The Method And System For Identifying Phishing URL Using Embedding

Abstract

The present invention relates to a method and server system for distinguishing phishing URLs using embeddings, wherein the method involves accessing a target URL received from a mail client running on a user terminal, capturing a web page screen, embedding it to derive a target embedding vector, comparing the similarity between the target embedding vector and a plurality of normal embedding vectors stored in a database, determining whether the target URL matches a normal URL mapped in the database with a normal embedding vector whose similarity is above a preset threshold, and if they do not match, determining the target URL as a phishing URL and providing a connection blocking command to the user terminal.

Description

Technology Field

[0001] The present invention relates to a method and server system for distinguishing phishing URLs using embeddings, wherein the method involves accessing a target URL received from a mail client running on a user terminal, capturing a web page screen, embedding it to derive a target embedding vector, comparing the similarity between the target embedding vector and a plurality of normal embedding vectors stored in a database, determining whether the target URL matches a normal URL mapped in the database with a normal embedding vector whose similarity is above a preset threshold, and if they do not match, determining the target URL as a phishing URL and providing a connection blocking command to the user terminal. Background Technology

[0003] With the recent advancement of internet technology, the use of various web services, such as online banking and social media, has become widespread. Since most of these services access personal information through user logins, it is crucial to securely protect sensitive user information, such as IDs and passwords.

[0004] However, phishing attack attempts are rapidly increasing as attackers exploit this online environment to illegally steal users' personal information by impersonating legitimate institutions or trusted companies.

[0005] Existing phishing URL detection technologies primarily rely on a blacklist approach. This method creates a list of already reported or known malicious URLs and blocks users from accessing them. However, many users are currently struggling with phishing attacks because phishing attackers create webpages that look similar to existing ones, generate thousands of new domains daily, and modify URLs to attempt attacks and deceive users into stealing their personal information.

[0006] Conventional email security systems include methods and systems for classifying malicious emails, such as those described in Korean Registered Patent No. 10-2733107. This method classifies malicious emails based on whether the sender domain matches the recipient domain and whether the DNS information of the A record of the domain included in the recipient email matches. Recently, there has been an increase in cases where phishing attackers create attacks that closely resemble conventional web pages to deceive users and steal their personal information. However, such conventional technology has limitations in distinguishing phishing attacks that utilize visual deception because it fails to analyze the visual similarity between the screen a user sees upon accessing a malicious URL and the actual legitimate screen.

[0007] Therefore, there is a need for new detection technology capable of responding to novel phishing threats by analyzing the visual similarity of web pages themselves and verifying it by comparing it with actual web pages. Prior art literature

[0009] Republic of Korea Registered Patent No. 10-2733107 (2024.11.18.) The problem to be solved

[0010] The present invention relates to a method and server system for distinguishing phishing URLs using embeddings. The invention aims to provide a method and system for distinguishing phishing URLs by accessing a target URL received from a mail client running on a user terminal, capturing a web page screen, embedding it to derive a target embedding vector, comparing the similarity between the target embedding vector and a plurality of normal embedding vectors stored in a database, determining whether the target URL matches a normal URL mapped in the database with a normal embedding vector whose similarity is above a preset threshold, and if they do not match, determining the target URL as a phishing URL and providing a connection blocking command to the user terminal. means of solving the problem

[0012] In order to solve the above problem, in one embodiment of the present invention, a method for distinguishing a phishing URL using embedding, performed in a server system including one or more processors and one or more memories, comprises: a target URL receiving step of receiving a target URL that a user intends to access from a mail client executed on a user terminal; a vector derivation step of capturing the entire area of ​​a target web page screen output by accessing the target URL and embedding the captured target web page screen to derive a target embedding vector; a similarity calculation step of calculating the similarity between the target embedding vector and a plurality of normal embedding vectors based on a database in which a normal embedding vector in which the entire area of ​​a normal web page screen is embedded and a normal URL related to the normal web page screen are mapped for each of a plurality of preset web pages including a normal web page screen; and a URL comparison step of determining whether the target URL matches a normal URL mapped to a normal embedding vector in which the similarity is greater than or equal to a preset threshold as a result of performing the similarity calculation step. A method for distinguishing a phishing URL is provided, comprising: a phishing URL determination step in which, if there is no normal URL matching the target URL in the database, the target URL is determined to be a phishing URL, and the determination result and a command to block access to the target URL are provided to the user terminal.

[0013] In one embodiment of the present invention, the vector derivation step may include capturing the entire area of ​​a target web page screen output by accessing the target URL, inputting the captured target web page screen into a deep learning-based embedding model to derive a target embedding vector, and the embedding model may include an artificial neural network-based image embedding model trained to receive a web page screen in image form and output feature information of the web page screen in vector form.

[0014] In one embodiment of the present invention, the URL comparison step may further include: a domain determination step for determining whether a domain included in the normal URL and a domain included in the target URL match each other when the normal URL and the target URL do not match; and a URL determination step for determining that the normal URL and the phishing URL match each other when the domain of the normal URL and the domain of the target URL match.

[0015] In one embodiment of the present invention, the method for distinguishing the phishing URL may further include: a phishing database storage step of determining the target URL as a phishing URL and storing the phishing URL in a phishing database when there is no normal URL matching the target URL in the database; and a pre-blocking command provision step of immediately transmitting a connection blocking command to the user terminal when the target URL exists in the phishing database.

[0016] In one embodiment of the present invention, the method for distinguishing the phishing URL may further include a database update step of deriving a normal embedding vector by embedding the entire area of ​​a normal web page screen output by accessing a normal URL stored in the database at predetermined intervals, and updating the database by mapping the normal embedding vector to the normal URL.

[0017] In order to solve the above-mentioned problem, one embodiment of the present invention comprises: a server system that performs a method for distinguishing phishing URLs using embedding, comprising one or more processors and one or more memories, and includes: a target URL receiving unit that receives a target URL that a user intends to access from a mail client running on a user terminal; a vector derivation unit that captures the entire area of ​​a target web page screen output by accessing the target URL and embedding the captured target web page screen to derive a target embedding vector; a similarity calculation unit that calculates the similarity between the target embedding vector and a plurality of normal embedding vectors based on a database in which a normal embedding vector in which the entire area of ​​a normal web page screen is embedded and a normal URL related to the normal web page screen are mapped for each of a plurality of preset web pages including a normal web page screen; and a URL comparison unit that determines whether the target URL matches a normal URL mapped to a normal embedding vector in which the similarity is greater than or equal to a preset threshold as a result of the execution of the similarity calculation unit. The present invention provides a server system comprising: a phishing URL determination unit that, if there is no normal URL matching the target URL in the database, determines the target URL as a phishing URL and provides the determination result and a command to block access to the target URL to the user terminal. Effects of the invention

[0019] In one embodiment of the present invention, by comparing visual feature vectors between a target embedding vector containing a target web page screen captured by accessing a target URL and a normal embedding vector containing a normal web page screen captured by accessing a plurality of normal URLs, it is possible to precisely detect phishing sites that are visually identically mimicked and thereby achieve the effect of preventing phishing attacks.

[0020] In one embodiment of the present invention, since the discrimination method is performed at the time when a user selects and inputs a URL link through a user terminal, the access to the corresponding URL is preemptively blocked before the target web page screen is displayed on the browser of the user terminal, thereby enabling the effect of preemptively blocking the threat of phishing attacks.

[0021] In one embodiment of the present invention, a target URL determined to be a phishing URL is stored in a phishing database, and when a request for the same phishing URL is received thereafter, the intermediate process is omitted and the request is blocked in advance, thereby improving the response speed of the system and reducing the computational load of the server.

[0022] In one embodiment of the present invention, by determining whether a target URL matches only with a normal URL that maps to a normal embedding vector having a similarity greater than or equal to a threshold criterion, the system load can be reduced and resource consumption can be saved.

[0023] In one embodiment of the present invention, when a normal URL and a target URL do not completely match but only the domains match, the two URLs are determined to match each other, thereby preventing a normal URL variation from being determined as a phishing URL, which can be achieved. Brief explanation of the drawing

[0025] FIG. 1 schematically illustrates the execution environment and internal configuration of a server system according to one embodiment of the present invention. FIG. 2 schematically illustrates the steps for performing a method for distinguishing phishing URLs using embeddings according to an embodiment of the present invention. FIG. 3 schematically illustrates a vector derivation step according to one embodiment of the present invention. FIG. 4 schematically illustrates the process of constructing a stored database according to one embodiment of the present invention. FIG. 5 schematically illustrates a similarity calculation step according to one embodiment of the present invention. FIG. 6 schematically illustrates a URL comparison step according to one embodiment of the present invention. FIG. 7 schematically illustrates a domain determination step according to one embodiment of the present invention. FIG. 8 schematically illustrates the steps for deriving a normal input induction region vector and a normal embedding vector according to an embodiment of the present invention. FIG. 9 schematically illustrates the steps for deriving a target input induction region vector and a target embedding vector according to one embodiment of the present invention. FIG. 10 schematically illustrates a similarity calculation step for calculating a first similarity and a second similarity according to an embodiment of the present invention. FIG. 11 schematically illustrates a pre-blocking command provision step according to one embodiment of the present invention. FIG. 12 schematically illustrates a database update step according to one embodiment of the present invention. FIG. 13 illustrates, in an exemplary manner, the internal configuration of a computing device according to one embodiment of the present invention. Specific details for implementing the invention

[0026] Hereinafter, various embodiments and / or aspects are disclosed with reference to the drawings. For illustrative purposes, numerous specific details are disclosed in the following description to aid in a general understanding of one or more aspects. However, it will also be recognized by those skilled in the art that these aspects may be practiced without such specific details. The following description and the accompanying drawings describe specific exemplary aspects of one or more aspects in detail. However, these aspects are exemplary, and some of the various methods in the principles of the various aspects may be used, and the description is intended to include all such aspects and their equivalents.

[0028] In addition, various aspects and features will be presented by a system that may include multiple devices, components and / or modules, etc. It should also be understood and recognized that various systems may include additional devices, components and / or modules, etc., and / or may not include all of the devices, components, modules, etc. discussed in relation to the drawings.

[0029] Terms such as “embodiment,” “example,” “aspect,” “example,” etc. as used herein may not be interpreted as implying that any aspect or design described is superior or more advantageous than other aspects or designs. Terms used below, such as “part,” “component,” “module,” “system,” “interface,” etc., generally refer to computer-related entities and may, for example, refer to hardware, a combination of hardware and software, or software.

[0030] Additionally, the terms “comprising” and / or “comprising” should be understood to mean that the relevant feature and / or component is present, but not to exclude the presence or addition of one or more other features, components and / or groups thereof.

[0031] Additionally, terms including ordinal numbers, such as first, second, etc., may be used to describe various components, but said components are not limited by said terms. Such terms are used solely for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be named the second component, and similarly, the second component may be named the first component. The term "and / or" includes a combination of a plurality of related described items or any of a plurality of related described items.

[0032] Furthermore, in the embodiments of the present invention, all terms used herein, including technical or scientific terms, unless otherwise defined, have the same meaning as generally understood by those skilled in the art to which the present invention pertains. Terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant technology, and should not be interpreted in an ideal or overly formal sense unless explicitly defined in the embodiments of the present invention.

[0033] The “user terminal” mentioned below may be implemented as a computer or portable terminal capable of connecting to a server or other terminals via a network. Here, the computer includes, for example, a notebook, desktop, or laptop equipped with a web browser, and the portable terminal may include, for example, all types of handheld-based wireless communication devices that ensure portability and mobility, such as smartphones, PCS (Personal Communication System), GSM (Global System for Mobile communications), PDC (Personal Digital Cellular), PHS (Personal Handyphone System), PDA (Personal Digital Assistant), IMT (International Mobile Telecommunication)-2000, CDMA (Code Division Multiple Access)-2000, W-CDMA (W-Code Division Multiple Access), and Wibro (Wireless Broadband Internet) terminals. In addition, the “network” can be implemented as a wired network such as a Local Area Network (LAN), Wide Area Network (WAN), or Value Added Network (VAN), or as any type of wireless network such as a mobile radio communication network or a satellite communication network.

[0035] FIG. 1 schematically illustrates the execution environment and internal configuration of a server system (1000) according to one embodiment of the present invention.

[0037] As illustrated in FIG. 1, the server system comprises one or more processors and one or more memories and performs a method for distinguishing phishing URLs using embedding, comprising: a target URL receiving unit (1100) that receives a target URL that a user intends to access from a mail client running on a user terminal; a vector derivation unit (1200) that captures the entire area of ​​a target web page screen output by accessing the target URL and embedding the captured target web page screen to derive a target embedding vector; and a similarity calculation unit (1300) that calculates the similarity between the target embedding vector and a plurality of normal embedding vectors based on a database in which a normal embedding vector in which the entire area of ​​a normal web page screen is embedded and a normal URL related to the normal web page screen are mapped for each of a plurality of preset web pages including a normal web page screen. The system includes: a URL comparison unit (1400) that determines whether the target URL matches a normal URL mapped to a normal embedding vector whose similarity is greater than or equal to a preset threshold as a result of the execution of the similarity calculation unit (1300); and a phishing URL determination unit (1500) that determines the target URL as a phishing URL if there is no normal URL matching the target URL in the database, and provides the determination result and a command to block access to the target URL to the user terminal.

[0039] The user terminal (2000) of the present invention is a device of a general recipient (user) that receives emails, and is linked with a server system (1000) to verify the validity of a target URL included in an email upon receiving an email. In one embodiment, the user terminal (2000) can check the result of the server system (1000)'s judgment regarding the target URL through a mail client (2100), and if the target URL is determined to be a phishing URL, it can display a warning message regarding the phishing URL on the screen.

[0041] Specifically, the server system (1000) of the present invention includes a plurality of components to perform a series of processing steps to determine whether a target URL that a user intends to access is a phishing URL from a mail client (2100) running on a user terminal (2000). The server system (1000) of the present invention is characterized by providing an advanced phishing URL detection function through a deep learning-based image embedding model and similarity analysis based on a stored database.

[0042] The normal web page screen defined in the present invention and the target web page screen described below are not limited to screens that merely provide a login function. They may encompass screens of general web pages such as portal sites, shopping malls, financial institutions, and government offices.

[0043] Meanwhile, phishing attackers typically create web pages that visually mimic actual institutions with sophisticated precision, with the primary objective of stealing such personal information by inducing users to input their personal information, such as IDs, passwords, account numbers, and credit card numbers. Therefore, the normal web page screen and the target web page screen may include screens that contain an interface inducing the input of the user's personal information.

[0044] In order to implement the technical features described above, the server system (1000) includes components corresponding to a target URL receiving unit (1100), a vector derivation unit (1200), a similarity calculation unit (1300), a URL comparison unit (1400), and a phishing URL determination unit (1500), and the process performed in each component will be described in detail below.

[0045] Meanwhile, the above mail client (2100) refers to a software program that is separately installed on a user terminal (2000) and used by the user to check, compose, and manage emails.

[0047] FIG. 2 schematically illustrates the steps for performing a method for distinguishing phishing URLs using embeddings according to an embodiment of the present invention.

[0049] As illustrated in FIG. 2, a method for distinguishing a phishing URL using embedding, performed in a server system (1000) comprising one or more processors and one or more memories, comprises: a target URL receiving step (S100) of receiving a target URL that a user intends to access from a mail client (2100) executed on a user terminal (2000); a vector derivation step (S200) of capturing the entire area of ​​a target web page screen output by accessing the target URL and embedding the captured target web page screen to derive a target embedding vector; and a similarity calculation step (S300) of calculating the similarity between the target embedding vector and a plurality of normal embedding vectors based on a database in which a normal embedding vector in which the entire area of ​​a normal web page screen is embedded and a normal URL related to the normal web page screen are mapped for each of a plurality of pre-configured web pages including a normal web page screen. The method includes: a URL comparison step (S400) for determining whether the target URL matches a normal URL mapped to a normal embedding vector whose similarity is greater than or equal to a preset threshold as a result of performing the similarity calculation step (S300); and a phishing URL determination step (S500) for determining the target URL as a phishing URL if there is no normal URL in the database that matches the target URL, and providing the determination result and a command to block access to the target URL to the user terminal (2000).

[0051] Specifically, the target URL receiving step (S100) is performed by the target URL receiving unit (1100), and when a user attempts to access a target URL included in an email by selecting and inputting it from a mail client (2100) running on a user terminal (2000), the target URL is received from the mail client (2100). Additionally, since the mail client (2100) must output an approval command or a blocking command for the target URL from the server system (1000) on the screen when the user selects and inputs the target URL included in the email, it is preferable not to immediately output the screen of the webpage corresponding to the target URL.

[0053] The vector derivation step (S200) is performed by a vector derivation unit (1200), and the entire area of ​​the target web page screen output by accessing the target URL is input into a deep learning-based embedding model to extract a target embedding vector. The embedding model may include an artificial neural network-based image embedding model trained to receive an image-type web page screen as input and output feature information of the web page screen in a vector form, and the image embedding model may include a Clip model, a SigLIP (Sigmoid Loss for Language Image Pre-Training) model, a multimodal model, etc.

[0055] The above similarity calculation step (S300) is performed by a similarity calculation unit (1300) and calculates the similarity between the target embedding vector and a plurality of normal embedding vectors stored in a database. For each of the plurality of pre-configured web pages including a normal web page screen, the entire area of ​​the normal web page screen is input into the deep learning-based embedding model to derive the normal embedding vector, and is mapped to a normal URL related to the normal web page screen and stored in the database.

[0057] The above URL comparison step (S400) is performed by the URL comparison unit (1400) as a result of the execution of the above similarity calculation step (S300) when there exists a normal embedding vector whose similarity is greater than or equal to a preset threshold, and determines whether there is a match by comparing the normal URL mapped to the corresponding normal embedding vector in the database with the above target URL.

[0058] Meanwhile, existing methods for identifying phishing URLs through comparison include comparing the similarity of strings contained within the URL and comparing the similarity of domains contained within the URL. However, these methods have limitations in countering phishing attacks that involve adding letters to legitimate URLs or replacing them with special characters that resemble the letters.

[0059] Therefore, by determining whether URLs match rather than comparing them through strings, it is possible to effectively block phishing URL attacks that attack by slightly adding letters to a legitimate URL or converting the letters of a legitimate URL into similar special characters.

[0061] The above phishing URL determination step (S500) is performed by the phishing URL determination unit (1500), and if there is no normal URL matching the target URL in the database, the target URL can be determined to be a phishing URL. Accordingly, the determination result and a command to block access to the target URL can be provided to the user terminal (2000) through the mail client (2100). The access blocking command may include a method of displaying a warning message of the mail client (2100) on the screen or a method of blocking access to the target URL by the mail client (2100) itself. Such a method can have the effect of preemptively blocking the threat of a phishing attack by blocking the target web page screen before it is displayed on the browser of the user terminal (2000).

[0063] As described above, the present invention can achieve the effect of preventing phishing attacks by precisely detecting phishing sites that are visually identically mimicked, by comparing visual feature vectors between a target embedding vector containing a target web page screen captured by accessing a target URL and a normal embedding vector containing a normal web page screen captured by accessing a plurality of normal URLs.

[0065] FIG. 3 schematically illustrates a vector derivation step (S200) according to one embodiment of the present invention.

[0067] As illustrated in FIG. 3, the vector derivation step (S200) captures the entire area of ​​the target web page screen output by accessing the target URL, inputs the captured target web page screen into a deep learning-based embedding model to derive a target embedding vector, and the embedding model may include an artificial neural network-based image embedding model trained to receive an image-type web page screen and output feature information of the web page screen in a vector form.

[0069] Specifically, when the vector derivation unit (1200) receives a target URL from the mail client (2100) of the user terminal (2000), it accesses the URL and captures the entire area of ​​the target web page screen including an ID and password input window and a login button, and inputs the entire area of ​​the target web page screen into an embedding model including a Clip model, a SigLIP (Sigmoid Loss for Language Image Pre-Training) model, a Multimodal model, etc., to derive feature information for the entire area of ​​the target web page screen as a target embedding vector in the form of a vector.

[0070] As an example of one embodiment, as shown in FIG. 3, the vector derivation unit (1200) can access a target URL corresponding to www.nnnmn.com / nid.idpw, capture a target web page screen corresponding to the initial web page screen output, and input the captured target web page screen into an embedding model to extract a target embedding vector.

[0071] FIG. 3 illustrates a target web page screen including a layer into which an ID and a PW are entered as one embodiment, but other embodiments are not limited thereto.

[0073] FIG. 4 schematically illustrates the process of constructing a stored database according to one embodiment of the present invention.

[0075] As illustrated in FIG. 4, the method for distinguishing the phishing URL involves mapping a normal embedding vector, in which the entire area of ​​the normal web page screen is embedded, and a normal URL associated with the normal web page screen to each of a plurality of preset web pages including a normal web page screen, and storing them in a database.

[0077] In summary, as an embodiment, FIG. 4(a) illustrates a process of deriving a normal embedding vector corresponding to each of the normal web page screens of a plurality of preset web pages, and FIG. 4(b) illustrates a process of storing the derived normal embedding vector and the normal URL associated with the normal web page screen together in the database.

[0079] Specifically, as illustrated in FIG. 4(a) as an example, normal web page screens of preset web pages such as NNNNN, DDDD, and GGGGGG can be captured, and a plurality of captured normal web page screens can be input into the embedding model to derive normal embedding vector #1 from the normal embedding vector of NNNNN, normal embedding vector #2 from the normal embedding vector of DDDD, and normal embedding vector #3 from the normal embedding vector of GGGGGG.

[0080] In addition, as shown in FIG. 4(b), the normal embedding vector derived by the embedding model is mapped to a URL related to the corresponding normal web page screen and stored in a database. In one embodiment, normal embedding vector #1, which is the normal embedding vector of NNNNN, is mapped to www.nnnnn.com / nid.idpw, which is the URL related to the normal web page screen of NNNNN, and stored in a database; normal embedding vector #2, which is the normal embedding vector of DDDD, is mapped to www.dddd.net / nid.idpw, which is the URL related to the normal web page screen of DDDD, and stored in a database; and normal embedding vector #3, which is the normal embedding vector of GGGGGG, is mapped to www.ggggg.com / nid.idpw, which is the URL related to the normal web page screen of GGGGGG, and stored in a database.

[0081] Meanwhile, the similarity between the target embedding vector and a plurality of normal embedding vectors is calculated, and if the similarity is greater than or equal to a threshold, the normal embedding vector and the normal URL are mapped and stored in a database to determine whether they match by comparing the normal URL mapped to the normal embedding vector with the target URL.

[0083] FIG. 5 schematically illustrates a similarity calculation step (S300) according to one embodiment of the present invention.

[0085] As illustrated in FIG. 5, the similarity calculation step (S300) calculates the similarity between the target embedding vector and a plurality of normal embedding vectors based on a stored database.

[0087] Specifically, as illustrated in FIG. 5 as an example embodiment, the similarity between the target embedding vector and a plurality of normal embedding vectors can be calculated by the similarity calculation unit (1300) such that the similarity with webpage A is 95%, the similarity with webpage B is 50%, the similarity with webpage C is 40%, the similarity with webpage D is 30%, and the similarity with webpage E is 65%. When the threshold similarity, which is the threshold criterion, is 90%, it can be determined whether the normal URL mapped to the normal embedding vector of webpage A, which has a similarity of 95% or higher than the threshold similarity, matches the target URL.

[0088] A detailed explanation of the method for determining whether the above normal URL and the above target URL match will be provided later in Fig. 6.

[0089] Accordingly, by determining whether a target URL matches only with normal URLs mapped to normal embedding vectors having a similarity level above a threshold, it is possible to reduce the system load and save resource consumption.

[0091] FIG. 6 schematically illustrates a URL comparison step (S400) according to one embodiment of the present invention.

[0093] As illustrated in FIG. 6, the URL comparison step (S400) determines whether the normal URL mapped to the normal embedding vector, which has a similarity greater than or equal to a preset threshold as a result of performing the similarity calculation step (S300), matches the target URL.

[0095] Specifically, as a result of the execution derived by the similarity calculation unit (1300), each character of the normal URL mapped to the normal embedding vector, which has a similarity greater than or equal to a preset threshold, and the character of the target URL can be compared by one-to-one matching, and if the result of the one-to-one matching comparison is completely identical, it can be determined whether the target URL is normal, and if the result of the one-to-one matching comparison is not completely identical, it can be determined.

[0096] As an example, as shown in FIG. 6, when the normal URL is www.nnnnn.com / nid.idpw and the target URL is www.nnnmn.com / nid.idpw, the normal URL and the target URL do not completely match, so they can be distinguished as a result of not matching.

[0098] FIG. 7 schematically illustrates a domain determination step according to one embodiment of the present invention.

[0100] As illustrated in FIG. 7, the URL comparison step (S400) further includes: a domain determination step for determining whether the domain included in the normal URL and the domain included in the target URL match each other when the normal URL and the target URL do not match; and a URL determination step for determining that the normal URL and the phishing URL match each other when the domain of the normal URL and the domain of the target URL match.

[0102] In summary, as an example, FIG. 7(a) shows a first normal web page screen and a first normal URL of the NNNNN website, and FIG. 7(b) shows a second normal web page screen and a second normal URL of the NNNNN website.

[0104] Generally, websites operated by institutions, companies, etc., may operate web pages including two or more login screens depending on the user environment or service policy, and the multiple web pages may all be composed of different images. Meanwhile, although the URLs of the websites where each web page is displayed may differ, it is desirable that the domains be the same for all of them.

[0106] Specifically, as illustrated in FIG. 7(a) as an example, the first normal URL corresponding to the first normal web page screen of the NNNNN website is www.nid.nnnnn.com / nidlogin.login?mode=form1, and as illustrated in FIG. 7(b), the second normal URL corresponding to the second normal web page screen of the NNNNN website is www.nid.nnnnn.com / nidlogin.login?mode=form2. That is, there may be multiple normal web page screens of the same website and multiple different normal URLs corresponding thereto.

[0107] For example, if a normal embedding vector in which the first normal web page screen is embedded is mapped to the first normal URL and stored in the database, and the second normal URL is received as a target URL from a mail client (2100) running on a user terminal (2000), the target URL can be accessed to capture the target web page screen, and the captured target web page screen can be embedded to derive a target embedding vector, and as a result of calculating the similarity between the target embedding vector and a plurality of normal embedding vectors stored in the database, a normal embedding vector corresponding to the first normal web page screen can be calculated above a threshold standard, and the first normal URL mapped to the normal embedding vector can be compared with the target URL to determine whether they match. In addition, since the first normal URL and the target URL do not completely match, the target URL can be identified as a phishing URL by the URL comparison unit (1400).

[0108] Therefore, according to an embodiment of the present invention, if the domains of the first normal URL and the target URL match as nnnnn.com, the target URL can be determined to be a normal URL. Accordingly, the present invention can achieve the effect of preventing a normal URL variation from being determined to be a phishing URL by determining that the two URLs match even when the normal URL and the target URL do not completely match and only the domains match.

[0110] FIG. 8 schematically illustrates the steps for deriving a normal input induction region vector and a normal embedding vector according to an embodiment of the present invention. Additionally, FIG. 9 schematically illustrates the steps for deriving a target input induction region vector and a target embedding vector according to an embodiment of the present invention.

[0112] As illustrated in FIGS. 8 and 9, the normal web page screen includes a normal input guidance area where the user actually enters login information on the web page, and the database further includes a normal input guidance area vector in which the normal input guidance area is embedded.

[0113] In addition, as shown in FIG. 9, the target web page screen includes a target input guidance area where the user inputs personal information on the web page displayed by accessing the target URL.

[0115] In the present invention, a normal input guidance area vector of a normal input guidance area included in the normal web page screen where a user inputs login information is entered is derived, a target input guidance area vector of a target input guidance area included in the target web page screen where a user inputs personal information is entered is extracted, and the similarity between the normal input guidance area vector and the target input guidance area vector is further calculated to enhance the accuracy of the method for distinguishing phishing URLs. A detailed explanation of the process of deriving the target input guidance area vector and calculating the similarity between the target input guidance area vector and a plurality of normal input guidance area vectors will be provided later in FIGS. 9 and 10.

[0117] Specifically, as illustrated in FIG. 8, in one embodiment, the server system (1000) captures a normal input guidance area that exists on a normal web page screen of a plurality of web pages and where a user actually enters login information, inputs the captured normal input guidance area into the embedding model to derive a normal input guidance area vector, and maps the normal input guidance area vector together with a normal embedding vector and a normal URL corresponding to the normal input guidance area vector and stores them in the database.

[0118] Additionally, as illustrated in FIG. 9, as an embodiment, the server system (1000) can access the target URL and capture the target input guidance area that exists on the target web page screen of the output web page and where the user inputs personal information, and input the captured target input guidance area into the embedding model to derive the target input guidance area vector.

[0120] FIG. 10 schematically illustrates a similarity calculation step (S300) for calculating a first similarity and a second similarity according to an embodiment of the present invention.

[0122] As illustrated in FIG. 10, the similarity calculation step (S300) further calculates a second similarity between the target input induction area vector and the normal input induction area vector.

[0124] Specifically, the first similarity refers to the similarity between the target embedding vector described in FIG. 5 and the normal embedding vector stored in the plurality of databases, and the second similarity refers to the calculated similarity between the target input induction region vector and the plurality of normal input induction region vectors stored in the databases.

[0125] Accordingly, the present invention can determine whether the normal URL mapped to the normal embedding vector, where both the first similarity and the second similarity are above a preset threshold, matches the target URL.

[0126] As illustrated in FIG. 10 as an example, the first threshold similarity corresponds to the threshold criterion of the first similarity, and the second threshold similarity corresponds to the threshold criterion of the second similarity. When the first threshold similarity is 70% and the second threshold similarity is 90%, the web pages having a first similarity greater than the first threshold similarity are A and E, and the web page having a second similarity greater than the second threshold similarity is A. Therefore, the normal URL associated with web page A, which has a first similarity and a second similarity greater than the first threshold similarity and the second threshold similarity criteria, can be compared with the target URL to determine whether they match.

[0127] In one embodiment of the present invention, by comparing the embedding vectors of the entire area of ​​the web page screen and the input induction area, it is possible to reliably determine whether the target web page screen is phishing even when only a part of the web page is changed or the layout is partially altered due to advertisements, etc.

[0128] Meanwhile, the aforementioned normal input guidance area and the aforementioned target input guidance area each refer to areas within the normal webpage screen and the target webpage screen where interfaces requiring actual information input from the user are concentrated, and which are visually demarcated areas including input fields for entering personal information such as ID, password, account number, and credit card number, and execution buttons for transmitting the entered information to a server or triggering an authentication process.

[0130] FIG. 11 schematically illustrates a pre-blocking command provision step according to one embodiment of the present invention.

[0132] As illustrated in FIG. 11, the method for distinguishing the phishing URL further includes: a phishing database storage step of determining the target URL as a phishing URL and storing the phishing URL in a phishing database when there is no normal URL matching the target URL in the database; and a pre-blocking command provision step of immediately transmitting a connection blocking command to the user terminal (2000) when the target URL exists in the phishing database.

[0134] Specifically, if the target URL is determined to be a phishing URL because there is no matching normal URL in the database, the phishing URL is stored in the phishing database. Additionally, the server system (1000) receives the target URL through a URL receiving unit, checks whether there is a matching phishing URL by querying the phishing database, and if there is a matching phishing URL, can immediately send a connection blocking command to the user terminal (2000) first. Accordingly, when a request for the target URL is received, it is blocked in advance by querying the phishing database, thereby improving the response speed of the system and reducing the computational load of the server.

[0136] FIG. 12 schematically illustrates a database update step according to one embodiment of the present invention.

[0138] As illustrated in FIG. 12, the method for distinguishing the phishing URL further includes a database update step of deriving a normal embedding vector by embedding the entire area of ​​the normal web page screen output by accessing a normal URL stored in the database at a predetermined period (T), and updating the database by mapping the normal embedding vector to the normal URL.

[0140] Specifically, since the method for distinguishing the phishing URL determines whether it is a phishing URL based on the similarity between a normal embedding vector derived by embedding a normal webpage screen in image form and a target embedding vector derived by embedding a target webpage screen in image form, it is very important whether the normal embedding vector is a value derived from the most recent webpage. If the normal embedding vector is not the most recent webpage, the similarity between the normal embedding vector and the target embedding vector is calculated to be below a threshold standard, and it may be determined to be a phishing URL.

[0141] Therefore, the entire area of ​​the output normal web page screen is input into the embedding model by accessing the normal URL stored in the above database at pre-configured intervals (T) to derive a normal embedding vector, and the said normal embedding vector is mapped to the above normal URL to update the above database.

[0143] FIG. 13 illustrates, in an exemplary manner, the internal configuration of a computing device according to one embodiment of the present invention.

[0145] The whole or part of the server system (1000) illustrated in FIG. 1 may include components of the computing device (11000) illustrated in FIG. 13, which will be described later.

[0147] As illustrated in FIG. 13, the computing device (11000) may include at least one processor (11100), memory (11200), peripheral interface (11300), input / output subsystem (I / O subsystem) (11400), power circuit (11500), and communication circuit (11600).

[0149] Specifically, the memory (11200) may include, for example, high-speed random access memory, magnetic disk, SRAM, DRAM, ROM, flash memory, or non-volatile memory. The memory (11200) may include software modules, instruction sets, or various other data required for the operation of the computing device (11000).

[0150] At this time, access to the memory (11200) from other components, such as the processor (11100) or the peripheral device interface (11300), can be controlled by the processor (11100). The processor (11100) may be composed of a single or multiple units and may include processors in the form of GPUs and TPUs to improve computational processing speed.

[0151] The above peripheral device interface (11300) can connect input and / or output peripheral devices of the computing device (11000) to the processor (11100) and the memory (11200). The processor (11100) can perform various functions for the computing device (11000) and process data by executing a software module or instruction set stored in the memory (11200).

[0152] The input / output subsystem (11400) may connect various input / output peripheral devices to the peripheral device interface (11300). For example, the input / output subsystem (11400) may include a controller for connecting peripheral devices such as a monitor, keyboard, mouse, printer, or, if necessary, a touchscreen or sensor to the peripheral device interface (11300). According to another aspect, the input / output peripheral devices may be connected to the peripheral device interface (11300) without passing through the input / output subsystem (11400).

[0153] The power circuit (11500) may supply power to all or part of the components of the terminal. For example, the power circuit (11500) may include one or more power sources such as a power management system, a battery or alternating current (AC), a charging system, a power failure detection circuit, a power converter or inverter, a power status indicator, or any other components for power generation, management, and distribution.

[0154] The communication circuit (11600) may enable communication with another computing device using at least one external port. Alternatively, as described above, the communication circuit (11600) may enable communication with another computing device by including an RF circuit and transmitting and receiving an RF signal, also known as an electromagnetic signal, as needed.

[0156] The embodiment of FIG. 13 is merely an example of the computing device (11000), and the computing device (11000) may have some components shown in FIG. 13 omitted, additional components not shown in FIG. 13 added, or a configuration or arrangement that combines two or more components. For example, a computing device for a communication terminal in a mobile environment may include a touchscreen or sensors in addition to the components shown in FIG. 13, and the communication circuit (1160) may include a circuit for RF communication of various communication methods (Wi-Fi, 3G, LTE, Bluetooth, NFC, Zigbee, etc.). The components that can be included in the computing device (11000) may be implemented as hardware, software, or a combination of both hardware and software, including one or more integrated circuits specialized for signal processing or applications.

[0157] Methods according to embodiments of the present invention may be implemented in the form of program instructions that can be executed through various computing devices and recorded on a computer-readable medium. In particular, the program according to the present embodiment may be configured as a PC-based program or an application dedicated to a mobile terminal. An application to which the present invention is applied may be installed on a user terminal through a file provided by a file distribution system. For example, the file distribution system may include a file transmission unit (not shown) that transmits the file upon a request from the user terminal.

[0158] The device described above may be implemented as a hardware component, a software component, and / or a combination of a hardware component and a software component. For example, the device and components described in the embodiments may be implemented using one or more general-purpose or special-purpose computers, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA), a programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing unit may execute an operating system (OS) and one or more software applications executed on said operating system. Additionally, the processing unit may access, store, manipulate, process, and generate data in response to the execution of the software. For ease of understanding, the processing unit may be described as being used as a single unit, but those skilled in the art will understand that the processing unit may include multiple processing elements and / or multiple types of processing elements. For example, the processing unit may include multiple processors or one processor and one controller. In addition, other processing configurations, such as parallel processors, are also possible.

[0159] Software may include computer programs, code, instructions, or a combination of one or more of these, and may configure a processing unit to operate as desired or command the processing unit independently or collectively. Software and / or data may be permanently or temporarily embodied in any type of machine, component, physical device, virtual equipment, computer storage medium or device, or transmitted signal wave in order to be interpreted by the processing unit or to provide instructions or data to the processing unit. Software may be standardized and stored or executed in a standardized manner on a networked computing device. Software and data may be stored on one or more computer-readable recording media.

[0160] The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc., either alone or in combination. The program instructions recorded on the medium may be those specifically designed and configured for the embodiment, or they may be those known and available to those skilled in the art of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes; optical recording media such as CD-ROMs and DVDs; magneto-optical media such as floptical disks; and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, and flash memory. Examples of program instructions include machine code, such as that generated by a compiler, as well as high-level language code that can be executed by a computer using an interpreter, etc. The hardware devices described above may be configured to operate as one or more software modules to perform the operation of the embodiment, and vice versa.

[0161] In one embodiment of the present invention, by comparing visual feature vectors between a target embedding vector containing a target web page screen captured by accessing a target URL and a normal embedding vector containing a normal web page screen captured by accessing a plurality of normal URLs, it is possible to precisely detect phishing sites that are visually identically mimicked and thereby achieve the effect of preventing phishing attacks.

[0162] In one embodiment of the present invention, since the discrimination method is performed at the time when the user selects and inputs a URL through the user terminal (2000), the connection to the URL is preemptively blocked before the target web page screen is displayed on the browser of the user terminal (2000), thereby enabling the effect of preemptively blocking the threat of a phishing attack.

[0163] In one embodiment of the present invention, a target URL determined to be a phishing URL is stored in a phishing database, and when a request for the same phishing URL is received thereafter, the intermediate process is omitted and the request is blocked in advance, thereby improving the response speed of the system and reducing the computational load of the server.

[0164] In one embodiment of the present invention, by determining whether a target URL matches only with a normal URL that maps to a normal embedding vector having a similarity greater than or equal to a threshold criterion, the system load can be reduced and resource consumption can be saved.

[0165] In one embodiment of the present invention, when a normal URL and a target URL do not completely match but only the domains match, the two URLs are determined to match each other, thereby providing the effect of preventing a normal URL variation from being determined as a phishing URL.

[0167] Although the embodiments have been described above with reference to limited examples and drawings, those skilled in the art can make various modifications and variations from the description above. For example, suitable results may be achieved even if the described techniques are performed in a different order than described, and / or if the components of the described system, structure, device, circuit, etc. are combined or assembled in a form different from described, or replaced or substituted by other components or equivalents. Therefore, other implementations, other embodiments, and equivalents to the claims below are also within the scope of the claims.

Claims

Claim 1 A method for distinguishing phishing URLs using embeddings performed in a server system comprising one or more processors and one or more memories, comprising: a target URL reception step of receiving a target URL that a user intends to access from a mail client executed on a user terminal; a vector derivation step of capturing the entire area of ​​a target web page screen output by accessing the target URL, deriving a target embedding vector by embedding the captured target web page screen, and further deriving a target input guidance area vector by capturing and embedding a target input guidance area where a user inputs personal information on the target web page screen; and for each of a plurality of pre-configured web pages including a normal web page screen, calculating a first similarity between the target embedding vector and a plurality of normal embedding vectors based on a database in which a normal embedding vector in which the entire area of ​​the normal web page screen is embedded, a normal input guidance area vector in which a user inputs personal information on the normal web page screen is embedded, and a normal URL related to the normal web page screen are mapped and stored, and A method for distinguishing a phishing URL, comprising: a similarity calculation step for further calculating a second similarity between a target input induction area vector and a plurality of normal input induction area vectors; a URL comparison step for determining whether a normal URL mapped to a normal embedding vector, where both the first similarity and the second similarity are greater than or equal to a preset threshold as a result of performing the similarity calculation step, matches the target URL with the normal URL, wherein if the normal URL and the target URL do not match, the URL comparison step determines whether the domain included in the normal URL and the domain included in the target URL match each other, and if they match, determines that the normal URL and the target URL match each other; and a phishing URL determination step for determining the target URL as a phishing URL if the normal URL matching the target URL is not in the database, and providing the determination result and a command to block access to the target URL to the user terminal. Claim 2 A method for distinguishing a phishing URL according to claim 1, wherein the vector derivation step comprises capturing the entire area of ​​a target web page screen output by accessing the target URL, inputting the captured target web page screen into a deep learning-based embedding model to derive a target embedding vector, and wherein the embedding model includes an artificial neural network-based image embedding model trained to receive an image-type web page screen as input and output feature information of the web page screen in a vector form. Claim 3 delete Claim 4 The method for distinguishing a phishing URL according to claim 1 further comprises: a phishing database storage step of determining the target URL as a phishing URL and storing the phishing URL in a phishing database when there is no normal URL matching the target URL in the database; and a pre-blocking command provision step of immediately transmitting a connection blocking command to the user terminal when the target URL exists in the phishing database. Claim 5 The method for distinguishing a phishing URL according to claim 1 further comprises a database update step of deriving a normal embedding vector by embedding the entire area of ​​a normal web page screen output by accessing a normal URL stored in the database at predetermined intervals, and updating the database by mapping the normal embedding vector to the normal URL. Claim 6 A server system comprising one or more processors and one or more memories, and performing a method for distinguishing phishing URLs using embedding, comprising: a target URL receiving unit that receives a target URL that a user intends to access from a mail client running on a user terminal; a vector derivation unit that captures the entire area of ​​a target web page screen output by accessing the target URL, derives a target embedding vector by embedding the captured target web page screen, and further derives a target input guidance area vector by capturing and embedding a target input guidance area where a user inputs personal information on the target web page screen; and for each of a plurality of pre-configured web pages including a normal web page screen, calculates a first similarity between the target embedding vector and a plurality of normal embedding vectors based on a database in which a normal embedding vector in which the entire area of ​​the normal web page screen is embedded, a normal input guidance area vector in which a user inputs personal information on the normal web page screen is embedded, and a normal URL related to the normal web page screen are mapped and stored, and the A server system comprising: a similarity calculation unit that further calculates a second similarity between a target input induction area vector and a plurality of normal input induction area vectors; a URL comparison unit that determines whether a normal URL mapped to a normal embedding vector, where both the first similarity and the second similarity are greater than or equal to a preset threshold as a result of the similarity calculation unit, matches the target URL and, if the normal URL and the target URL do not match, determines whether the domain included in the normal URL and the domain included in the target URL match each other, and if they match, determines that the normal URL and the target URL match each other; and a phishing URL determination unit that, if there is no normal URL matching the target URL in the database, determines the target URL as a phishing URL and provides the determination result and a command to block access to the target URL to the user terminal.

Images