element that is written in a position different from the information representing the link destination, and determining whether the email is a phishing email based on the similarity between the first element and the second element.

[0011] The program relating to the third aspect is a program that causes hardware resources to execute a process for detecting phishing sites, and causes the hardware resources to execute the following processes: a process for acquiring suspect site information; a process for extracting specified elements within the suspect site information; a process for calculating the similarity of strings between a specified domain of the URL in the specified element and a specified domain of the URL of the suspect site information, or the similarity of strings between all or any of the specified elements; and a process for determining whether the site related to the suspect site information is a phishing site based on whether the similarity is within a predetermined numerical range. Furthermore, as a further embodiment of the third aspect, there is provided a program executed by a computer having one or more processors and a storage device that stores instructions to be executed by the one or more processors, the program causing the one or more processors to execute a process of extracting from an email a first element that is at least part of information representing a link destination and a second element that is written in a position different from the information representing the link destination, and a process of determining whether the email is a phishing email based on the similarity between the first element and the second element.

[0012] The program can be recorded on a computer-readable storage medium. The storage medium can be a non-transient medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. The present disclosure can also be embodied as a computer program product. The program is input to a computer device from an input device or an external device via a communication interface, stored in a storage device, and drives a processor according to predetermined steps or processes. The processing results, including intermediate states as needed, can be displayed at each stage on a display device, or the computer device can communicate with the outside world via the communication interface. For example, a computer device for this purpose typically includes a processor, a storage device, an input device, a communication interface, and, if necessary, a display device, all of which can be connected to each other via a bus. [Effects of the Invention]

[0013] The first to third aspects can contribute to the efficient detection of phishing sites without having to prepare information about legitimate sites in advance. [Brief explanation of the drawings]

[0014] [Figure 1] 1 is a block diagram schematically illustrating the configuration of an information processing device according to a first embodiment. [Figure 2] FIG. 10 is an image diagram illustrating an example of a phishing site login screen of a suspected site for which phishing site detection processing is performed by the information processing device according to the first embodiment. [Figure 3] 4 is an image diagram schematically illustrating an example of the operation of an element determining unit in the information processing device according to the first embodiment. FIG. [Figure 4] 4 is an image diagram schematically illustrating an example of the operation of a domain similarity determination unit in the information processing device according to the first embodiment. FIG. [Figure 5] 4 is a flowchart schematically illustrating the operation of a phishing site detection unit of the information processing device according to the first embodiment. [Figure 6]FIG. 10 is a block diagram schematically illustrating the configuration of an information processing device according to a second embodiment. [Figure 7] 10 is an image diagram schematically illustrating an example of the operation of an element complementing unit in the information processing device according to the second embodiment. FIG. [Figure 8] 10 is an image diagram schematically illustrating an example of the operation of an element similarity determination unit in the information processing device according to the second embodiment. FIG. [Figure 9] 10 is a flowchart schematically illustrating the operation of the information processing device according to the second embodiment. [Figure 10] FIG. 10 is a transition diagram illustrating the operation of the information processing device according to the second embodiment in the case of a suspicious email. [Figure 11] FIG. 10 is a block diagram schematically illustrating the configuration of an information processing device according to a third embodiment. [Figure 12] FIG. 2 is a block diagram illustrating a configuration of hardware resources. DETAILED DESCRIPTION OF THE INVENTION

[0015] Hereinafter, embodiments will be described with reference to the drawings. Note that, where reference numerals are used in this application, they are intended solely to facilitate understanding and are not intended to limit the present invention to the illustrated embodiments. Furthermore, the following embodiments are merely illustrative and do not limit the present invention. Furthermore, connecting lines between blocks in the drawings, etc., referred to in the following description, include both bidirectional and unidirectional lines. Unidirectional arrows are used to schematically indicate the flow of main signals (data) and do not exclude bidirectionality. Furthermore, although not explicitly shown, input and output ports exist at the input and output ends of each connecting line in the circuit diagrams, block diagrams, internal configuration diagrams, connection diagrams, etc., shown in this disclosure. The same applies to input and output interfaces. A program is executed via a computer device, which includes, for example, a processor, a storage device, an input device, a communication interface, and, if necessary, a display device. The computer device is configured to communicate with internal or external devices (including computers) via the communication interface, whether wired or wireless.

[0016] [Embodiment 1] An information processing device according to a first embodiment will be described with reference to the drawings. FIG. 1 is a block diagram schematically showing the configuration of the information processing device according to the first embodiment. FIG. 2 is an image diagram schematically showing an example of a phishing site login screen of a suspected site for which phishing site detection processing is performed in the information processing device according to the first embodiment. FIG. 3 is an image diagram schematically showing an example of the operation of an element determination unit in the information processing device according to the first embodiment. FIG. 4 is an image diagram schematically showing an example of the operation of a domain similarity determination unit in the information processing device according to the first embodiment.

[0017] The information processing device 10 is a device that processes information (see FIG. 1). The information processing device 10 may be, for example, a personal computer, a tablet terminal, a smartphone, or the like. The information processing device 10 can communicate with a server device (not shown) via a network (not shown) and can transmit information to the server device and acquire site information (legitimate site information, suspect site information, fraudulent site information, etc.) provided by the server device. The information processing device 10 has a function to display the acquired site information. The information processing device 10 has a function to transmit information entered in an input field for the acquired site information to a linked server device. The information processing device 10 has a function to display site information (site information provided by the server device) of a URL (Uniform Resource Locator) of the hyperlink destination by operating (e.g., clicking, tapping, etc.) a hyperlink in the acquired site information. The information processing device 10 has a function to detect whether the acquired site information (the site related to the suspect site information 1) is a phishing site (a fake site that resembles legitimate site information or a domain). The information processing device 10 includes a communication unit 11, an input unit 12, an output unit 13, a storage unit 14, and a control unit 15.

[0018] Here, the suspect site information 1 may be acquired from a server device (not shown) via a network (not shown). The suspect site information 1 may also be information acquired by accessing a hyperlink in a phishing email (not shown). For example, as shown in FIG. 2, the suspect site information 1 may include a new registration button 41 that transitions to a new registration page of a legitimate site, an email address input field 42, a password input field 43, a login button 44 that transmits login information (email address and password in this case) to the suspect site, a forgotten password button 45 that transitions to a password reset page of the legitimate site, and a terms of use / privacy policy button 46 that transitions to a terms of use / privacy policy page of the legitimate site.

[0019] The communication unit 11 is a functional unit that communicates information (wired communication or wireless communication) (see FIG. 1). The communication unit 11 is communicably connected to a network (not shown). The communication unit 11 communicates under the control of the control unit 15. The communication unit 11 can receive the suspect site information 1. The communication unit 11 can transmit information entered in an input field of the suspect site information 1 to a linked server device. The communication unit 11 can access a hyperlink destination in the suspect site information 1 and receive information on the URL of the hyperlink destination.

[0020] The input unit 12 is a functional unit that inputs information (character input, voice input, operation input, etc.) (see FIG. 1). The input unit 12 performs input under the control of the control unit 15. For example, a touch panel, a mouse, a keyboard, a microphone, a gesture sensor, etc. can be used as the input unit 12.

[0021] The output unit 13 is a functional unit that outputs information (display output, audio output, etc.) (see FIG. 1). The output unit 13 performs output under the control of the control unit 15. As the output unit 13, for example, a display, a speaker, etc. can be used.

[0022] The storage unit 14 is a functional unit that stores information (including data and programs) (see FIG. 1). The storage unit 14 stores information under the control of the control unit 15.

[0023] The control unit 15 is a functional unit that controls the communication unit 11, the input unit 12, the output unit 13, and the storage unit 14 (see FIG. 1). The control unit 15 may be, for example, a processor such as a CPU (Central Processing Unit) or an MPU (Micro Processor Unit). The control unit 15 executes a predetermined program stored in the storage unit 14, thereby performing predetermined information processing described in the program. The control unit 15 includes a browsing processing unit 20 and a phishing site detection unit 30.

[0024] The browsing processing unit 20 is a functional unit that performs various processes related to browsing of site information (such as transmission and reception, browsing, and input / output) (see FIG. 1). The browsing processing unit 20 may be implemented, for example, by running browsing software. A phishing site detection unit 30 is plugged into the browsing processing unit 20.

[0025] The phishing site detection unit 30 is a functional unit that detects whether the suspect site information 1 being browsed is information related to a phishing site (see FIG. 1). The phishing site detection unit 30 determines whether a suspect site is a phishing site by detecting a homograph attack that deceives the user's vision by extracting a predetermined element (here, a predetermined domain in the URL (a unique part (identifiable part) of the entire domain)) from the suspect site information 1 and determining the similarity. The phishing site detection unit 30 can be implemented by executing a predetermined program, tool, script, shell, command, etc. The phishing site detection unit 30 can be plugged into the browsing processing unit 20. The phishing site detection unit 30 includes an information acquisition unit 31, an element extraction unit 32, an element determination unit 33, and a domain similarity determination unit 34.

[0026] Here, we assume that phishing sites are created by using legitimate sites and do not provide content that is not directly related to the criminals' objectives. This is because criminals' objectives are to steal authentication information, credit card information, etc., and providing content that is not directly related to achieving these objectives requires resources and effort. We also assume that phishing sites use domains with similar character strings to legitimate sites. This is a technique used by criminals to prevent targets from identifying a phishing site from the URL character string.

[0027] The information acquisition unit 31 is a functional unit that acquires suspect site information 1 (for example, website content (HTML information)) being viewed by the browsing processing unit 20 (see FIG. 1). The information acquisition unit 31 passes the acquired suspect site information 1 to the element extraction unit 32.

[0028] The element extraction unit 32 is a functional unit that extracts predetermined elements (here, link elements within the suspect site information 1) from the suspect site information 1 acquired by the information acquisition unit 31 (see Figure 1). As a method of extracting predetermined elements, for example, link elements are extracted as predetermined elements from the suspect site information 1 (HTML information) using HTML tags (e.g., strings beginning with http(s), link rel, Img src, href, background-image:url, etc.). Here, link elements do not include the URL of the suspect site information 1 itself, which is not set as a link destination. The element extraction unit 32 passes the extracted predetermined elements to the element determination unit 33.

[0029] The element determination unit 33 is a functional unit that determines whether a URL exists in the predetermined element extracted by the element extraction unit 32 (see FIG. 1). If a URL exists in the predetermined element extracted by the element extraction unit 32, the element determination unit 33 passes the URL to the domain similarity determination unit 34. If a URL does not exist in the predetermined element extracted by the element extraction unit 32, the element determination unit 33 determines that the site related to the suspect site information 1 is not a phishing site. For example, as in Example 1-1 of FIG. 3, if the predetermined elements extracted by the element extraction unit 32 are "https: / / www.nec.com / xxxx" and "https: / / www.example.com / yyyy," a URL exists, and the URL is passed to the domain similarity determination unit 34. As in Example 1-2 of FIG. 3, if no predetermined element is extracted by the element extraction unit 32, no URL exists, and the element determination unit 33 determines that the site related to the suspect site information 1 is not a phishing site. If the predetermined elements extracted by the element extractor 32 are only elements other than a URL, there is no URL, and therefore it is determined that the site related to the suspected site information 1 is not a phishing site.

[0030] The domain similarity determination unit 34 is a functional unit that calculates the similarity of character strings between a predetermined domain of the URL from the element determination unit 33 (the URL of the link destination in the suspect site information 1) and a predetermined domain of the URL of the suspect site information 1 itself, and determines whether the site related to the suspect site information 1 is a phishing site based on whether the similarity is within a preset numerical range (see FIG. 1). From the URL from the element determination unit 33 (the URL of the link destination in the suspect site information 1), the domain similarity determination unit 34 extracts the scheme (http: / / ), host (www), top-level domain (com, jp, etc.), second-level domain (co, ac, go, etc.) that represents the organizational attribute if there is an organizational attribute, and predetermined domain excluding directories (e.g., third-level domain, second-level domain that does not represent the organizational attribute, etc.). The domain similarity determination unit 34 obtains the URL of the suspect site information 1 itself from the information acquisition unit 31, and extracts from the obtained URL a predetermined domain (e.g., a third-level domain, a second-level domain that does not represent an organizational attribute, etc.) excluding the scheme (http: / / ), host (www), top-level domain (generic top-level domains (gTLDs) such as .com, .net, .org, etc., and country code top-level domains (ccTLDs) such as .jp, .uk, .fr), and second-level domains that represent organizational attributes (e.g., .co, .ac, .go, etc.). The extracted predetermined domain may include subdomains if the URL contains subdomains. The domain similarity determination unit 34 calculates the similarity X between the predetermined domain of the URL of the linked URL in the extracted suspect site information 1 and the predetermined domain of the URL of the extracted suspect site information 1 itself. Any method may be used to calculate the similarity of character strings, such as Gestalt pattern matching, Levenshtein distance, Jaro-Winkler distance, or image comparison. The similarity X ranges from 0 to 1, with 1 indicating the same and 0 indicating dissimilarity. The domain similarity determination unit 34 determines whether the calculated similarity X is greater than or equal to a threshold and less than 1. The threshold is a preset value.If there are multiple calculated similarities, the domain similarity determination unit 34 determines whether each similarity is equal to or greater than the threshold and less than 1. If similarity X is equal to or greater than the threshold and less than 1 (if there are multiple similarities, at least one similarity is equal to or greater than the threshold and less than 1), the domain similarity determination unit 34 determines that the site related to suspect site information 1 is likely to be a phishing site and causes the output unit 13 to output a warning indicating that the site related to suspect site information 1 is likely to be a phishing site. The warning may be output by any method, such as a pop-up display or audio output. If similarity X is not equal to or greater than the threshold and less than 1 (if similarity X is less than the threshold or 1, or if there are multiple similarities, all similarities are less than the threshold or 1), the domain similarity determination unit 34 determines that the site related to suspect site information 1 is not a phishing site.

[0031] As an example of the operation of the domain similarity determination unit 34, for example, as shown in Example 2-1 of Figure 4, if the URL received from the element determination unit 33 is "https: / / www.nec.com / xxxx," the domain of the suspect site is "example.co.jp," and the threshold is 0.8, the specified domain of the suspect site that is the source of comparison will be "example," and the specified domain of the link destination of the suspect site that is the target of comparison will be "nec," and when the similarity between the source of comparison and the target of comparison is calculated, it will be, for example, 0.01 (depending on the calculation method), and since the similarity of 0.01 is greater than or equal to the threshold of 0.8 and not less than 1, the suspect site is determined to be not a phishing site.

[0032] Furthermore, for example, as in Example 2-2 of Figure 4, if the URLs received from the element determination unit 33 by the domain similarity determination unit 34 are "https: / / www.nec.com / xxxx" and "https: / / www.example.com / yyyy," the domain of the suspect site is "example.co.jp," and the threshold is 0.8, the specified domain of the suspect site that is the source of comparison will be "example," and the specified domains linked to by the suspect site that is the target of comparison will be "nec" and "example," and when the similarity between the source of comparison and the target of comparison is calculated, it will be, for example, 0.01 and 1.0 (depending on the calculation method), and both similarities of 0.01 and 1.0 are greater than the threshold of 0.8 and not less than 1, so it is determined that the suspect site is not a phishing site.

[0033] Furthermore, for example, as in Example 2-3 of Figure 4, if the URLs received by the domain similarity determination unit 34 from the element determination unit 33 are "https: / / www.nec.com / xxxx" and "https: / / www.example.co.jp / yyyy," the domain of the suspect site is "exarnple.co.jp," and the threshold is 0.8, the specified domain of the suspect site that is the source of comparison will be "exarnple," and the specified domains linked to by the suspect site that is the target of comparison will be "nec" and "example." When the similarity between the source of comparison and the target of comparison is calculated, it will be, for example, 0.015 and 0.95 (depending on the calculation method), and a similarity of 0.015 is greater than or equal to the threshold of 0.8 and not less than 1, but a similarity of 0.95 is greater than or equal to the threshold of 0.8 and less than 1, so it is determined that the suspect site is highly likely to be a phishing site.

[0034] The operation of the information processing device according to the first embodiment will be described with reference to the drawings. Fig. 5 is a flow chart that schematically illustrates the operation of the phishing site detection unit of the information processing device according to the first embodiment. Please refer to Fig. 1 for the configuration of the information processing device.

[0035] First, the information acquisition unit 31 of the phishing site detection unit 30 of the information processing device 10 acquires the suspected site information 1 that is being browsed by the browse processing unit 20 (step A1).

[0036] Next, the element extraction unit 32 of the phishing site detection unit 30 extracts a predetermined element (here, the URL of the link destination in the suspect site information 1) from the suspect site information 1 acquired by the information acquisition unit 31 (step A2).

[0037] Next, the element determination unit 33 of the phishing site detection unit 30 determines whether or not a linked URL exists in the predetermined element extracted by the element extraction unit 32 (step A3). If a linked URL does not exist (NO in step A3), the process proceeds to step A10.

[0038] If a linked URL exists (YES in step A3), the domain similarity determination unit 34 of the phishing site detection unit 30 extracts the scheme (http: / / ), host (www), top-level domain (com, jp, etc.), second-level domain (co, ac, go, etc.) that represents the organizational attributes if any, and a specified domain excluding directories (e.g., third-level domain, second-level domain that does not represent the organizational attributes, etc.) from the linked URL determined by the element determination unit 33 (the linked URL in the suspected site information 1) (step A4).

[0039] Next, the domain similarity determination unit 34 acquires the URL of the suspect site information 1 itself from the information acquisition unit 31, and extracts from the acquired URL predetermined domains (e.g., third-level domains, second-level domains that do not represent organizational attributes, etc.) excluding the scheme (http: / / ), host (www), top-level domain (com, jp, etc.), and, if there are organizational attributes, second-level domains that represent organizational attributes (co, ac, go, etc.) (step A5).

[0040] Next, the domain similarity determination unit 34 calculates the similarity X between the string of a specific domain of the URL of the link destination in the extracted suspicious site information 1 and the specific domain of the URL of the extracted suspicious site information 1 itself (step A6).

[0041] Next, the domain similarity determination unit 34 determines whether the calculated similarity X is equal to or greater than the threshold and less than 1 (step A7). If the similarity X is not equal to or greater than the threshold and less than 1 (NO in step A7), the process proceeds to step A11.

[0042] If the similarity X is equal to or greater than the threshold and less than 1 (YES in step A7), the domain similarity determination unit 34 determines that the site related to the suspect site information 1 is highly likely to be a phishing site (step A8).

[0043] Next, the domain similarity determination unit 34 outputs a warning from the output unit 13 to the effect that the site related to the suspected site information 1 is highly likely to be a phishing site (step A9), and then ends the process.

[0044] If the URL of the linked site does not exist (NO in step A3), the element determining unit 33 determines that the site related to the suspected site information 1 is not a phishing site (step A10), and then ends the process.

[0045] If the similarity X is equal to or greater than the threshold and is not less than 1 (NO in step A7), the domain similarity determination unit 34 determines that the site related to the suspected site information 1 is not a phishing site (step A11), and then ends the process.

[0046] According to the first embodiment, whether a site related to the suspect site information 1 is a phishing site is determined based on the similarity of the character string between a predetermined domain in the URL of the suspect site information 1 itself and a predetermined domain in the URL of a link destination in the suspect site information 1, which contributes to the efficient detection of phishing sites without the need to prepare information related to legitimate sites in advance. In other words, phishing sites on the Internet can be detected without the need to collect or define legitimate sites in advance.

[0047] [Embodiment 2] An information processing device according to the second embodiment will be described with reference to the drawings. Fig. 6 is a block diagram schematically showing the configuration of the information processing device according to the second embodiment. Fig. 7 is a conceptual diagram schematically showing an example of the operation of an element complementing unit in the information processing device according to the second embodiment. Fig. 8 is a conceptual diagram schematically showing an example of the operation of an element similarity determining unit in the information processing device according to the second embodiment.

[0048] The second embodiment is a modification of the first embodiment, and determines whether a site related to the suspect site information 1 is a phishing site based on the similarity of character strings between all (or some) of the elements extracted from the suspect site information 1. Furthermore, even if a relative path describing a relative location from the current location exists in the suspect site information 1, the URL is complemented to determine whether the site related to the suspect site information 1 is a phishing site. The information processing device 10 according to the second embodiment is similar to the information processing device (10 in FIG. 1) according to the first embodiment in terms of the communication unit 11, input unit 12, output unit 13, and memory unit 14, and is similar to the browsing processing unit 20 of the control unit 15, but differs in the way information is processed by the phishing site detection unit 30 of the control unit 15 (see FIG. 6).

[0049] The phishing site detection unit 30 includes an information acquisition unit 31, an element extraction unit 32, an element completion unit 35, and an element similarity determination unit 36. The information acquisition unit 31 is the same as the information acquisition unit (31 in FIG. 1) in the first embodiment.

[0050] The element extraction unit 32 is a functional unit that extracts predetermined elements (here, link elements, relative paths, and other character strings within the suspect site information 1) from the suspect site information 1 acquired by the information acquisition unit 31 (see FIG. 6). To extract the URL of the link destination within the suspect site information 1, for example, the link destination URL is extracted as a predetermined element from the suspect site information 1 (HTML information) using HTML tags (e.g., character strings beginning with http(s), link rel, Img src, href, background-image:url, etc.). Here, the link destination URL does not include the URL of the suspect site information 1 itself, which is not set as the link destination. Furthermore, to extract the relative path, for example, a relative path can be extracted using ". / " as a clue, but any method is acceptable. Furthermore, other character strings can be, for example, keywords. The element extraction unit 32 passes the extracted predetermined elements to the element completion unit 35. If the element extraction unit 32 is unable to extract a predetermined element, it may determine that the site related to the suspected site information 1 is not a phishing site and terminate the process.

[0051] The element completion unit 35 is a functional unit that completes a relative path so that it becomes a URL when the specific element extracted by the element extraction unit 32 has a relative path (see FIG. 6). The element completion unit 35 determines whether the specific element received from the element extraction unit 32 has a relative path. The presence of a relative path can be determined by any method, such as using ". / " as a clue. The element completion unit 35 completes a relative path so that it becomes a URL when the specific element extracted by the element extraction unit 32 has a relative path. As a completion method, the element completion unit 35 acquires the URL of the suspicious site information 1 from the information acquisition unit 31 and converts the ". / " portion of the relative path to the acquired URL. For example, as shown in Example 3 of FIG. 7, if the URL of the suspicious site information 1 is "https: / / www.example.co.jp / ", the relative path ". / login / " of the element (element before completion) extracted by the element extraction unit 32 is completed to "https: / / www.example.co.jp / login / " so that it becomes a URL. The element completion unit 35 passes the URL with the relative path completed as a predetermined element to the element similarity determination unit 36. The element completion unit 35 also passes the predetermined elements other than the relative path as they are to the element similarity determination unit 36. When the predetermined element extracted by the element extraction unit 32 does not have a relative path, the element completion unit 35 skips it and passes all of the predetermined elements as they are to the element similarity determination unit 36.

[0052] The element similarity determination unit 36 ​​is a functional unit that calculates the similarity of character strings between all (or some) of the predetermined elements acquired from the element completion unit 35 and determines whether the site associated with the suspect site information 1 is a phishing site (see FIG. 6). The element similarity determination unit 36 ​​searches for a URL in the predetermined elements acquired from the element completion unit 35, and if a URL is found, extracts the following predetermined elements from the URL (the URL of the link destination in the suspect site information 1): the scheme (http: / / ), the host (www), the top-level domain (com, jp, etc.), and, if an organizational attribute exists, a second-level domain (co, ac, go, etc.) that represents the organizational attribute, and a predetermined domain excluding a directory (e.g., a third-level domain, a second-level domain that does not represent the organizational attribute, etc.). The extracted predetermined domain may include a subdomain if the URL includes a subdomain. The element similarity determination unit 36 ​​calculates the similarity X of character strings between all (or some) of the predetermined elements. Any method may be used to calculate the similarity of character strings, such as Gestalt pattern matching, Levenshtein distance, Jaro-Winkler distance, or image comparison. Similarity X ranges from 0 to 1, where 1 indicates identity and 0 indicates dissimilarity. The element similarity determination unit 36 ​​determines whether at least one of the calculated similarities is equal to or greater than a threshold and less than 1. The threshold is a preset value. If there is at least one similarity equal to or greater than the threshold and less than 1, the element similarity determination unit 36 ​​determines that the site related to the suspected site information 1 is likely to be a phishing site, and outputs a warning from the output unit 13 indicating that the site related to the suspected site information 1 is likely to be a phishing site. The warning may be output by any method, such as a pop-up display or audio output. If there is no similarity equal to or greater than the threshold and less than 1, the element similarity determination unit 36 ​​determines that the site related to the suspected site information 1 is not a phishing site. When calculating the similarity of strings between some specified elements, elements that clearly do not include the domain (for example, keywords such as "Terms of Use") may be excluded and the similarity of strings between the remaining specified elements may be calculated.

[0053] As an example of the operation of the element similarity determination unit 36, for example, when the elements completed by the element completion unit 35 are "https: / / www.nec.com / xxxx," "https: / / www.exarnple.co.jp / login / ," "https: / / www.example.co.jp / yyyy," and "Terms of Use," as shown in Example 4 of Figure 8, and the threshold is 0.8, the element similarity determination unit 36 ​​converts the URL to a specified domain and calculates the similarity, which results in the table of Figure 8. Since there are two similarities that are greater than the threshold of 0.8 and less than 1 (the similarity between the combination of "exarnple" and "example," and the similarity between the combination of "example" and "exarnple"), the element similarity determination unit 36 ​​determines that the site related to suspect site information 1 is highly likely to be a phishing site.

[0054] The operation of the information processing device according to the second embodiment will be described with reference to the drawings. Fig. 9 is a flow chart schematically showing the operation of the information processing device according to the second embodiment. Fig. 10 is a transition diagram schematically showing the operation of the information processing device according to the second embodiment in the case of a suspicious email.

[0055] First, the information acquisition unit 31 of the phishing site detection unit 30 of the information processing device 10 acquires the suspected site information 1 that is being browsed by the browse processing unit 20 (step B1).

[0056] Next, the element extraction unit 32 of the phishing site detection unit 30 extracts predetermined elements (here, the URL of the link destination, relative path, and other character strings in the suspect site information 1) from the suspect site information 1 acquired by the information acquisition unit 31 (step B2).

[0057] Next, the element complementing unit 35 of the phishing site detecting unit 30 determines whether or not the predetermined element extracted by the element extracting unit 32 has a relative path (step B3). If there is no relative path (NO in step B3), the process proceeds to step B5.

[0058] If there is a relative path (YES in step B3), the element complementing unit 35 complements the relative path so that it becomes a URL (step B4).

[0059] After step B4, or if there is no relative path (NO in step B3), the element similarity determination unit 36 ​​of the phishing site detection unit 30 searches for a URL in the predetermined element acquired from the element completion unit 35, and if there is a URL, extracts the scheme (http: / / ), host (www), top-level domain (com, jp, etc.), second-level domain (co, ac, go, etc.) representing the organizational attribute if there is an organizational attribute, and predetermined domain excluding directories (for example, third-level domain, second-level domain not representing the organizational attribute, etc.) as predetermined elements from the URL (the URL of the link destination in the suspect site information 1) (step B5). Note that if there is no URL in the predetermined element acquired from the element completion unit 35, step B5 is skipped.

[0060] Next, the element similarity determination unit 36 ​​calculates the similarity X of the character strings between all (or some) of the predetermined elements (step B6).

[0061] Next, the element similarity determination unit 36 ​​determines whether or not there is at least one similarity among the calculated similarities that is equal to or greater than the threshold and less than 1 (step B7). If there is no similarity that is equal to or greater than the threshold and less than 1 (NO in step B7), the process proceeds to step B10.

[0062] If there is at least one similarity that is equal to or greater than the threshold and less than 1 (YES in step B7), the element similarity determination unit 36 ​​determines that the site related to the suspect site information 1 is highly likely to be a phishing site (step B8).

[0063] Next, the element similarity determination unit 36 ​​outputs a warning from the output unit 13 to the effect that the site related to the suspected site information 1 is highly likely to be a phishing site (step B9), and then ends the process.

[0064] If there is no similarity that is equal to or greater than the threshold and less than 1 (NO in step B7), the element similarity determination unit 36 ​​determines that the site related to the suspected site information 1 is not a phishing site (step B10), and then ends the process.

[0065] In the second embodiment described above, the target is suspect site information 1 that is suspected to be a phishing site, but the target can also be a suspect email that is suspected to be a phishing email, as shown in Figure 10. When an email body like that shown in Figure 10(A) is displayed by the browsing processing unit 20, the information acquisition unit 31 acquires the email source like that shown in Figure 10(B), the element extraction unit 32 extracts a predetermined element like that shown in Figure 10(C), and since the extracted predetermined element does not have a relative path, the processing by the element completion unit 35 is skipped, and the element similarity determination unit 36 ​​can determine the similarity between the predetermined elements like that shown in Figure 10(D).

[0066] Furthermore, the second embodiment can be used in combination with the first embodiment, thereby improving the accuracy of detecting phishing sites.

[0067] According to the second embodiment, whether a site related to the suspect site information 1 is a phishing site is determined based on the similarity of character strings between all or any of the predetermined elements extracted from the suspect site information 1. This contributes to the efficient detection of phishing sites without the need to prepare information related to legitimate sites in advance.

[0068] [Embodiment 3] An information processing device according to the third embodiment will be described with reference to the drawings. Fig. 11 is a block diagram showing a schematic configuration of the information processing device according to the third embodiment.

[0069] The information processing device 10 is a device that processes information. The information processing device 10 includes an information acquisition unit 31, an element extraction unit 32, and a similarity determination unit 37. The information acquisition unit 31 is configured to acquire suspect site information. The element extraction unit 32 is configured to extract predetermined elements from the suspect site information. The similarity determination unit 37 is configured to calculate the similarity of character strings between a predetermined domain of a URL in a predetermined element and a predetermined domain of a URL in the suspect site information, or the similarity of character strings between all or any of the predetermined elements. The similarity determination unit 37 is configured to determine whether a site related to the suspect site information is a phishing site based on whether the similarity is within a predetermined numerical range.

[0070] According to embodiment 3, whether a site related to suspect site information is a phishing site is determined based on the similarity of the string between a specified domain of the URL in a specified element and a specified domain of the URL in the suspect site information, or the similarity of the string between all or any of the specified elements. This contributes to the efficient detection of phishing sites without the need to prepare information related to legitimate sites in advance.

[0071] The information processing devices according to the first to third embodiments can be configured using so-called hardware resources (information processing devices, computers), and may be configured as shown in Fig. 12. For example, the hardware resources 100 include a processor 101, a memory 102, a network interface 103, and the like, which are interconnected by an internal bus 104.

[0072] 12 is not intended to limit the hardware configuration of the hardware resource 100. The hardware resource 100 may include hardware (e.g., an input / output interface) that is not shown. Furthermore, the number of units such as the processor 101 included in the device is not intended to be limited to the example shown in FIG. 12, and for example, multiple processors 101 may be included in the hardware resource 100. The processor 101 may be, for example, a central processing unit (CPU), a microprocessor unit (MPU), a graphics processing unit (GPU), or the like.

[0073] The memory 102 may be, for example, a random access memory (RAM), a read only memory (ROM), a hard disk drive (HDD), or a solid state drive (SSD).

[0074] The network interface 103 may be, for example, a LAN (Local Area Network) card, a network adapter, a network interface card, or the like.

[0075] The functions of the hardware resource 100 are realized by the processing modules described above. The processing modules are realized, for example, by the processor 101 executing a program stored in the memory 102. The programs can be updated by downloading them over a network or by using a storage medium that stores the programs. Furthermore, the processing modules may be realized by semiconductor chips. In other words, it is sufficient that the functions performed by the processing modules be realized by software being executed on some kind of hardware.

[0076] Some or all of the above embodiments may be described as, but are not limited to, the following supplementary notes.

[0077] [Appendix 1] an information acquisition unit configured to acquire suspect site information; ,before an element extraction unit configured to extract a predetermined element from the suspect site information; ,before a similarity determination unit configured to calculate the similarity of character strings between a predetermined domain of a URL in the predetermined element and a predetermined domain of a URL in the suspect site information, or the similarity of character strings between all or any of the predetermined elements, and determine whether the site related to the suspect site information is a phishing site based on whether the similarity is within a preset numerical range. Information that provides Information processing device. [Appendix 2] The predetermined element is a link element. ,before The similarity determination unit is configured to calculate a similarity between a character string of a predetermined domain of a URL in the predetermined element and a predetermined domain of a URL in the suspect site information, and determine whether the site related to the suspect site information is a phishing site. ,before The similarity determination unit ,before an element determination unit configured to determine whether a URL exists in the predetermined element; ,before a domain similarity determination unit configured to, when a URL exists in the predetermined element, calculate a similarity between a character string of a predetermined domain of the URL in the predetermined element and a predetermined domain of the URL in the suspect site information, and determine whether the site related to the suspect site information is a phishing site based on whether the similarity is within a preset numerical range. and equipped with 2. The information processing device according to claim 1. [Appendix 3] The element determination unit is configured to determine that the site related to the suspect site information is not a phishing site if there is no URL in the predetermined element or if the element extraction unit does not extract the predetermined element. With 3. The information processing device according to claim 2. [Appendix 4] The domain similarity determination unit is configured to extract a predetermined domain of a URL in the predetermined element and to extract a predetermined domain of a URL in the suspicious site information. With 4. The information processing device according to claim 2 or 3. [Appendix 5] Further provided with an output section ,before The domain similarity determination unit is configured to determine that the site related to the suspect site information is highly likely to be a phishing site when the similarity is within a preset numerical range, and to cause the output unit to output a warning that the site related to the suspect site information is highly likely to be a phishing site. With 5. The information processing device according to any one of claims 2 to 4. [Appendix 6] The domain similarity determination unit is configured to determine that the site related to the suspect site information is not a phishing site when the similarity is not within a preset numerical range. With 6. The information processing device according to any one of claims 2 to 5. [Appendix 7] The predetermined element is one of a link element, a relative path, and a character string. ,before The similarity determination unit is configured to calculate similarities between character strings of all or any of the predetermined elements and determine whether the site related to the suspect site information is a phishing site based on whether the similarities are within a preset numerical range. ,before The similarity determination unit ,before an element completion unit configured to, when the predetermined element has a relative path, complete the relative path so that it becomes a URL; ,before an element similarity determination unit configured to calculate the similarity of character strings between all or any of the predetermined elements after completion and determine whether the site related to the suspect site information is a phishing site based on whether the similarity is within a preset numerical range; and equipped with 2. The information processing device according to claim 1. [Appendix 8] The element similarity determination unit is configured to extract a predetermined domain of a URL in the predetermined element. With 8. The information processing device according to claim 7. [Appendix 9] further comprising an output unit; The element similarity determination unit is configured to determine that the site related to the suspect site information is highly likely to be a phishing site when the similarity is within a preset numerical range, and to cause the output unit to output a warning that the site related to the suspect site information is highly likely to be a phishing site. With 9. The information processing device according to claim 7 or 8. [Appendix 10] The element similarity determination unit is configured to determine that the site related to the suspect site information is not a phishing site when the similarity is not within a preset numerical range. With 10. The information processing device according to any one of claims 7 to 9. [Appendix 11] A phishing site detection method for detecting a phishing site using hardware resources, , covered A step of acquiring suspicious site information; ,before extracting a predetermined element from the suspect site information; ,before calculating a similarity of character strings between a predetermined domain of a URL in the predetermined element and a predetermined domain of a URL in the suspect site information, or a similarity of character strings between all or any of the predetermined elements; ,before a step of determining whether the site related to the suspect site information is a phishing site based on whether the similarity is within a predetermined numerical range. and including How to detect phishing sites. [Appendix 12] A program that causes hardware resources to execute a process for detecting phishing sites. , coveredThe process of acquiring suspicious site information ,before A process of extracting predetermined elements from the suspected site information; ,before A process of calculating the similarity of character strings between a predetermined domain of a URL in the predetermined element and a predetermined domain of a URL in the suspect site information, or the similarity of character strings between all or any of the predetermined elements; ,before A process for determining whether the site related to the suspect site information is a phishing site based on whether the similarity is within a predetermined numerical range. and The hardware resource is caused to execute Rup Program. [Appendix 13] an extracting unit that extracts, from one email, a first element that is at least a part of information that indicates a link destination and a second element that is written in a position different from the information that indicates the link destination; an information processing device comprising: a determination unit that determines whether the one email is a phishing email based on the similarity between the first element and the second element. [Appendix 14] The information processing device according to claim 13, wherein the first element and the second element are included in the body of the email or in the email source. [Appendix 15] 15. The information processing device according to claim 13, wherein the first element is a domain. [Appendix 16] 16. The information processing device according to claim 14, wherein the first element is a third level domain or a second level domain. [Appendix 17] 17. The information processing device according to any one of appendices 13 to 16, wherein the second element is a character string. [Appendix 18] A determination method executed by a computer having one or more processors and a storage device that stores instructions to be executed by the one or more processors, the determination method including the steps of: extracting from an email a first element that is at least part of information indicating a link destination and a second element that is written in a position different from the information indicating the link destination; and determining whether the email is a phishing email based on the similarity between the first element and the second element. [Appendix 19] A program executed by a computer having one or more processors and a storage device that stores instructions to be executed by the one or more processors, the program causing the one or more processors to execute the following processes: extracting from an email a first element that is at least part of information indicating a link destination and a second element that is written in a position different from the information indicating the link destination; and determining whether the email is a phishing email based on the similarity between the first element and the second element.

[0078] The disclosures of the above-mentioned patent and non-patent documents are incorporated herein by reference and may be used as the basis or part of the present invention, as necessary. Modifications and adjustments of the embodiments and examples are possible within the scope of the entire disclosure of the present invention (including the claims and drawings), and further based on the basic technical concepts thereof. Furthermore, various combinations and selections (or non-selections, as necessary) of the various disclosed elements (including each element of each claim, each element of each embodiment or example, each element of each drawing, etc.) are possible within the scope of the entire disclosure of the present invention. In other words, the present invention naturally includes various modifications and alterations that would be possible by a person skilled in the art in accordance with the entire disclosure and technical concepts, including the claims and drawings. Furthermore, with regard to the numerical values ​​and numerical ranges described in this application, any intermediate values, lower values, and smaller ranges are deemed to be included, even if not explicitly stated. Furthermore, the disclosures of the above-cited documents, when used in part or in whole in combination with the disclosures herein as part of the disclosure of the present invention, in accordance with the spirit of the present invention, are also deemed to be included in (belong to) the disclosures of this application. [Explanation of symbols]

[0079] 1. Suspect site information 10. Information processing equipment 11 Communications Department 12 Input section 13 Output section 14 Storage section 15 Control Unit 20 Browsing processing unit 30 Phishing site detection unit 31 Information Acquisition Department 32 Element Extraction Unit 33 Element judgment part 34 Domain similarity judgment section 35 Element Completion Section 36 Element similarity determination unit 37 Similarity determination unit 40 Login Screen 41 New registration button 42 Email address input field 43 Password entry field 44 Login button 45 Forgot Password Button 46 Terms of Use Privacy Policy Button 100 Hardware Resources 101 processors 102 memory 103 Network Interface 104 Internal Bus

Claims

[Claim 1] an information acquisition unit configured to acquire suspicious site information; an element extraction unit configured to extract a predetermined element from the suspect site information; a similarity determination unit configured to calculate the similarity of character strings between a predetermined domain of a URL in the predetermined element and a predetermined domain of a URL in the suspect site information, or the similarity of character strings between all or any of the predetermined elements, and determine whether the site related to the suspect site information is a phishing site based on whether the similarity is within a preset numerical range; An information processing device comprising:

Images