Trained model, site determination program, and site determination system

Abstract

To provide technology that contributes to prevention of phishing fraud damage.SOLUTION: When a learned logo or icon contained in a screenshot of a site at an input URL is detected by an object detection unit 10 (S36 in FIG. 7), compound determination is performed by a compound determination unit 50 based on the detection result and a white list stored in advance in a site information storage unit 20. When a logo or icon having a reliability degree exceeding a threshold is detected (S60: Yes), and when a domain or IP address of a server specified in the input URL does not exist in the white list (S62: No), it is determined that it is not an official site (S66), and it is output that there is a high suspicion of a phishing site (S42 in FIG. 7). In this way, it is possible to determine whether or not it is the official site before a user actually accesses the input URL and notify the user of the determination result, so that damage of phishing fraud can be prevented.SELECTED DRAWING: Figure 8

Description

[Technical field]

[0001] The present invention relates to a technique for determining whether or not a site is a phishing site. [Background technology]

[0002] Conventionally, there has been a never-ending stream of phishing sites on the Internet that pose as real organizations to steal personal information such as account IDs and passwords, ATM PIN numbers, and credit card numbers, and various measures have been taken to combat this. For example, a communication control device is known that stores URLs used in phishing scams in a phishing site list in advance, compares the URL a user is attempting to access with the URLs included in the phishing site list, and, if a match is found, prohibits access to the URL (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] International Publication No. 2006 / 087908 Summary of the Invention [Problem to be solved by the invention]

[0004] According to the above-mentioned prior art, it is considered possible to prohibit access to known phishing sites. However, since phishing sites rarely remain with the same URL in order to avoid tracking, and new URLs are often used for phishing scams, it is impossible to store the URLs of all phishing sites in a list in advance. Therefore, if the URL is not stored in the list, it is not possible to prohibit access even if it is a phishing site. In addition, in recent years, smartphones have rapidly spread to a wide range of generations, and there is a concern that the damage caused by phishing scams will further increase, so more reliable measures are required.

[0005] Therefore, an object of the present invention is to provide a technique that contributes to preventing damage caused by phishing fraud. [Means for solving the problem]

[0006] In order to solve the above problems, the present invention provides the following trained model, site determination program, and site determination system. Note that the following words in parentheses are merely examples, and the present invention is not limited thereto.

[0007] In other words, the trained model of the present invention is a trained model for causing a computer to function to detect a specified display included in an input image, which has been trained in advance using a screenshot image of a website, and which generates multiple feature maps by repeating the operations of convolving the input image to generate a first feature map of a specified size, convolving the first feature map to generate a second feature map, and convolving the previously generated feature map to generate a further feature map, and which causes a computer to function to detect a specified display included in the input image based on the multiple feature maps.

[0008] A website usually has a predetermined display (trademark, etc.), such as a logo or icon, that represents the company or service that operates the website. The trained model is trained in advance using screenshot images of the website, and can therefore accurately detect the predetermined display that is located on the website included in the input image. If the detected display is located on a website with a URL that is unrelated to the company or service that uses the display, the website is highly likely to be a phishing site. Therefore, the trained model can play a part in determining whether the website to be accessed is a phishing site or not, and can contribute to preventing phishing scams from occurring.

[0009] Preferably, in the above trained model, the website is an official website and a phishing site impersonating the official website.

[0010] There are official websites that are officially operated, and phishing sites that pretend to be official websites. Phishing sites are deliberately made to look exactly like official websites in order to trick visitors into thinking they are the official website, and generally have the same displays (logos, icons, etc.) as those on the official website. However, depending on the phishing site, the images of such displays may be rougher than those on the official website, or the appearance (size, color, shape, etc.) may be slightly changed.

[0011] Here, the trained model of the above aspect has been trained in advance using screenshot images of official websites and phishing sites, and can therefore accurately detect a predetermined display located on an official website or phishing site contained in an input image. Therefore, the trained model of the above aspect can play a part in determining whether a website to be accessed is an official website (whether it is not a phishing site) and can contribute to preventing phishing fraud damage.

[0012] More preferably, in the trained model, the predetermined size is equal to or larger than a half scale of the input image. Alternatively, in the trained model, when detecting a predetermined display included in the input image based on the first feature map, a plurality of types of rectangles with a reference length of 24 pixels are used.

[0013] In the trained model of this embodiment, the first feature map generated by convolving the input image, i.e., the largest feature map, is generated at a size equal to or larger than half the scale of the input image. Alternatively, for the first feature map, it is possible to detect objects from small regions by using a rectangle with a reference length of 24 pixels. Therefore, according to the trained model of this embodiment, it is possible to accurately detect small icons included in the input image.

[0014] The site determination program of the present invention is intended to cause a computer to function as a storage means for pre-storing information regarding official websites, a receiving means for receiving input of a URL, an acquisition means for acquiring a screenshot image of the URL's website, the above-mentioned trained model for detecting a specified display contained in the screenshot image, and a determination means for determining whether the URL's site is an official website based on the detection results of the specified display and the above-mentioned information.

[0015] In addition, the site determination system of the present invention includes a storage means for pre-storing information regarding official websites, a receiving means for receiving input of a URL, an acquisition means for acquiring a screenshot image of the website of the URL, the above-mentioned trained model for detecting a specified display contained in the screenshot image, and a determination means for determining whether the site of the URL is an official website or not based on the detection result of the specified display and the above-mentioned information.

[0016] In the site determination program and site determination system, information about official websites (a whitelist of domain names and IP addresses where official websites are published) is stored in advance in a storage means, and whether or not a website is official is determined based on this information and the detection result of a predetermined display by the trained model. Therefore, according to the above site determination program or site determination system, it is possible to determine whether or not a website a user is attempting to access is an official website (whether or not it is a phishing site) before the user actually accesses the website, and by issuing a notification according to the result, it is possible to prevent damage from phishing scams.

[0017] Preferably, the above-mentioned site determination program and site determination system further include an input means for inputting the screen shot image acquired by the acquisition means into the trained model without reducing it.

[0018] In the site determination program and site determination system of this aspect, the acquired screen shot image of the website is input to the trained model without being reduced. Therefore, according to the site determination program and site determination system of this aspect, even if the size of the screen shot image is large, the screen shot image can be folded into the feature map while maintaining the information of the entire screen shot image without degradation due to reduction, so that a predetermined display included in the screen shot image can be detected with high accuracy. Effect of the Invention

[0019] The present invention can contribute to preventing damage caused by phishing fraud. [Brief description of the drawings]

[0020] [Figure 1] FIG. 2 is a functional block diagram of an object detection model. [Diagram 2] FIG. 1 is a diagram showing an example of an official website and a fake website impersonating that website. [Diagram 3] 10 is a flowchart illustrating an example of a procedure for object detection processing. [Figure 4] FIG. 1 is a conceptual diagram illustrating the flow of an object detection process. [Diagram 5] FIG. 11 is a diagram illustrating an example of a detection result based on an object detection model. [Figure 6] FIG. 4 is a functional block diagram of a phishing site determination program. [Figure 7] 13 is a flowchart illustrating an example of a procedure for a phishing site determination process. [Figure 8] 13 is a flowchart illustrating an example of a procedure for compound determination processing. [Figure 9] FIG. 13 is a diagram (1 / 3) showing how the phishing site detection application is used. [Figure 10] FIG. 2 is a diagram (2 / 3) showing how the phishing site detection app is used. [Figure 11] FIG. 3 is a diagram (3 / 3) showing how the phishing site detection app is used. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0021] Hereinafter, embodiments of the present invention will be described with reference to the drawings. Note that the following embodiments are preferred examples, and the present invention is not limited to these examples.

[0022] [Object detection model] FIG. 1 is a functional block diagram of an object detection model 10.

[0023] The object detection model 10 is a trained model that has been trained in advance to detect objects (predetermined displays) such as logos and icons used as trademarks of specific companies or services contained in an input image, and is actually a program that executes an object detection algorithm developed based on the source code of OSS (open source software) and optimized for the embodiment. In this embodiment, a single shot multibox detector (SSD) is used as the object detection algorithm.

[0024] The object detection model 10 is composed of, for example, a learning result storage unit 11, an image input unit 12, a feature map generation unit 13, a detection unit 14, a detection result generation unit 15, and the like.

[0025] The learning result storage unit 11 stores the results of learning that has been performed in advance (learned parameters obtained by learning). In this embodiment, screenshots of official websites (hereinafter referred to as "official websites") operated by companies and services (shopping, SNS, file sharing, video distribution, banking, credit cards, electronic payments, etc.) that are likely to be misused in phishing scams, and phishing sites (hereinafter sometimes referred to as "fake sites") that impersonate these official websites are collected, and learning is performed in advance using these as learning data.

[0026] FIG. 2 shows an example of an official website and a fake website impersonating that website. For the sake of convenience, in the following explanation, it is assumed that a fictitious company "ZZZMAIL" provides the email service "ZZZMAIL." The site shown in Figure 2 and the logos and icons placed on the site are all fictitious and have been created for the purpose of explanation, and do not actually exist.

[0027] FIG. 2 (A): An example of an official website is shown. Official websites are published on a server with a domain or IP address owned by the company that provides the official website, and generally support encrypted communication. When such an official website is accessed with a browser, a URL starting with "https:" is displayed in the address bar, along with a lock symbol indicating that communication with the site is secure. The illustrated page displays the logo "ZZZMAIL" indicating the name of the company (service), an icon of three stacked Z's, and an input field for information required to sign in to the email service.

[0028] Figure 2 (B): An example of a fake website impersonating the above official website is shown. The fake website is created to look exactly like the official website to make people who access it believe that it is the official website, but the URL is naturally different from that of the official website. For example, fake websites do not support encrypted communications, and often contain the domain name of the official website as part of the URL.

[0029] In the fake site shown in Fig. 2(B), the page structure is almost the same as that of the official site, but depending on the fake site, for example, the position or aspect (size, color, shape, etc.) of the logo or icon indicating the name of the company (service) may be slightly changed, the image quality of these may be low, or the page structure may be changed (for example, the installation of an input field that does not exist on the official site). Therefore, in this embodiment, in order to enable highly accurate detection of logos and icons of companies (services) that are easily misused on fake sites, both the official site and the fake site are used as learning data, and the logos and icons contained on these sites are classified into classes as objects to be detected, and learning is performed in advance.

[0030] [Object Detection Processing] 3 is a flowchart showing an example of the procedure of the object detection process executed by the object detection model 10. Below, the details of the object detection process will be described along with the example of the procedure, and the roles of the above-mentioned functional units 11 to 15 will also be described.

[0031] Step S10: First, the image input unit 12 accepts an input of an image from outside the object detection model 10. In this embodiment, in order to improve the efficiency of the detection process, the external image is input to the object detection model 10 with a fixed size (512 × 512 pixels). Then, the image input unit 12 passes the input image (hereinafter referred to as the "input image") to the feature map generation unit 13.

[0032] Step S12: Next, the feature map generating unit 13 convolves the input image stepwise using a convolutional neural network to generate feature maps of multiple sizes. At this time, the feature map generating unit 13 first generates the largest feature map by convolving the input image using, for example, a VGG-16 network. The feature map generating unit 13 then repeats further convolutions and generates feature maps of different sizes through 39 layers.

[0033] In this embodiment, in order to enable accurate detection of small icons included in an image, the size of the largest feature map is made larger than that in the SSD released as OSS. Specifically, the size of the largest feature map for an input image of 512×512 pixels in SSD512 is 64×64 pixels, whereas in this embodiment, the size of the largest feature map for an input image of 512×512 pixels is, for example, 512×512 pixels.

[0034] Step S14: Next, the detection unit 14 detects objects corresponding to trademarks of specific companies or services included in the input image using the multiple feature maps generated by the feature map generation unit 13, predicts which class the detected objects belong to, and outputs the predicted class and the reliability of the prediction (hereinafter simply referred to as "reliability") for each object. At this time, the detection unit 14 detects objects using multiple types of rectangles (so-called "default boxes") defined with different aspect ratios based on a reference length for each feature map.

[0035] In this embodiment, six types of rectangles are defined. For example, in the case of a feature map of 512×512 pixels, detection is performed using six types of rectangles for each feature point (1×1 pixel) constituting the feature map, so the amount of calculation required for prediction per class is 512×512×6, and as a result, 512×512×6 detection region candidates can be obtained.

[0036] In addition, the six types of rectangular shapes are defined as (s,s), (s,2s), (2s,s), (s,s / 2), (s / 2,s), (√(s*s´), √(s*s´)), respectively, with the reference length being "s" and the shape being expressed as "(width, height)". "s´" refers to the reference length in the next layer feature map (the feature map one level smaller in size at the next higher level).

[0037] The value of the reference length s varies depending on the degree of convolution, and the higher the layer of the feature map (the smaller the size of the feature map), the larger the reference length s and therefore the larger the area surrounded by a rectangle (field of view). In this embodiment, the reference length s for the feature map in the lowest layer (largest size), i.e., the feature map with the smallest area surrounded by a rectangle (field of view), is 24 pixels when converted into an input image of 512 x 512 pixels.

[0038] Step S16: Finally, the detection result output unit 15 performs final adjustment based on the detection result by the detection unit 14, and outputs the class and reliability of each object. The final adjustment here refers to a well-known process (Non-Maximum Suppression) that adjusts rectangles into one when the same object is detected multiple times in different rectangles. The detection result output unit 15 outputs the class and reliability of each object detected in the rectangle after the final adjustment.

[0039] When the above steps are completed, the object detection process ends.

[0040] FIG. 4 is a conceptual diagram showing the flow of the object detection process.

[0041] When an image of a fixed size (512×512 pixels) is input to the object detection model 10, the input image is convolved stepwise to generate multiple feature maps (corresponding to step S12 in FIG. 3).

[0042] Specifically, first, an input image is convolved to generate a first feature map (e.g., 512×512 pixels). Next, the first feature map is convolved to generate a smaller second feature map (e.g., 256×256 pixels). Then, the second feature map is convolved to generate an even smaller third feature map (e.g., 128×128 pixels). Thereafter, smaller feature maps are generated one after another in the same manner by convolving the previously generated feature map.

[0043] The larger the size of each feature map, the smaller the area in the input image represented by each feature point constituting the feature map, and the smaller the size, the larger the area in the input image represented by each feature point. Thus, a large feature map is used for fine-grained detection, and a small feature map is used for coarse-grained detection.

[0044] When multiple feature maps of different sizes are generated, specific objects contained in the input image are detected using six types of rectangles defined based on the above-mentioned reference length s for these feature maps (object detection in FIG. 4: corresponding to step S14 in FIG. 3). Specifically, small objects are detected using large feature maps, and large objects are detected using small feature maps.

[0045] When a specific object is detected in the input image, final adjustments are made based on the detection results, and the class and confidence of each object are output (detection result output in Figure 4: corresponding to step S16 in Figure 3).

[0046] In this embodiment, a feature map of a very large size (e.g., 512 x 512 pixels: 1 / 1 scale of the input image) is generated for the input image, and objects are detected from this feature map using six types of rectangles with a reference length s of 24 pixels, allowing small icons contained in the image to be detected with high accuracy.

[0047] [Example of detection results] 5 is a diagram showing an example of a detection result by the object detection model 10. Here, an example is given to explain what kind of detection result is output when a screenshot of the fake site shown in FIG. 2(B) is acquired and input to the object detection model 10.

[0048] In addition, the rectangle drawn with a thick dashed line in the figure indicates that a specific object has been detected within this rectangle (hereinafter, this rectangle will be referred to as the "detection area.") In addition, the solid line surrounding the detection area is a frame showing the detection result, and at the top of the frame, the class to which the detected object is predicted to belong and its reliability are shown in the format of "class name: reliability."

[0049] As shown in Figure 5, four specific objects were detected from the screenshot of this fake website. Specifically, the detection result "icon_zzzmail:0.92" was output for the icon consisting of three Z's, and the detection result "logo_zzzmail:1.00" was output for the large logo "ZZZMAIL" located to the right of the logo. Furthermore, the detection result "logo_zzzmail:0.23" was output for the character string "zzzmail" in the email address shown as a legend in the email address input box located slightly below. Furthermore, the detection result "logo_zzzmail:0.87" was output for the character string "ZZZMAIL" in the copyright notice located in the lower right of the screenshot.

[0050] Thus, one object predicted to belong to the class "icon_zzzmail" and three objects predicted to belong to the class "logo_zzzmail" were detected from this fake site, but it can be seen that the reliability differs depending on the form of each logo or icon. For example, the character string "zzzmail" in an email address, which was calculated to have the lowest reliability among the four objects, is compared to the logo "ZZZMAIL" previously classified into a class, and while the character shape of the first half of the "zzz" part is similar, the character shape of the second half of the "mail" part is significantly different, so it is presumed that the reliability was calculated to be low based on the learning results. In contrast, the other three objects are almost identical in appearance to the logos and icons previously classified into classes, so it is presumed that the reliability was calculated to be high based on the learning results.

[0051] In this embodiment, as described above, screenshots of the official site and the fake site were used as learning data, and 80% of the entire learning data was used for learning and 20% was used for verification. At each stage of increasing the learning data, the precision rate (correct prediction rate) and recall rate (what percentage of the correct answer was correct (=reproduced) at the time of prediction) were calculated, and the F value (harmonic mean of the precision rate and recall rate) was measured as the detection accuracy. It was found that the detection accuracy improves as more learning data is added.

[0052] [Phishing site detection program] FIG. 6 is a functional block diagram of the phishing site determination program 100. As shown in FIG.

[0053] The phishing site determination program 100 is a program that determines whether or not a website that a user is attempting to access is a phishing site (whether or not it is an official website), and is configured to be operable on a computer (e.g., a mobile device such as a smartphone or tablet PC) with a general browsing function that a user uses when accessing a website. Furthermore, the phishing site determination program 100 is recognized by a user of such a computer as an application (hereinafter referred to as a "phishing site determination app").

[0054] The phishing site determination program 100 is composed of, for example, an object detection unit 10, a site information storage unit 20, a URL input unit 30, a site screen acquisition unit 40, a composite determination unit 50, and a determination result output unit 60. Of these, the object detection unit 10 is a unit in which the above-mentioned object detection model 10 is incorporated as part of the phishing site determination program 100. In addition, the site information storage unit 20 stores a whitelist that is registered in advance by visually checking domain names and IP addresses owned by companies that provide official sites.

[0055] [Phishing site determination process] 7 is a flowchart showing an example of the procedure of the phishing site determination process executed by the phishing site determination program 100. The phishing site determination process will be described in detail below along with the example of the procedure, and the roles of the above-mentioned functional units 10 to 60 will also be described.

[0056] Step S30: First, the URL input unit 30 accepts input of a URL from outside the phishing site determination program 100, and passes the input URL (hereinafter referred to as the "input URL") to the site screen acquisition unit 40. The URL input unit 30 supports iOS (registered trademark) universal links and Android (registered trademark) app links, and is capable of receiving a URL that is set as a link destination.

[0057] Steps S32 and S34: Next, the site screen acquisition unit 40 accesses the input URL and acquires a screenshot (step S32), resizes it to a predetermined size (512 x 512 pixels) if necessary (step S34), and inputs it to the object detection unit 10.

[0058] Specifically, when the acquired screenshot is smaller than the predetermined size, the site screen acquisition unit 40 resizes the screenshot to the predetermined size by filling blank areas that do not fit the predetermined size with 0 (black). On the other hand, when the acquired screenshot is larger than the predetermined size, the site screen acquisition unit 40 divides the screenshot to fit each divided piece to a predetermined size or less, and fills blank areas that do not fit the predetermined size with 0 (black), thereby resizing each divided piece to the predetermined size. Note that as long as the divided pieces fit to a predetermined size or less, the division method is not important. For example, when the size of the screenshot is 800×600 pixels, it may be divided into four equal pieces to generate divided pieces of 200×150 pixels, or larger divided pieces may be generated and some areas may overlap each other.

[0059] In this way, even if the screenshot is larger than a predetermined size, the information contained in the screenshot can be input as is to the object detection unit 10 without being degraded by reduction. Note that, in this embodiment, when the acquired screenshot is larger than a predetermined size, the screenshot is divided as described above, but it is also possible to reduce the screenshot to a predetermined size without dividing it and input it to the object detection unit 10.

[0060] Step S36: Upon receiving the screenshot, the object detection unit 10 detects logos and icons contained in the screenshot that are predicted to correspond to the learned classes.

[0061] Step S38: Next, the combined judgment unit 50 executes a combined judgment process. In this process, the combined judgment unit 50 performs a combined judgment as to whether or not the site of the input URL is a phishing site, based on the detection result of the logo and icon in the previous step S36 and the information on the official site stored in the site information storage unit 20. The specific contents of the combined judgment process will be described in detail later with reference to another flowchart.

[0062] Step S40: Then, the determination result output unit 60 executes a process according to the determination result in the previous step S38. Specifically, if the determination result output unit 60 determines that the site of the input URL is a phishing site (not an official site) (Step S40: Yes), it executes step S42. On the other hand, if the determination result output unit 60 determines that the site is not a phishing site (it is an official site) (Step S40: No), it executes step S44.

[0063] Step S42: The determination result output unit 60 outputs on the screen a message indicating that the site of the input URL is highly likely to be a phishing site.

[0064] Step S44: The determination result output unit 60 outputs on the screen a message indicating that the site of the input URL is an official site.

[0065] When the above steps are completed, the phishing site determination process ends.

[0066] In the above example procedure, in order to improve the efficiency of the detection process in the object detection unit 10, the site screen acquisition unit 40 resizes the acquired screenshot to a predetermined size before inputting it to the object detection unit 10. However, this is not limited to this, and it is also possible to input the acquired screenshot as is to the object detection unit 10.

[0067] [Composite Judgment Processing] 8 is a flowchart showing an example of a procedure of the combined judgment process executed in the course of the above-mentioned phishing site judgment process (step S38 in FIG. 7). The following is an explanation of the procedure.

[0068] Step S60: The combined judgment unit 50 checks whether a logo or icon with a reliability with respect to a learned object that exceeds a threshold (e.g., 0.8) has been detected. If the check results in a logo or icon with a reliability exceeding the threshold (step S60: Yes), the combined judgment unit 50 executes step S62. On the other hand, if no logo or icon has been detected (step S60: No), the combined judgment unit 50 executes step S64.

[0069] Step S62: The compound judgment unit 50 checks whether or not the domain or IP address of the server specified in the input URL is present on the whitelist, i.e., whether or not information on the domain or IP address of the server specified in the input URL is stored in the site information storage unit 20. If the check results in information being stored in the site information storage unit 20 (Step S62: Yes), the compound judgment unit 50 executes Step S64. On the other hand, if the information is not stored (Step S62: No), the compound judgment unit 50 executes Step S66.

[0070] Step S64: The composite judging unit 50 judges that the site of the input URL is not a phishing site (is an official site).

[0071] Step S66: The composite determination unit 50 determines that the site of the input URL is a phishing site (not an official site).

[0072] Step S68: The composite decision unit 50 outputs the decision result made in the above step S64 or step S66 to the caller.

[0073] When the above steps are completed, the compound determination process ends.

[0074] In this manner, in this embodiment, if even one logo or icon with a reliability exceeding a threshold, i.e., an indication of a well-known company (service), is detected from a site with a domain or IP address not on the whitelist, the site is determined to be a phishing site, and a screen is displayed indicating that the site is highly suspected to be a phishing site. Therefore, the risk of the site with a URL that the user is attempting to access can be determined and notified before the user actually accesses the site, making it possible to prevent damage from phishing fraud.

[0075] In addition, if the display of two different companies (services) is detected from a single site, such as a shopping site that is linked to an electronic payment service and a display of the shopping site and the electronic payment service, if the site's domain or IP address is on the whitelist, it will be determined not to be a phishing site and a screen will be displayed indicating that it is the official website.

[0076] [How to use the phishing site detection app] 9 to 11 are diagrams showing how the phishing site determination application is used on the smartphone SP.

[0077] Figure 9: An example of an email attempting to lead to a phishing site. The subject of this email is "Did you log in to [ZZZ]?" and the sender is "ZZZ Bank Online Support." The body of the email also contains an explanation that makes it seem as if a third party has logged into the recipient's ZZZ Bank account, followed by a link to a URL to confirm the account information.

[0078] Figure 10: When a link in the body of an email is pressed and held, a list of available options is displayed in a pop-up. When "Open with phishing site detection app" is selected from the list, the URL of the linked site is passed to the phishing site detection app (phishing site detection program 100). The phishing site detection app then starts up, and a determination is made as to whether the site at the URL is a phishing site or not.

[0079] In FIG. 11 (A): If the site is determined to be not an official site, the phishing site detection app displays the message "This site is highly suspected to be a phishing site and cannot be accessed."

[0080] In Figure 11 (B): On the other hand, if the site is determined to be an official site, the phishing site detection app will display the message "This site is an official site, so there is no problem accessing it," along with a button labeled "Access." By tapping this button, the user can safely access the site in the URL directly.

[0081] In the illustrated example, the application name is displayed as "phishing site detection app", but in reality, a unique name of the phishing site detection app will be displayed. Also, the configuration of the screen displayed after the detection is made by the phishing site detection app is merely an example, and is not limited to the above example.

[0082] In addition to the above examples, emails that try to lure users to phishing sites include messages such as "your account has been frozen," "your account will be closed soon," "a campaign limited to members is running," and "your password has been reset due to possible fraudulent use," all of which are cleverly written to make users feel as if they need to log in immediately. If a user with high information literacy receives an email with such messages, they can immediately recognize that something is wrong and ignore the email. However, users who are not familiar with email and the Internet may be confused by the message, lose their composure, inadvertently access the URL, and even fall for a phishing trick and enter their personal information.

[0083] In contrast, if a user installs a phishing site determination app, even when the user receives such an email, the user can have the app determine whether or not the email is a phishing site without any delay. If the email is highly suspected to be a phishing site, the user can stop accessing the site, and as a result, the user can avoid becoming a victim of phishing fraud. On the other hand, if the email is not a phishing site, the user can access the site with peace of mind. Therefore, the significant advantages of the above-described embodiment are clear.

[0084] The present invention is not limited to the above-described embodiment, and can be modified in various ways. The specific examples presented in relation to the embodiment are merely examples, and the present invention is not limited to the above-described contents.

[0085] In the above embodiment, the maximum feature map size generated by convolving an input image of 512×512 pixels in the object detection model 10 is 512×512 pixels (1 / 1 scale of the input image), but the maximum feature map size may be smaller than this if there is no effect on the object detection accuracy. For example, a feature map of 256×256 pixels, which is 1 / 2 scale in both the vertical and horizontal directions, may be generated.

[0086] In the above-described embodiment, the object detection model 10, site information storage unit 20, and composite judgment unit 50, which correspond to the central functions of judgment, are provided inside the phishing site judgment program 100, and all processing is completed within the program without communicating with the outside. However, instead, it is also possible to provide a judgment server equipped with these functional units 10, 20, and 50 on the cloud, and to configure the judgment-related processing (specifically, steps S36 and S38 in FIG. 7) to be executed on the server side.

[0087] In the above-described embodiment, SSD is adopted as the object detection algorithm, but the algorithm is not necessarily limited to SSD, and any algorithm can be used as long as it can accurately detect trademarks such as logos and icons used on websites.

[0088] Furthermore, the configurations and numerical values ​​given in the course of the explanation of the object detection model 10 and the phishing site determination program 100 are merely examples, and needless to say, they can be modified as appropriate when implementing the present invention. [Explanation of symbols]

[0089] 10 Object detection model (object detection part) 20 Site information storage unit 30 URL input section 40 Site Screen Acquisition Department 50 Composite judgment section 60 Judgment result output unit 100 Phishing site detection program (phishing site detection app)

Claims

1. A trained model for causing a computer to detect a predetermined display used as a trademark of a company or service in an input image, The trained model is used to function as a computer that has been trained in advance by classifying elements contained within official websites using screenshot images of official websites and phishing sites that impersonate official websites, and that generates multiple feature maps by repeating the operations of convolving an input image to generate a first feature map of a predetermined size, convolving the first feature map to generate a second feature map, and convolving the previously generated feature map to generate a further feature map, and then detecting the specified display contained in the input image based on the multiple feature maps.

2. In the trained model according to claim 1, The predetermined size is: A trained model having a scale equal to or greater than half that of the input image.

3. In the trained model according to claim 1, A trained model characterized in that when detecting the specified display contained in the input image based on the first feature map, multiple types of rectangles with a reference length of 24 pixels are used.

4. In the trained model according to any one of claims 1 to 3, The input image is A trained model that is not downsized.

5. Computer, A storage means for storing information regarding the official website in advance; A receiving means for receiving an input of a URL; An acquisition means for acquiring a screen shot image of the website of the URL; The trained model according to claim 1 , which detects the predetermined display included in the screen shot image; A determination means for determining whether the site of the URL is an official website based on the detection result of the predetermined display and the information. A site determination program that functions as a.

6. 6. The site evaluation program according to claim 5, A site judgment program further comprising a computer that functions as an input means for inputting the screen shot image acquired by the acquisition means into the trained model without reducing it.

7. 6. The site evaluation program according to claim 5, A site judgment program further comprising a computer that functions as an input means for reducing the screen shot image and inputting it into the trained model if the screen shot image acquired by the acquisition means is larger than a predetermined image size.

8. A storage means for storing information regarding the official website in advance; A receiving means for receiving an input of a URL; An acquisition means for acquiring a screen shot image of the website of the URL; The trained model according to claim 1 , which detects the predetermined display included in the screen shot image; a determination means for determining whether the site of the URL is an official website or not based on the detection result of the predetermined display and the information; A site determination system equipped with

9. The site determination system according to claim 8, The site determination system further comprises an input means for inputting the screen shot image acquired by the acquisition means into the trained model without reducing it.

10. The site determination system according to claim 8, The site determination system further comprises an input means for reducing the screen shot image before inputting it into the trained model if the screen shot image acquired by the acquisition means is larger than a predetermined image size.

Images