Information processing device, domain confirming method, and domain confirming program

Abstract

Provided is an information processing device which can reduce a possibility that a newly established domain will cause loss of an existing domain. This information processing device comprises: an acquisition unit that acquires a first domain name indicating a newly registered domain name; a confirmation unit that confirms whether there is a web page corresponding to the first domain name; a detection unit that detects, when there is a web page corresponding to the first domain name, whether there is a second domain name which is among existing domain names and is likely to be erroneously recognized as being identical to the first domain name; and a notification unit that notifies, when the second domain name has been detected, information regarding the first domain name to a user associated with the second domain name.

Description

Information processing device, domain verification method, and domain verification program

[0001] The present invention relates to an information processing device, a domain confirmation method, and a domain confirmation program.

[0002] In recent years, there has been an increase in various types of fraud and other illegal activities, including the creation of domains that look similar to existing domains and then using those domains to direct users to web pages that are mistakenly believed to be related to the existing domains. For businesses that provide services using existing domains, such activities can result in significant losses, such as lost opportunities to acquire new customers and the loss of existing customers. Therefore, Patent Literature 1 discloses a device and a program for detecting phishing sites.

[0003] Japanese Patent Application Laid-Open No. 2022-7278

[0004] Incidentally, users of existing domains would like to prevent situations like the one above from occurring as soon as possible.

[0005] Therefore, the present invention has been made in consideration of the above-mentioned demand, and aims to provide an information processing device, a domain verification method, and a domain verification program that can reduce the possibility that a newly established domain will result in the loss of an existing domain.

[0006] An information processing device according to one embodiment of the present invention includes an acquisition unit that acquires a first domain name indicating a newly registered domain name; a confirmation unit that confirms whether a web page corresponding to the first domain name exists; a detection unit that detects whether there is a second domain name that may be mistaken for the first domain name being the same as one of existing domain names; and a notification unit that, when the detection unit detects the second domain name and there is a web page corresponding to the first domain name that may be mistaken for the second domain name, notifies a user associated with the second domain name of information related to the first domain name.

[0007] In the information processing device, the detection unit may detect, as the second domain name, a domain name that becomes the same as the first domain name when one character is added to an existing domain name.

[0008] In the information processing device, the detection unit may detect, as the second domain name, a domain name that becomes the same as the first domain name when one character is deleted from an existing domain name.

[0009] In the information processing device, the detection unit may detect, as the second domain name, a domain name that becomes the same as the first domain name when one character is deleted from an existing domain name.

[0010] In the above information processing device, the detection unit may detect as the second domain name a domain name that becomes identical to the first domain name when a part of an existing domain name is replaced with another character string that is similar to the part of the character string.

[0011] The information processing device may be provided with a receiving unit that receives verification information from a user indicating whether the first domain name is likely to be a malicious domain name to the user, and a registration unit that registers success / failure information indicating the success or failure of detection by the detection unit based on the verification information.

[0012] The information processing device may include a receiving unit that receives phishing information from a user indicating whether a web page corresponding to a first domain name is a phishing site, and a registration unit that registers the first domain name in a blacklist as a phishing site when the phishing information indicates that the web page corresponding to the first domain name is a phishing site.

[0013] In addition, a domain verification method according to one embodiment of the present invention includes an acquisition step in which a computer acquires a first domain name indicating a newly registered domain name; a confirmation step in which a web page corresponding to the first domain name exists; a detection step in which a computer detects whether a second domain name exists that may be mistaken for the first domain name being the same as any of the existing domain names; and a notification step in which a computer notifies a user associated with the second domain name of information related to the first domain name when the detection step detects the second domain name and a web page corresponding to the first domain name exists that may be mistaken for the second domain name.

[0014] In addition, a domain verification program according to one embodiment of the present invention provides a computer with an acquisition function for acquiring a first domain name indicating a newly registered domain name, a confirmation function for confirming whether a web page corresponding to the first domain name exists, a detection function for detecting whether there is a second domain name that may be mistaken for the first domain name being the same as one of the existing domain names, and a notification function for notifying a user associated with the second domain name of information related to the first domain name when the detection function detects the second domain name and there is a web page corresponding to the first domain name that may be mistaken for the second domain name.

[0015] According to the information processing device, domain verification method, and domain verification program of the present disclosure, it is possible to determine whether a customer's telephone number is being used fraudulently, and to output and present the determination result.

[0016] FIG. 1 is a system diagram showing an example of the configuration of a domain verification system including an information processing device; FIG. 2 is a block diagram showing an example of the configuration of a server (information processing device); FIG. 3 is a block diagram showing an example of the configuration of a terminal; FIG. 4 is a block diagram showing an example of the configuration of a domain server; FIG. 5 is a data conceptual diagram showing an example of the configuration of domain information; FIG. 6 is a sequence diagram showing an example of exchange between devices related to the domain verification system; FIG. 7 is a flowchart showing an example of the operation of an information processing device; and FIG. 8 is a flowchart showing an example of the operation of a terminal.

[0017] An information processing device, a domain confirmation method, and a domain confirmation program according to the present invention will be described in detail below with reference to the drawings.

[0018] 1 is an example of a system diagram showing devices related to a domain verification system 1 according to this embodiment. As shown in Fig. 1, the domain verification system 1 includes a server (information processing device) 100, terminals 200 (200a, 200b), and a domain server 400, which are communicatively connected via a network 300.

[0019] In the domain confirmation system 1, when a new domain is registered in the domain server 400, the server (information processing device) 100 acquires information about the new domain, determines whether the new domain is likely to be mistaken for an existing domain, and if there is a possibility of the new domain being mistaken, notifies the user corresponding to the existing domain of the information about the new domain.

[0020] The server (information processing device) 100 determines whether a newly acquired (registered) domain may be mistaken for an existing domain, and if so, notifies the user of the existing domain of information about the new domain that may be mistaken. More specifically, if the server 100 determines that a new domain may be mistaken for an existing domain, it checks whether a web page is associated with the new domain, and if so, notifies the user associated with the existing domain of information about the new domain.

[0021] Terminal 200 is an information processing device held by a user associated with an existing domain. Terminal 200 receives information about the new domain from server (information processing device) 100 and presents it to the user of terminal 200. This allows the user of terminal 200 to check whether the newly registered domain will be mistaken for their own domain, improving the possibility of preventing potential losses that the user may incur.

[0022] The domain server 400 is a server device that provides information about newly registered domains. The domain server 400 provides information about newly registered domains in response to a request from the server (information processing device) 100. The domain server 400 may be a server that only stores information about the domains to be registered. In other words, the domain server 400 does not necessarily have the function of accepting domain registrations, and may simply receive and store information about new domains from the server that registers the domains.

[0023] With this configuration, the domain verification system 1 can reduce losses incurred by users who own existing domains due to newly registered new domains by notifying users who own existing domains of information about domains that are likely to be mistaken for newly registered existing domains.

[0024] The network 300 may include a wireless network or a wired network. Specifically, for example, the network 300 may be a wireless LAN (WLAN), a wide area network (WAN), integrated service digital networks (ISDNs), wireless LANs, code division multiple access (CDMA), long term evolution (LTE), LTE-Advanced, fourth generation communication (4G), fifth generation communication (5G), sixth generation communication (6G) or later mobile communication system, etc. The network 300 is not limited to these examples and may also be, for example, a public switched telephone network (PSTN), Bluetooth (registered trademark), an optical fiber line, an asymmetric digital subscriber line (ADSL) line, a satellite communication network, etc. The network 300 may also be a combination of these. This will be described in detail below.

[0025] 2 is a block diagram showing an example of the configuration of a server (information processing device) 100 (hereinafter referred to as the information processing device 100). The information processing device 100 is a computer system including a processor and a memory, and may be realized by a server device, a PC, a tablet terminal, or the like.

[0026] As shown in FIG. 2, the information processing device 100 includes a communication unit 110 , an input unit 120 , a control unit 130 , a storage unit 140 , and an output unit 150 .

[0027] The communication unit 110 is a communication interface for communicating with external devices via the network 300 in accordance with instructions from the control unit 130. The communication unit 110 receives, for example, a new domain list transmitted from the domain server 400 and transmits it to the control unit 130. In addition, for example, in accordance with instructions from the control unit 130, the communication unit 110 transmits, to the user terminal 200 corresponding to an existing domain, new registration information indicating that a new domain that may be mistaken for an existing domain has been registered.

[0028] The input unit 120 is an input interface that accepts input from an operator of the information processing device 100. The input unit 120 may be realized by, for example, an input device such as a keyboard or a mouse, or may be realized by a microphone that accepts voice input. The input unit 120 transmits the content input by the operator to the control unit 130.

[0029] The control unit 130 is a processor having the function of controlling each unit of the information processing device 100. The control unit 130 executes various programs stored in the storage unit 140 and references data stored in the storage unit 140 to realize the functions that the information processing device 100 should fulfill.

[0030] The control unit 130 functions as an acquisition unit 131 , a confirmation unit 132 , a detection unit 133 , and a notification unit 134 , and may also function as a registration unit 135 and an alarm unit 136 .

[0031] The acquisition unit 131 acquires a new domain list including newly registered domains from the domain server 400 via the communication unit 110. The acquisition unit 131 acquires the new domain list at a predetermined timing. The predetermined timing may be any timing as long as the acquisition unit 131 can periodically acquire information about new domains. For example, the acquisition unit 131 may be configured to acquire the new domain list at 10:00 a.m. every day or every Monday. The acquisition unit 131 stores the new domain list and new domain information 142 in the storage unit 140.

[0032] The verification unit 132 verifies whether or not a corresponding web page exists for each new domain included in the new domain information 142. As an example, the verification may be performed by using a service that provides information on whether a web server or a mail server is set up for a domain when the domain name is input, or by executing a program that searches for a corresponding web server when the domain name is input.

[0033] For each new domain for which the confirmation unit 132 has confirmed the existence of a corresponding web page, the detection unit 133 detects whether there is any domain that could be mistaken for any of the existing domains included in the existing domain information 141. That is, it determines whether there is a possibility that a person will mistakenly recognize that a new domain name associated with a web page and an existing domain name are the same in appearance. Misrecognizing that they are the same in appearance refers to, for example, the following cases.

[0034] (i) Adding one or more characters to a new domain name makes it identical to an existing domain name. Conversely, a new domain name has some characters deleted from the existing domain name. The part of the characters may be a single character, or it may be multiple characters if there is a possibility of misidentification. For example, if the existing domain is "carulis," the detection unit 133 determines that a new domain such as "carlis" or "caruls" is likely to be misidentified. In other words, the detection unit 133 may determine that a new domain name will be misidentified if the character string obtained by deleting some characters from the existing domain name matches the new domain name. The part of the characters may be a single character, as described above, or, if multiple characters, may be a predetermined percentage (e.g., 0.5%) of the number of characters in the character string of the existing domain name.

[0035] (ii) If one or more characters are deleted from a new domain name, it will become identical to an existing domain name. Conversely, a new domain name is a character string in which one or more characters are added to an existing domain name. This is particularly true when a new domain name is a string that duplicates one character of an existing domain name. For example, if the existing domain is "carulis," the detection unit 133 determines that a new domain such as "caarulis" or "caulliis" may be mistaken for an existing domain name. That is, the detection unit 133 may determine that a new domain name is mistaken for an existing domain name if the string in which some characters are deleted from the new domain name matches the existing domain name. The "some characters" may be a single character, as described above, or a predetermined percentage (e.g., 10%) of the total number of characters in the string of characters in the new domain name (or the existing domain name).

[0036] (iii) If a predetermined character string is added before or after an existing domain name, the new domain name will be identical to the character string. Conversely, if a predetermined character string that exists before or after the new domain name is deleted, the new domain name will be identical to the existing domain name. Note that the predetermined character string may exist both before and after the existing domain name, and in that case, the character strings before and after may be the same or different. For example, if the existing domain is "carulis," the detection unit 133 may determine that a new domain such as "neocarulis" or "carulislis" may be mistaken for the existing domain name. In other words, if the new domain name contains the same character string as the existing domain name, the detection unit 133 may determine that the new domain name is a domain name that may be mistaken for the existing domain name.

[0037] (iv) If some characters in an existing domain name are replaced with other characters, the new domain name will be identical to the existing domain name. Conversely, if some characters in a new domain name are replaced with other characters, the new domain is determined to be likely to be mistaken for the existing domain. The part of the characters may be a single character or multiple characters. For example, if the existing domain is "carulis," new domains such as "c@rulis," "carulls," or "c@rulls" are determined to be likely to be mistaken. The characters to be replaced can be determined by storing a correspondence table in advance in the storage unit 140 indicating characters that are likely to be confused with each other, and determining whether the character string matches when converted according to the correspondence table. For example, a correspondence table of easily confused combinations of replacement characters, such as "a" and "@," "b" and "d," "p" and "q," "i" and "l," and "I" and "l," may be stored in the storage unit 140.

[0038] (v) The existing domain and the new domain have the same third-level domain, but the combination of the top-level domain and the second-level domain is different.

[0039] The detection unit 133 detects existing domains that have the relationships shown in (i) to (iv) above. That is, the detection unit 133 identifies new domains that may cause losses to existing domains in some way (e.g., stealing existing customers, acquiring customers who would otherwise be new customers of the existing domain, etc.). Note that while the detection unit 133 has performed rule-based detection as described above, the detection unit 133 may also perform detection using a learning model. That is, a newly registered domain may be designated as a first domain and an existing domain as a second domain, and information associating the pair with information indicating whether the first domain name is likely to be mistaken for the second domain may be used as training data. A learning model generated by learning multiple such training data may be used to detect whether the new domain is likely to be mistaken for an existing domain. Furthermore, the training data may be created using information on pairs of new domains and existing domains with which the new domain may be mistaken.

[0040] The notification unit 134 notifies the terminal 200 of the user corresponding to the existing domain detected by the detection unit as having the possibility of the new domain being mistaken for an existing domain of information about the registered new domain via the communication unit 110. The information about the new domain includes at least the registered new domain name and may also include the URL of a web page described in the new domain and a request message requesting confirmation because the new domain is similar to the user's domain and may cause some kind of loss. Since the new domain detected by the detection unit 133 is not necessarily a domain that may cause loss to the existing domain, the notification unit 134 transmits information about the new domain to the terminal 200 of the user of the existing domain to prompt the user of the existing domain to confirm.

[0041] The registration unit 135 registers, via the communication unit 110, success / failure information indicating the success / failure of the detection result by the detection unit 133 in the storage unit 140 based on verification information indicating whether the new domain is malicious for users of the existing domain. That is, the registration unit 135 registers, in the storage unit 140, success / failure information indicating whether the detection of a new domain detected by the information processing device 100 that may be mistaken for an existing domain was correct or not, with respect to the domain. By accumulating this success / failure information, feedback using this success / failure information can be provided to the detection unit 133, thereby improving the detection accuracy of the detection unit 133. As an example, when rule-based detection is performed, a new detection rule may be discovered and added, or when detection is performed using a learning model, the new domain and existing domain used in the detection, and their success / failure information may be used as new training data to re-learn and update the learning model.

[0042] In addition, if the verification information received from a user of an existing domain indicates that the new domain is a malicious domain, the registration unit 135 may register information indicating that the web page corresponding to the new domain is a phishing site in the memory unit 140 as a blacklist related to phishing sites.

[0043] The notification unit 136 may notify that a web page corresponding to a new domain is a phishing site. Note that the notification of this information by the notification unit 136 is intended to prevent each user from falling victim to a phishing site, and therefore the notification may be sent to any destination, such as a message delivered to each user's terminal, a post on a news site, or a notification to a user who has entered into a contract with the information processing device 100. The destination may be set by the operator of the information processing device 100 via the input unit 120 each time, or may be set in advance.

[0044] The storage unit 140 is a storage medium that stores various programs and data required for the operation of the information processing device 100. The storage unit 140 can be realized, for example, by a hard disk drive (HDD), a solid state drive (SSD), a flash memory, or the like, but is not limited to these. The storage unit 140 may store a program that determines whether a new domain is likely to be mistaken for one of the existing domains, a program that checks whether a web page is associated with the new domain, a program that notifies the user that a new domain may be mistaken for an existing domain, and the like. These programs may be divided or integrated into units arbitrarily determined by the programmer. The storage unit 140 also stores new domain information 142 and existing domain information 141.

[0045] The output unit 150 outputs designated information in accordance with instructions from the control unit 130. The output of information by the output unit 150 may be an output of images or text, an output of sound, or an output of information transmitted from an external device. As an example, the output unit 150 may be realized by a monitor or a speaker connected to the information processing device 100, and the transmission of information is realized via the communication unit 110.

[0046] This concludes the description of the information processing device 100.

[0047] 3 is a block diagram showing an example of the configuration of the terminal 200. The terminal 200 is an information processing terminal held by a user associated with an existing domain, and is a computer system equipped with a processor and memory. The terminal 200 is realized by, for example, a server device, a PC, a tablet terminal, a smartphone, a mobile phone, etc., but is not limited to these.

[0048] As shown in FIG. 3, the terminal 200 includes a communication unit 210 , an input unit 220 , a control unit 230 , a storage unit 240 , and an output unit 250 .

[0049] The communication unit 210 is a communication interface for communicating with external devices via the network 300 in accordance with instructions from the control unit 230. The communication unit 210 receives, for example, from the information processing device 100, information about a new domain that may be mistaken for an existing domain held by the information processing device 100, and transmits the information to the control unit 230. In addition, the communication unit 210, for example, in accordance with instructions from the control unit 230, transmits verification information indicating whether the new domain may cause some kind of damage to the information processing device's existing domain.

[0050] The input unit 220 is an input interface that accepts input from the user of the terminal 200. The input unit 220 may be realized by, for example, input devices such as a keyboard or a mouse, or may be realized by a microphone that accepts voice input. The input unit 220 transmits the content input by the user to the control unit 230.

[0051] The control unit 230 is a processor having the function of controlling each unit of the terminal 200. The control unit 230 executes various programs stored in the storage unit 140 and references data stored in the storage unit 140 to realize the functions that the terminal 200 should perform.

[0052] The storage unit 240 is a storage medium that stores various programs and various data required for the operation of the terminal 200. The storage unit 140 can be realized by, for example, a hard disk drive (HDD), a solid state drive (SSD), a flash memory, or the like, but is not limited to these. For example, the storage unit 240 may hold a program that, when the terminal 200 receives information about a new domain transmitted from the information processing device 100, causes the output unit 250 to output the information. The storage unit 240 may also store, for example, information about the new domain transmitted from the information processing device 100.

[0053] The output unit 250 outputs specified information in accordance with instructions from the control unit 230. The information output by the output unit 250 may be output as images or text, may be output as audio, or may be output by transmitting information from an external device. As an example, the output unit 250 may be realized by a monitor or speaker provided in the terminal 200, and the transmission of information is realized via the communication unit 210. The output unit 250 outputs, for example, information related to a new domain transmitted from the information processing device 100. This allows the user of the terminal 200 to recognize the existence of a new domain that may be mistaken for an existing domain that the user owns. This concludes the description of the terminal 200.

[0054] 4 is a block diagram showing an example of the configuration of the domain server 400. The domain server 400 is a computer system that stores a domain list related to new domains and includes a processor and memory. The domain server 400 is realized by, for example, a server device, a PC, a tablet terminal, or the like, but is not limited to these.

[0055] As shown in FIG. 4, the domain server 400 includes a communication unit 410 , an input unit 420 , a control unit 430 , a storage unit 440 , and an output unit 450 .

[0056] The communication unit 410 is a communication interface for communicating with external devices via the network 300 in accordance with instructions from the control unit 430. The communication unit 410 receives, for example, request information requesting information on new domains from the information processing device 100, and transmits the request information to the control unit 430. In addition, the communication unit 410 transmits a new domain list to the information processing device 100 in accordance with instructions from the control unit 430.

[0057] The input unit 420 is an input interface that accepts input from a user of the domain server 400. The input unit 420 may be realized by, for example, an input device such as a keyboard or a mouse, or may be realized by a microphone that accepts voice input. The input unit 420 transmits the content input by the user to the control unit 430.

[0058] The control unit 430 is a processor having the function of controlling each unit of the domain server 400. The control unit 430 executes various programs stored in the storage unit 140 and references data stored in the storage unit 140 to realize the functions to be performed by the domain server 400.

[0059] The storage unit 440 is a storage medium that stores various programs and data required for the operation of the domain server 400. The storage unit 440 can be realized, for example, by a hard disk drive (HDD), a solid state drive (SSD), a flash memory, or the like, but is not limited to these. For example, the storage unit 440 may store a program that causes the domain server 400 to transmit a new domain list including information about the new domain to the information processing device 100 when the domain server 400 receives request information requesting a new domain from the information processing device 100. The storage unit 440 may also store, for example, a newly acquired domain list 441 transmitted from the information processing device 100. The newly acquired domain list 441 may be information input and set by a user of the domain server 400. The newly acquired domain list 441 may also be automatically registered and stored by the control unit 130 each time a new domain is registered if the domain server 400 is a server that has its own new domain registration function.

[0060] The output unit 450 outputs designated information in accordance with instructions from the control unit 430. The output of information by the output unit 450 may be output as images or text, may be output as audio, or may be output by transmitting information from an external device. As an example, the output unit 450 may be realized by a monitor or speaker provided in the domain server 400, and the transmission of information is realized via the communication unit 410.

[0061] Although details will not be explained here, the domain server 400 may have a function to accept a request to register a new domain, determine whether registration is possible, and if it is determined that registration is possible, register the new domain in the newly acquired domain list 441 in the memory unit 440.

[0062] This concludes the description of the domain server 400.

[0063] <Data> Fig. 5 is a conceptual data diagram showing an example of the configuration of domain information. Fig. 5(a) shows an example of the configuration of existing domain information 141 held by the information processing device 100, and Fig. 5(b) shows an example of the configuration of new domain information 142 held by the information processing device 100 or the domain server 400.

[0064] The existing domain information 141 is a collection of information about registered domains. As shown in Fig. 5A, the existing domain information 141 is information in which a management ID 501, a domain 502, a top URL page 503, an owner name 504, a registration date 505, and an expiration date 506 are associated with each other.

[0065] The management ID 501 is identification information assigned by the information processing device 100 for the purpose of conveniently managing information about each domain.

[0066] The domain 502 is character string information indicating the domain managed by the corresponding management ID 501 .

[0067] The top URL page 503 is information indicating the address (URL: Uniform Resource Locator) of a web page set for the domain managed by the corresponding management ID 501 .

[0068] The owner name 504 is information indicating the owner who holds the domain managed by the corresponding management ID 501 .

[0069] The registration date 505 is information indicating the date on which the domain managed by the corresponding management ID 501 was registered.

[0070] The expiration date 506 is information indicating the expiration date registered as a valid date for use of the domain managed by the corresponding management ID 501 .

[0071] In the example of FIG. 5A , for example, the domain 502 managed by the management ID 501 "010293312" is "carulis.jp," and its top page URL 503 is "https: / / carulis.jp." The owner name 504 of the domain is "Caulis Co., Ltd." The registration date 505 is "December 4, 2015," and the expiration date is "December 4, 2022." Note that this is merely an example. Furthermore, the information included in the existing domain information 141 is sufficient as long as it includes at least the domain 502 and the owner name 504; other information is not required. Furthermore, information other than the information shown in FIG. 5A may be associated with the domain as long as it is information related to the domain. For example, the existing domain information 141 may include the email address and SNS account information of the terminal 200 as contact information for the owner name 504.

[0072] The above is the description of the existing domain information 141.

[0073] The new domain information 142 is a collection of information about newly registered domains. The new domain information 142 may include information about multiple new domains, or may include only one. As shown in FIG. 5B, the new domain information 142 associates a newly acquired domain 511, an owner name 512, and a registration date 513.

[0074] The newly acquired domain 511 is information of a character string indicating a newly acquired domain.

[0075] The owner name 512 is information indicating the owner of the corresponding newly acquired domain 511 .

[0076] The registration date 513 is information indicating the date on which the corresponding newly acquired domain 511 was registered.

[0077] In the example of FIG. 5(b), the owner name 512 of the newly acquired domain 511 "caplis" is "BBB LLC," and the registration date 513 is "March 7, 2022." Note that this is merely an example. Furthermore, the new domain information 142 only needs to include the newly acquired domain 511; other information is not required. Furthermore, the new domain information 142 may be associated with information other than the information shown in FIG. 5(b), as long as it is information related to the new domain.

[0078] The new domain information 142 may be the same as the newly acquired domain list 441 held by the domain server 400. This concludes the description of the new domain information 142.

[0079] <Operation> Hereinafter, the operation of the domain confirmation system 1 and each related device will be described.

[0080] FIG. 6 is a sequence diagram showing an example of communication between the devices involved in the domain verification system 1. In FIG.

[0081] As shown in FIG. 6, the information processing apparatus 100 transmits request information to the domain server at a predetermined timing, requesting a list of newly acquired domains including information on newly acquired domains (step S601).

[0082] In response to this, the domain server 400 transmits new domain information from the newly acquired domain list 441 that it holds to the information processing device 100, including information on newly registered domains that have not been transmitted to the information processing device 100 before (step S602).

[0083] Upon receiving the new domain information, the information processing device 100 checks whether each new domain is likely to be mistaken for an existing domain (step S603). If there is a new domain that is likely to be mistaken for an existing domain, it checks whether there is a web page for that new domain (step S604). If there is a new domain that is likely to be mistaken for an existing domain and a web page corresponding to that new domain exists, the information processing device 100 transmits registration information for the new domain that is likely to be mistaken for an existing domain to the terminal 200 of the user of the likely mistaken existing domain (step S605).

[0084] The user of terminal 200 checks the information about the new domain, and depending on the content of the information, the user inputs information about the new domain and transmits it to information processing device 100 (step S606). The information about the new domain may be, for example, verification information as to whether the new domain is a domain that may cause losses to the user.

[0085] The information processing device 100 registers the information about the new domain received from the terminal 200 (step S607), and ends the process.

[0086] This allows the domain confirmation system 1 to notify the terminal 200 of any new domains that may cause harm to the terminal 200.

[0087] FIG. 7 is a flowchart showing an example of the operation of the information processing device 100 for realizing the exchange shown in FIG.

[0088] 7, the acquisition unit 131 of the control unit 130 transmits request information requesting the newly acquired new domain list to the domain server 400 via the communication unit 110 (step S701). In response, the domain server 400 transmits the new domain list to the information processing device 100. The communication unit 110 receives the new domain list transmitted from the domain server 400 and transmits it to the control unit 130. The control unit 130 stores the received new domain list in the storage unit 140 as new domain information 142. The control unit 130 then repeatedly executes the processes shown in steps S703 to S707 for the new domains included in the new domain information 142 until the processes have been executed for all new domains.

[0089] The detection unit 133 of the control unit 130 detects whether the new domain may be mistaken for an existing domain (step S703). That is, it detects existing domains that may be mistaken for the new domain. If there is no existing domain that may be mistaken for the new domain (NO in step S703), the process proceeds to processing the next new domain or ends.

[0090] If there is an existing domain that may be mistaken for a new domain (YES in step S703), the confirmation unit 132 of the control unit 130 checks whether a corresponding web page exists for the new domain (step S704).If there is no corresponding web page (NO in step S704), the process proceeds to processing the next new domain or ends.

[0091] If a web page corresponding to the new domain exists and there is an existing domain that may be mistaken for the new domain, the notification unit 134 of the control unit 130 notifies the user terminal 200 corresponding to the existing domain of information about the new domain that may be mistaken for the new domain via the communication unit 110 (step S705).

[0092] If the communication unit 110 receives information about a new domain from the terminal 200 (YES in step S706), it transmits the information to the control unit 130; if not (NO in step S706), it moves on to processing the next new domain or terminates the processing.

[0093] When control unit 130 receives information about the new domain from communication unit 110, it registers the information in storage unit 140 (step S707). That is, information indicating whether the information about the new domain has the potential to cause harm to users of existing domains is stored in storage unit 140 as success / failure information, and if information indicating that the corresponding URL is a phishing site is included, it is registered as phishing site information indicating that the URL corresponding to the new domain is a phishing site. Control unit 130 then proceeds to process the next new domain, or, if processing for the new domain included in the new domain information has been completed, ends processing.

[0094] The processes of steps S706 and S707 may not be executed during the process of notifying the user of the existing domain of the information about the new domain, and may be executed at a different timing. In this way, the information processing device 100 notifies the user of the existing domain of the information about the new domain that may cause damage.

[0095] FIG. 8 is a flowchart showing an example of the operation of the terminal 200 for realizing the exchange shown in FIG.

[0096] 8 , the communication unit 210 of the terminal 200 receives information about a new domain that may be mistaken for an existing domain held by the user of the terminal 200, which information has been transmitted from the information processing device 100 (step S801). The communication unit 210 transmits the received information to the control unit 230.

[0097] The control unit 230 causes the output unit 250 to output the received information about the new domain (step 802). As an example, the output unit 250 displays a character string indicating the new domain.

[0098] The user of terminal 200 checks the displayed character string of the new domain and the corresponding web page, and determines whether the domain is malicious (a domain that may cause harm to the user). Then, the user of terminal 200 inputs their opinion about the new domain, i.e., information indicating whether the new domain is malicious or not, into input unit 220 (step S803). Input unit 220 transmits the input information to control unit 230.

[0099] The control unit 230 transmits the received information about the new domain to the information processing device 100 via the communication unit 210 (step S804), and ends the process.

[0100] As a result, information as to whether or not the new domain provided by the information processing device 100 is harmful to the user of the terminal 200 is transmitted to the information processing device 100 .

[0101] The domain server 400 simply receives request information requesting information about a new domain from the information processing device 100 and transmits the new domain information, so detailed description of the operation will be omitted.

[0102] <Summary> According to the information processing device 100 of this embodiment, it determines whether a newly acquired domain may be mistaken for one of the existing domains. If it determines that a newly acquired domain may be mistaken for one of the existing domains and a web page has been established, it notifies the user who owns the existing domain that may be mistaken for the newly acquired domain of information about the newly acquired domain. This allows the owner (user) of the existing domain to recognize that a domain similar to the domain they own has been acquired, recognize the possibility of incurring damage, and, in some cases, take measures such as requesting the cancellation of the newly acquired domain. Therefore, the information processing device 100 can reduce the possibility that the existing domain owner will incur damage due to the newly acquired domain.

[0103] <Supplementary Note> The domain verification system 1 and the information processing device 100 according to the above embodiment are not limited to the aspects shown in the above embodiment. Various modifications will be described below.

[0104] (1) In the above embodiment, the information processing device 100 is configured to determine whether a new domain is likely to be mistaken for an existing domain, determine whether a web page is associated with the new domain, and then notify the user of the existing domain. However, the information processing device 100 may be configured to notify the user of the existing domain of information about the new domain simply by determining that the new domain may be mistaken for an existing domain, without checking whether a web page is associated with the new domain. That is, the control unit 130 does not need to include the confirmation unit 132. In that case, the detection unit 133 detects whether any of the new domains included in the new domain information 142 is likely to be mistaken for an existing domain.

[0105] (2) In the above embodiment, the information processing device 100 determines whether a new domain is mistaken for an existing domain and identifies whether a web page is associated with the new domain, thereby determining whether to notify users of the existing domain. However, the determination of whether to notify is not limited to this method. Scores may be set for various determinations, and if the total score exceeds a predetermined threshold, users of the existing domain may be notified.

[0106] As an example, (a) if the new domain name is included in a third-party data source that collects suspicious URLs / FQDNs, the score will be A. (b) if the new domain is classified into the cluster of fraudulent domains in the information that has been analyzed and clustered to determine whether URLs / FQDNs previously collected by the information processing device 100 are fraudulent, the score will be B. (c) if the domain's who is information is privacy-protected, the score will be C. (d) if the new domain name corresponds to any of (i) to (v) in the above embodiments and a web page is set, the score will be D. (e) if the new domain name is a random character string, the score will be E. (f) if multiple IP addresses are associated with the new domain name and each IP address has a short usage period, the score will be F. (g) if the server certificate corresponding to the new domain name is a server certificate that has been fraudulently used in the past, or a server certificate with the same hash value, the score will be G. A score value may be set for each of the various states in which a new domain name may be fraudulent, such as the above, and if the total value exceeds a predetermined threshold, the information processing device 100 may be configured to notify users of existing domains or output information indicating that the new domain name may be fraudulent. In particular, since the above cases (A), (B), (D), (E), (F), and (G) are more likely to be fraudulent than other cases, a higher score may be set for these cases than for other cases. In this way, the information processing device 100 may be configured to calculate a score indicating the possibility of fraud for a new domain, determine whether it is fraudulent based on the score, and output the information.

[0107] (3) In the above embodiment, the information processing device 100 is assumed to have the existing domain information 141 stored in advance, but this is not limited to this. The information processing device 100 may also be configured to acquire information indicating the existing domain at the stage of determining whether a newly registered domain is likely to be mistaken for an existing domain.

[0108] (4) In the above embodiment, the information processing device 100 is configured to sequentially check new domain information with the domain server 400. However, this is not limited to this. For example, this configuration may be realized by a configuration in which, instead of the information processing device 100 requesting the domain server 400, the domain server 400 automatically transmits the information to the information processing device 100 periodically or every time a new domain is registered.

[0109] (5) In the above embodiment, the acquiring unit 131 acquires new domain information from the domain server 400. However, the acquiring unit 131 may acquire new domain information by other methods. Specifically, the acquiring unit 131 may acquire domain information from certificate information (digital certificate, SSL server certificate) that can be acquired when accessing a website. Some websites issue certificate information to guarantee access rights to the website or to certify that communication with the website's server is secure. Without this certificate information (i.e., not installed on the information processing terminal being accessed), the website may be inaccessible or unsafe. In recent years, even malicious websites, such as phishing sites, have begun to use certificate information. This certificate information includes the website's URL, which guarantees access to the URL or certifies that communication with the server is secure. Since the certificate information is issued when the website is accessed, the acquiring unit 131 may acquire new domain information by checking the URL included in the acquired certificate information.

[0110] (6) When each functional unit of the information processing device 100 is implemented by software, the information processing device 100 includes a CPU that executes instructions from a program, which is software that implements each function; a ROM (Read Only Memory) or storage device (these are referred to as "recording media") on which the program and various information are recorded so as to be readable by a computer (or CPU); and a RAM (Random Access Memory) on which the program is deployed. The object of the present invention is achieved when the computer (or CPU) reads and executes the program from the recording media. That is, the information processing device 100 according to the present invention functions as each of the above-mentioned components by the CPU executing the program loaded onto the RAM. The recording media may be "non-transitory tangible media," such as semiconductor memory or programmable logic circuits. The program may also be supplied to the computer via any transmission medium capable of transmitting the program (such as a communication network or broadcast waves). The present invention may also be realized in the form of an information signal embedded in a carrier wave, in which the program is embodied by electronic transmission.

[0111] The above program may be implemented using, for example, a scripting language such as ActionScript, JavaScript (registered trademark), Python, or Ruby; an object-oriented programming language such as C, C++, C#, Objective-C, Swift, or Java (registered trademark); or a markup language such as HTML5. Furthermore, the term "section, module, or unit" in the claims may be read as "means" or "circuit." For example, a communication unit may be read as communication means or a communication circuit.

[0112] In addition, the program of the present disclosure may be provided to the server 100 via any transmission medium (such as a communication network or broadcast waves) capable of transmitting the program.

[0113] (7) The order and timing of the processes described in the above embodiments can be changed as appropriate as long as the same effects as those described in the above embodiments can be achieved. For example, the process of step S704 and the process of step S703 may be executed in reverse order, or may be executed simultaneously in parallel. For example, when a web page corresponding to a new domain exists, it may be determined whether the new domain is likely to be mistaken for any of the existing domains, and if there is any such likely existing domain, the owner of the domain may be notified.

[0114] REFERENCE SIGNS LIST 100 Server (information processing device) 110 Communication unit 120 Input unit 130 Control unit 131 Acquisition unit 132 Confirmation unit 133 Detection unit 134 Notification unit 135 Registration unit 136 Notification unit 140 Storage unit 141 Existing domain information 142 New domain information 150 Output unit 200 Terminal device 210 Communication unit 220 Input unit 230 Control unit 240 Storage unit 250 Output unit 400 Domain server 410 Communication unit 420 Input unit 430 Control unit 440 Storage unit 450 Output unit

Claims

1. an acquisition unit for acquiring a first domain name indicating a newly registered domain name; a verification unit that determines whether a web page corresponding to the first domain name exists; a detection unit for detecting whether the first domain name includes a second domain name that may be mistakenly recognized as being the same as any of existing domain names; a notification unit that notifies a user who holds the second domain name of information related to the first domain name when the detection unit detects the second domain name and there is a web page corresponding to a first domain name that may be mistaken for the second domain name; and An information processing device comprising:

2. The detection unit detects, as the second domain name, a domain name that becomes the same as the first domain name when one character is added to an existing domain name.

2. The information processing apparatus according to claim 1,

3. The detection unit detects, as the second domain name, a domain name that becomes the same as the first domain name when one character is deleted from an existing domain name.

2. The information processing apparatus according to claim 1,

4. The detection unit detects, as the second domain name, a domain name that becomes the same as the first domain name when a predetermined character string is added before or after an existing domain name.

2. The information processing apparatus according to claim 1,

5. The detection unit detects, as the second domain name, a domain name that becomes the same as the first domain name when a part of an existing domain name is replaced with another character string similar to the part of the existing domain name.

2. The information processing apparatus according to claim 1,

6. a receiving unit for receiving verification information from the user, the verification information indicating whether the first domain name is likely to be a malicious domain name for the user; a registration unit that registers success / failure information indicating success or failure of detection by the detection unit based on the verification information; The information processing device according to any one of claims 1 to 5, comprising:

7. a receiving unit for receiving phishing information from the user, the phishing information indicating whether or not a web page corresponding to the first domain name is a phishing site; a registration unit that registers the first domain name as a phishing site in a blacklist when the phishing information indicates that a web page corresponding to the first domain name is a phishing site; The information processing device according to any one of claims 1 to 5, comprising:

8. a receiving unit for receiving phishing information from the user, the phishing information indicating whether or not a web page corresponding to the first domain name is a phishing site; a notification unit that notifies information indicating that the first domain name is a phishing site when the phishing information indicates that the web page corresponding to the first domain name is a phishing site; The information processing device according to any one of claims 1 to 5, comprising:

9. The computer an acquisition step of acquiring a first domain name indicating a newly registered domain name; a checking step of checking whether a web page corresponding to the first domain name exists; a detection step for detecting whether there is a second domain name that may be mistakenly identified as the same as any of the existing domain names of the first domain name; a notification step of notifying a user who holds the second domain name of information related to the first domain name when the detection step detects the second domain name and there is a web page corresponding to a first domain name that may be mistaken for the second domain name; How to perform domain verification.

10. On the computer, an acquisition function for acquiring a first domain name indicating a newly registered domain name; a checking function for checking whether a web page corresponding to the first domain name exists; a detection function for detecting whether there is a second domain name that may be mistakenly identified as the same as any of the existing domain names of the first domain name; a notification function that notifies a user who holds the second domain name of information about the first domain name when the detection function detects the second domain name and there is a web page corresponding to a first domain name that may be mistaken for the second domain name; and A domain verification program that makes this possible.