Method and apparatus for detecting URL associated with phishing site by using artificial intelligence algorithm

Abstract

A method and apparatus for detecting a URL associated with a phishing site are disclosed. A method for detecting a URL associated with a phishing site performed by an apparatus, according to an embodiment of the present disclosure, may comprise the steps of: obtaining a target URL associated with a first URL included in a text message; checking whether the target URL is included in at least one of a first DB and a second DB; capturing a first web page screen after accessing the target URL on the basis of identifying that the target URL is not included in at least one of the first DB and the second DB; and storing information related to the target URL in a result DB by means of the first web page screen, obtaining the information related to the target URL by inputting a plurality of types of data to a first artificial intelligence model and storing the information related to the target URL in the result DB on the basis of not identifying whether the target URL is associated with a phishing site on the basis of the plurality of types of data.

Description

Method and device for detecting URLs associated with phishing sites using artificial intelligence algorithms

[0001] The present disclosure relates to a phishing site detection technology, and more particularly, to a method and device for detecting a uniform resource locator (URL) associated with a phishing site using an artificial intelligence algorithm.

[0002] Phishing is a cybercrime that involves illegally collecting and exploiting personal and financial information through spoofed financial websites or fake emails. As information and communication technology advances, phishing techniques are becoming more sophisticated, and the resulting damage is increasing exponentially. Various technologies are being developed and introduced to prevent phishing.

[0003] Previously, a technology was introduced that detects phishing activity through a server connected through a communication network and notifies the caller when a specific word included in a phishing text message is recognized.

[0004] However, as victims' responses to phishing text messages are not consistent and the composition of phishing text messages becomes increasingly sophisticated, there is a problem in that conventional technologies are not sufficient to detect and notify phishing.

[0005] The present disclosure has been made to solve the above-described problems, and the purpose of the present disclosure is to provide a method and device for detecting a URL associated with a phishing site using an artificial intelligence algorithm.

[0006] The purposes of the present disclosure are not limited to those mentioned above, and other unmentioned purposes and advantages of the present disclosure can be understood through the following description and will be more clearly understood through the embodiments of the present disclosure. Furthermore, it will be readily apparent that the purposes and advantages of the present disclosure can be realized by the means and combinations thereof set forth in the claims.

[0007] According to one embodiment of the present disclosure, a method for detecting a uniform resource locator (URL) associated with a phishing site, performed by a device, comprises: performing a preprocessing operation on a first URL included in a text message to obtain a target URL associated with the first URL; determining whether the target URL is included in at least one of a first database (DB) in which information on a plurality of phishing sites is stored or a second DB in which information on a plurality of non-phishing sites is stored; capturing a first web page screen corresponding to the target URL after accessing the target URL based on determining that the target URL is not included in at least one of the first DB or the second DB; And based on whether the target URL is associated with a phishing site based on the plurality of types of data acquired through the first web page screen, storing information related to the target URL in a result DB, and based on whether the target URL is not associated with a phishing site based on the plurality of types of data, inputting the plurality of types of data into a first artificial intelligence model to acquire information related to the target URL, and storing the information related to the target URL in the result DB.

[0008] In addition, the preprocessing operation for the first URL may include an operation of removing spaces included in the first URL, an operation of converting at least one special character included in the first URL to a general character, an operation of converting lowercase letters included in the first URL to uppercase letters, an operation of removing subdirectory information from the first URL, and an operation of obtaining redirect information connected to the first URL.

[0009] And, the plurality of types of data include strings, scripts, comments, and image data extracted from the first web page screen, and based on the existence of specific data among the plurality of site-specific data stored in the similarity DB, the similarity between the strings and image data extracted from the first web page screen exceeds a threshold value, i) scripts and comments included in a specific site corresponding to the specific data, and ii) scripts and comments extracted from the first web page screen, it can be identified whether the target URL is associated with a phishing site.

[0010] And, by performing OCR (optical character recognition) on the first web page screen, a string on the first web page screen is extracted, and if the string is not associated with the script, the comment, and the image data, the target URL can be identified as being associated with a phishing site.

[0011] And, if there is no specific data in the similarity DB whose similarity exceeds the threshold value, it is determined that it is not identified whether the target URL is associated with a phishing site based on the plurality of types of data, and the artificial intelligence model can be trained to output information related to the target URL including at least one of a type of site corresponding to the target URL, a probability that the target URL is associated with a phishing site, and a description of the site corresponding to the target URL output based on the first web page based on the plurality of types of data.

[0012] And, based on the text message being entered in an application executing a method for detecting a URL associated with the phishing site or a chat room associated with the application, information related to the target URL may be transmitted through the control UI (user interface) of the device or the chat room, and based on the target URL being associated with the phishing site, access to the target URL may be blocked.

[0013] And, the step of storing information related to the target URL in the result DB may further include: a step of generating a first block based on a first hash value corresponding to the information related to the target URL; a step of obtaining information indicating a difference between the first website screen and the second website screen based on a website screen corresponding to the target URL being changed from the first website screen to a second website screen; a step of generating a second block based on a second hash value corresponding to the information indicating the obtained difference; and a step of storing a blockchain related to the target URL in the result DB by connecting the second block to the first block.

[0014] In one embodiment of the present disclosure, a device for detecting a uniform resource locator (URL) associated with a phishing site comprises: one or more memories; and one or more processors, wherein the one or more processors are configured to: perform a preprocessing operation on a first URL included in a text message to obtain a target URL associated with the first URL; determine whether the target URL is included in at least one of a first database (DB) storing information on a plurality of phishing sites or a second DB storing information on a plurality of non-phishing sites; and capture a first web page screen corresponding to the target URL after accessing the target URL based on determining that the target URL is not included in at least one of the first DB or the second DB. And based on whether the target URL is associated with a phishing site based on the plurality of types of data acquired through the first web page screen, information related to the target URL is stored in a result DB, and based on whether the target URL is not associated with a phishing site based on the plurality of types of data, information related to the target URL is acquired by inputting the plurality of types of data into a first artificial intelligence model, and information related to the target URL is stored in the result DB.

[0015] And, the one or more processors may be configured to generate a first block based on a first hash value corresponding to information related to the target URL; obtain information indicating a difference between the first website screen and the second website screen based on a website screen corresponding to the target URL being changed from the first website screen to a second website screen; and generate a second block based on a second hash value corresponding to the information indicating the obtained difference; and store a blockchain related to the target URL in the result DB by connecting the second block to the first block.

[0016] The solutions to the above problems do not enumerate all the features of the present disclosure. The various features of the present disclosure and their corresponding advantages and effects can be understood in more detail by referring to the specific examples below.

[0017] According to various embodiments of the present disclosure, a method and device for detecting a URL associated with a phishing site using an artificial intelligence algorithm can be provided.

[0018] According to various embodiments of the present disclosure, phishing sites can be detected more efficiently by detecting whether a website is a phishing site based on the content on the website associated with the URL, rather than simply detecting specific characters included in a text message.

[0019] The effects of the present disclosure are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the description below.

[0020] FIG. 1 is a block diagram showing the configuration of a device for detecting a URL associated with a phishing site according to one embodiment of the present disclosure.

[0021] FIG. 2 is a flowchart illustrating a method for detecting a URL associated with a phishing site according to one embodiment of the present disclosure.

[0022] FIG. 3 is a diagram illustrating a method for identifying whether a target URL is associated with a phishing site based on a similarity DB according to one embodiment of the present disclosure.

[0023] FIG. 4a, FIG. 4b and FIG. 4c are diagrams illustrating examples of information and result DB related to a target URL according to one embodiment of the present disclosure.

[0024] FIG. 5a, FIG. 5b, FIG. 5c, and FIG. 5d are diagrams for explaining a process of outputting information related to a target URL according to one embodiment of the present disclosure.

[0025] The advantages and features of the present disclosure, and methods for achieving them, will become clearer with reference to the embodiments described below in detail with the accompanying drawings. However, the present disclosure is not limited to the embodiments disclosed below and may be implemented in various different forms. These embodiments are provided solely to ensure that the disclosure is complete and to fully inform those skilled in the art of the scope of the present disclosure, and the present disclosure is defined solely by the scope of the claims.

[0026] The terminology used herein is for the purpose of describing embodiments and is not intended to limit the present disclosure. In this specification, singular forms also include plural forms, unless specifically stated otherwise. As used herein, the terms "comprises" and / or "comprising" do not exclude the presence or addition of one or more other components in addition to the components mentioned.

[0027] Throughout the specification, the same reference numerals refer to the same elements, and the term "and / or" includes each and every combination of the elements mentioned. Although terms such as "first," "second," etc. are used to describe various elements, these elements are not limited by these terms. These terms are merely used to distinguish one element from another. Accordingly, it should be understood that a first element mentioned below may also be a second element within the technical scope of the present disclosure.

[0028] Unless otherwise defined, all terms (including technical and scientific terms) used herein may be used in their common sense to those of ordinary skill in the art to which this disclosure pertains. Furthermore, terms defined in commonly used dictionaries are not to be interpreted ideally or excessively unless explicitly and specifically defined otherwise.

[0029] Spatially relative terms such as "below," "beneath," "lower," "above," and "upper" may be used to easily describe the relationship of one component to another, as illustrated in the drawings. Spatially relative terms should be understood to include different orientations of components during use or operation in addition to the orientations illustrated in the drawings.

[0030] For example, if a component depicted in a drawing is flipped, a component described as "below" or "beneath" another component may be positioned "above" the other component. Thus, the exemplary term "below" may encompass both the above and below orientations. Components may also be oriented in other directions, and thus spatially relative terms may be interpreted based on their orientation.

[0031] Hereinafter, a method and device for detecting a uniform resource locator (URL) associated with a phishing site will be described with reference to the drawings.

[0032]

[0033] FIG. 1 is a block diagram illustrating the configuration of a device for detecting URLs associated with phishing sites according to one embodiment of the present disclosure. The device illustrated in FIG. 1 may include, but is not limited to, a smartphone, a tablet PC, a wearable device, a laptop, and the like.

[0034] As illustrated in FIG. 1, the device (100) may include a memory (110), a communication module (120), a display (130), and a processor (140). However, the present invention is not limited thereto, and the device (100) may have its software and hardware configurations modified / added / omitted within a range apparent to those skilled in the art according to the required operation.

[0035] The memory (110) can store data supporting various functions of the device (100), programs for the operation of the control unit, input / output data (e.g., various databases (DB), information related to input URLs, etc.), and a plurality of application programs (or applications) run on the device, data for the operation of the device, and commands. At least some of these application programs can be downloaded from an external device via wireless communication.

[0036] The memory (110) may include at least one type of storage medium among a flash memory type, a hard disk type, an SSD (Solid State Disk type), an SDD (Silicon Disk Drive type), a multimedia card micro type, a card type memory (e.g., SD or XD memory, etc.), a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, and an optical disk. In addition, the memory (110) may be a database that is separate from the device but is connected by wire or wirelessly.

[0037] The communication module (120) may include one or more components that enable communication with an external device. For example, the communication module (120) may include at least one of a wireless communication module, a wired communication module, or a location information module.

[0038] For example, the communication module (120) can receive information about a plurality of URLs that have been checked for phishing sites from another device and the results of phishing site checks for the URLs.

[0039] Here, the wireless communication module may include a wireless communication module that supports various wireless communication methods such as GSM (global System for Mobile Communication), CDMA (Code Division Multiple Access), WCDMA (Wideband Code Division Multiple Access), UMTS (universal mobile telecommunications system), TDMA (Time Division Multiple Access), LTE (Long Term Evolution), 4G, 5G, and 6G, in addition to a WiFi module and a Wireless Broadband module.

[0040] The display (130) displays (outputs) information processed in the device (100) (e.g., information related to a URL included in a text message, etc.). For example, the display may display execution screen information of an application program (e.g., an application) running in the device (100), or UI (User Interface) or GUI (Graphical User Interface) information based on such execution screen information.

[0041] The processor (140) may be implemented as a memory storing data for an algorithm for controlling the operation of components within the device (100) or a program reproducing the algorithm, and at least one processor (not shown) that performs the aforementioned operations using the data stored in the memory. In this case, the memory and the processor may be implemented as separate chips. Alternatively, the memory and the processor may be implemented as a single chip.

[0042] That is, the processor (140) can control the overall operation and function of the device (100) by controlling the components within the device. The processor can control any one or a combination of the components discussed above in order to implement various embodiments according to the present disclosure described in the drawings below on the device.

[0043]

[0044] FIG. 2 is a flowchart illustrating a method for detecting URLs associated with phishing sites, according to one embodiment of the present disclosure. The operations of the device described in FIG. 2 may be performed via applications and / or websites related to the method for detecting URLs associated with phishing sites.

[0045] Additionally or alternatively, the device may perform the operations described in FIG. 2 using a server storing a DB for detecting URLs associated with phishing sites.

[0046] The device can perform a preprocessing operation on a first URL included in a text message to obtain a target URL associated with the first URL (S210).

[0047] Here, text messages may include text messages, messages sent via instant messaging applications, messages sent via quick panels and / or pop-up windows, etc. However, this is only one example, and text messages may include messages entered / sent via various media.

[0048] The device can detect and extract a first URL contained in a text message and perform a preprocessing operation on the first URL.

[0049] For example, the preprocessing operation for the first URL may include an operation of removing spaces included in the first URL, an operation of converting at least one special character included in the first URL to a general character, an operation of converting lowercase letters included in the first URL to uppercase letters, an operation of removing subdirectory information from the first URL, and an operation of obtaining redirect information associated with the first URL.

[0050] Specifically, the device can first process special characters, such as newlines and TAB characters, contained in the first URL as spaces. The device can convert specific characters contained in the first URL into characters of similar form (e.g., converting "(" into "C"). The device can convert predefined special characters (e.g., converting "®" into "R") into general characters.

[0051] In addition, the device can extract only the pure URL portion, excluding subdirectories, from the first URL. The device can convert uppercase letters contained in the extracted URL portion to lowercase letters. The device can request header information for the extracted URL portion. For example, if the "Status_code" is 200, the device can obtain the target URL redirected from the first URL through the "Response.headers[Location]" information. In other words, the target URL refers to the actual URL that can be accessed by entering / selecting the first URL.

[0052] Additionally or alternatively, the device can automatically recognize malicious code cases using scripts uploaded to specific sites and obtain the target URL.

[0053] For example, if the first URL is "www.abcd.com?redirect=www.defg.com", the device can automatically recognize the malware case and identify that the target URL corresponding to the first URL is "www.defg.com".

[0054] The device can check whether the target URL is included in at least one of a first DB storing information about a plurality of phishing sites or a second DB (e.g., a white DB) storing information about a plurality of non-phishing sites (S220).

[0055] Here, the first database may include a list of multiple phishing sites, at least one URL associated with the phishing site, etc. If a target URL obtained by performing a preprocessing operation on the first URL is included in the first database, the device may determine that the first URL is associated with a phishing site.

[0056] For example, if a URL obtained by converting special characters contained in a first URL to regular characters is included in the first database, the device may determine that the first URL is associated with a phishing site. The device may determine whether the first URL is associated with a phishing site by determining whether the obtained URL is included in the first database each time it performs a preprocessing operation.

[0057] The second database may include a list of multiple non-phishing sites, at least one URL associated with the non-phishing site, and the like. If a target URL obtained by performing a preprocessing operation on the first URL is included in the second database, the device may determine that the first URL is not associated with a phishing site.

[0058] The device can determine whether the first URL is associated with a phishing site by determining whether the acquired URL is included in the second DB each time the device performs each preprocessing operation.

[0059] Based on the determination that the target URL is not included in at least one of the first DB or the second DB, the device can capture the first web page screen corresponding to the target URL after accessing the target URL (S230).

[0060] That is, the device can obtain the first web page screen by accessing the target URL address finally obtained. Additionally or alternatively, the device can obtain DNS (domain name system) information of the target URL.

[0061] The device can extract and obtain multiple types of data (e.g., tags, scripts, plain text, comments, image data, etc.) from the first web page screen.

[0062] Here, if the script included in the first web page screen is obfuscated / encrypted, the device can decrypt the script. Additionally or alternatively, the device can obtain information about the script by applying an algorithm, such as a JavaScript emulator, to the script included in the first web page screen.

[0063] The device can identify whether the target URL is associated with a phishing site based on multiple types of data acquired through the first web page screen (S240).

[0064] As an example of the present disclosure, based on the identification of whether a target URL is associated with a phishing site based on multiple types of data acquired through a first web page screen, the device can store information related to the target URL in a result DB (S250-Y).

[0065] Here, information related to the target URL may include a text message containing the target URL, a type of site corresponding to the target URL, image data of a website screen corresponding to the target URL, a probability that the target URL is associated with a phishing site, a description of the site corresponding to the target URL output based on the first web page, etc.

[0066] A similarity database (DB) refers to a database that stores tags, scripts, plain text, comments, and image data for multiple URL addresses. The device can obtain similarities between multiple types of data extracted from the first website screen and data stored in the DB. The device can use specific data stored in the DB whose similarity exceeds a threshold value to identify whether a specific URL is associated with a phishing site.

[0067] Based on the existence of specific data whose similarity with strings and image data extracted from a first web page screen exceeds a threshold among multiple site-specific data stored in a similarity DB, the device can identify whether a target URL is associated with a phishing site based on i) scripts and comments included in a specific site corresponding to the specific data and ii) scripts and comments extracted from the first web page screen.

[0068] The process by which the device identifies whether a target URL is associated with a phishing site based on multiple types of data using a similarity DB is described in detail with reference to FIG. 3.

[0069] As another example of the present disclosure, based on whether or not it is not identified whether a target URL is associated with a phishing site based on multiple types of data, the device can input multiple types of data into a first artificial intelligence model to obtain information related to the target URL, and store the information related to the target URL in a result DB (S250-N).

[0070] Here, the inability to identify whether the target URL is associated with a phishing site based on multiple types of data may mean that there is no data associated with the multiple types of data in the similarity database. If information related to the target URL is not obtained through the similarity database, the device can input multiple types of data into the first artificial intelligence model to obtain information related to the target URL.

[0071] Here, the first artificial intelligence model may be trained to output at least one of a type of site corresponding to the target URL, a probability that the target URL is associated with a phishing site, and a description of the site corresponding to the target URL output based on the first web page, based on multiple types of data.

[0072] For example, the first artificial intelligence model may include, but is not limited to, one or more neural networks for performing generative artificial intelligence operations.

[0073] The device can build a result database based on information related to the target URL. The various types of data built into the result database are described in detail with reference to Figures 4a to 4c.

[0074] As a further example of the present disclosure, if the string extracted through OCR is different from the text, script, comment, and image data extracted from the first website, it may be considered that a separate string has been inserted on the screen of the first website to deceive the user.

[0075] Accordingly, the device can extract a string on the first web page screen as one of multiple types of data by performing optical character recognition (OCR) on the first web page screen. If the string extracted from the first web page screen is not associated with scripts, comments, or image data extracted from the first website, the device can identify the target URL as being associated with a phishing site.

[0076] As an additional example of the present disclosure, based on a text message entered into an application executing a method for detecting a URL associated with a phishing site or in a chat room associated with the application, the device may transmit information related to the target URL via the device's control user interface (e.g., a quick panel, etc.) or the chat room. Furthermore, if the target URL is identified as being associated with a phishing site, the device may block access to the target URL.

[0077] As an additional example of the present disclosure, the device can build a results database based on blockchain technology. This allows for more secure and efficient storage and management of URL information related to phishing sites.

[0078] Specifically, the device can generate a first block based on a first hash value corresponding to information related to the target URL. Here, a block refers to a bundle of valid information, and may include a block hash value that serves as the block identifier, a previous block hash value, a Merkle root, and transaction information.

[0079] The device can monitor whether the website screen corresponding to the target URL changes to a different screen. Based on the change from the first website screen to the second website screen (i.e., the configuration of the first website screen changes, etc.), the device can obtain information indicating differences between the first website screen and the second website screen. The device can generate a second block based on a second hash value corresponding to the information indicating the identified differences obtained. The device can link the second block to the first block and store the blockchain associated with the target URL in a result database.

[0080]

[0081] FIG. 3 is a diagram illustrating a method for identifying whether a target URL is associated with a phishing site based on a similarity DB according to one embodiment of the present disclosure.

[0082] The device can identify whether there is a string among the strings stored in the similarity DB whose similarity to the string extracted from the first web page screen exceeds the first threshold value (S310).

[0083] Specifically, the device can obtain an SSDEEP hash value for a string extracted from a first web page screen. The device can obtain a similarity between the SSDEEP hash value for the obtained string and the SSDEEP hash values ​​for multiple strings stored in a similarity database. Accordingly, the device can identify whether, among the strings stored in the similarity database, there is a string whose similarity to the string extracted from the first web page screen exceeds a first threshold value.

[0084] If there is no string in the similarity DB whose similarity exceeds the first threshold value with the string extracted from the first web page screen, the device can determine, based on multiple types of data, that the target URL is not associated with a phishing site. Furthermore, the device can input multiple types of data into the first artificial intelligence model.

[0085] Assume that there is a string in the similarity DB whose similarity to the string extracted from the first web page screen exceeds the first threshold value. In this case, the device can identify whether there is an image stored in the similarity DB whose similarity to the image extracted from the first web page screen exceeds the second threshold value (S320).

[0086] The device can obtain a hash value for an image extracted from a first web page screen. The device can obtain a similarity between the hash value for the obtained image and the hash values ​​for multiple images stored in a similarity database. Accordingly, the device can identify whether there is an image stored in the similarity database whose similarity to the image extracted from the first web page screen exceeds a second threshold value.

[0087] If there is no image in the similarity database whose similarity exceeds the second threshold value with the image extracted from the first web page, the device can determine, based on multiple types of data, that the target URL is not associated with a phishing site. Furthermore, the device can input multiple types of data into the first artificial intelligence model.

[0088] Assume that there are specific strings and images within the image database whose similarity exceeds a threshold value with strings and images extracted from the first web page screen. The device can identify scripts and comments contained within a specific site associated with the specific strings and images.

[0089] The device can identify whether the similarity between the script and comments extracted from the first web page screen and the script and comments included in a specific site exceeds a third threshold value (S330).

[0090] If the similarity between the scripts and comments extracted from the first web page screen and the scripts and comments included in a specific site does not exceed a third threshold, the device can identify the target URL as being associated with a phishing site.

[0091] Assume that the similarity between the scripts and comments extracted from the first web page screen and the scripts and comments contained in a specific site exceeds a third threshold. At this time, the device can verify whether the country information of the IP address of the site associated with the target URL matches the country information of the IP address of the specific site, and whether the domain of the site associated with the target URL has been created for more than one year (S340).

[0092] If the country information of the IP address of the site associated with the target URL matches the country information of the IP address of a specific site, and the domain of the site associated with the target URL has been created more than one year ago, the device can identify the site associated with the target URL as a normal site.

[0093] If the country information of the IP address of the site associated with the target URL does not match the country information of the IP address of a specific site, or if the domain of the site associated with the target URL is less than one year old, the device may identify the target URL as being associated with a phishing site.

[0094] Additionally or alternatively, the procedures and operations described with reference to FIG. 3 may be performed via a second AI model.

[0095] Specifically, when input data includes strings, images, scripts, and comments extracted from a first web page screen, the second AI model may be trained to output information about whether the input data (i.e., multiple types of data) should be input to the first AI model or whether the target URL is associated with a normal / phishing site. That is, the second AI model may be trained to perform operations according to steps S310 to S340 based on the input data described above.

[0096]

[0097] FIGS. 4A to 4C are diagrams illustrating examples of information and result DBs related to a target URL according to one embodiment of the present disclosure.

[0098] Figure 4a illustrates information related to a target URL output by the device. Information related to the target URL may include the content of a text message containing the first URL, the target URL, output data from the first AI model (if data was input to the first AI model), DNS information associated with the target URL, the type of site associated with the target URL, and more.

[0099] Figure 4b illustrates a result DB constructed based on information related to a target URL.

[0100] For example, the result DB may include an ID of information related to the target URL, the content of a text message containing the first URL, the target URL, output data of the first AI model (if data was input to the first AI model), the IP address of the user (i.e., device), DNS information associated with the target URL, the type of query input related to the target URL, etc.

[0101] Figure 4c illustrates information related to a target URL stored in a similarity DB, etc.

[0102] For example, information related to a target URL stored in a similarity DB, etc., may include the target URL, the IP address actually accessed when accessing the target URL, information about the country where the IP address exists, a value obtained by extracting only the JavaScript portion from the HTML code downloaded when accessing the target URL and storing an SSDEEP hash, a value obtained by extracting only the displayed string portion from the HTML code downloaded when accessing the target URL and storing an SSDEEP hash, a value obtained by extracting only the comment portion within the source code from the HTML code downloaded when accessing the target URL and storing an SSDEEP hash, a value obtained by storing an image hash for an image to measure the similarity of an image captured when accessing the target URL, a hash value for a string extracted from a captured image, etc.

[0103]

[0104] FIGS. 5A to 5D are diagrams for explaining a process of outputting information related to a target URL according to one embodiment of the present disclosure.

[0105] As an example of the present disclosure, as illustrated in FIG. 5A, a text message (510) including a first URL may be copied and then entered into a chat room associated with an application that executes a method for detecting URLs associated with phishing sites. The device may acquire information related to a target URL corresponding to the first URL according to the method described in FIGS. 1 to 4C, and output information (520) that allows access to the acquired information related to the target URL through the chat room.

[0106] As another example of the present disclosure, as illustrated in FIG. 5b, a first URL may be entered into an input window (530-1) on an application executing a method for detecting URLs associated with phishing sites. At this time, the device may display a list of URLs (530-2) checked by another device for association with phishing sites in a specific area of ​​the application. When one of the multiple URLs included in the URL list (530-2) is selected, the device may provide the results of the inspection of the selected URL.

[0107] The device can obtain information related to a target URL corresponding to the first URL according to the method described in FIGS. 1 to 4C. For example, as illustrated in FIG. 5C, the device can output information (540) that can access information related to the obtained target URL through a control UI (e.g., a quick panel) (540).

[0108] As another example, as illustrated in FIG. 5d, information related to the acquired target URL (e.g., information indicating whether the target URL is associated with a phishing site, the first website screen of the target URL, etc.) can be output through a separate application screen (550).

[0109] The embodiments described in this disclosure and the accompanying drawings merely exemplify some of the technical concepts encompassed by this disclosure. Therefore, the embodiments disclosed in this specification are intended to illustrate, rather than limit, the technical concepts of this disclosure. Therefore, it is clear that the scope of the technical concepts of the present invention is not limited by these embodiments.

[0110] All modifications and specific embodiments that can be easily inferred by a person skilled in the art within the scope of the technical idea included in the specification and drawings of the present disclosure should be construed as being included within the scope of the rights of the present disclosure.

[0111] [Explanation of symbols]

[0112] 100: Device

[0113] 110: Memory

[0114] 120: Communication module

[0115] 130: Display

Claims

1. A method for detecting a uniform resource locator (URL) associated with a phishing site, performed by a device, the method comprising: A step of performing a preprocessing operation on a first URL included in a text message to obtain a target URL associated with the first URL; A step of checking whether the target URL is included in at least one of a first database (DB) storing information on a plurality of phishing sites or a second DB storing information on a plurality of non-phishing sites; A step of capturing a first web page screen corresponding to the target URL after accessing the target URL based on confirmation that the target URL is not included in at least one of the first DB or the second DB; and Based on the identification of whether the target URL is associated with a phishing site based on multiple types of data acquired through the first web page screen, information related to the target URL is stored in a result DB, A method comprising: inputting the plurality of types of data into a first artificial intelligence model to obtain information related to the target URL based on whether it is not identified whether the target URL is associated with a phishing site based on the plurality of types of data; and storing the information related to the target URL in the result DB.

2. In paragraph 1, The preprocessing operation for the above first URL is: A method comprising: an action of removing spaces included in the first URL, an action of converting at least one special character included in the first URL to a general character, an action of converting lowercase letters included in the first URL to uppercase letters, an action of removing subdirectory information from the first URL, and an action of obtaining redirect information connected to the first URL.

3. In paragraph 1, The above multiple types of data are: Contains strings, scripts, comments, and image data extracted from the first web page screen, A method for identifying whether the target URL is associated with a phishing site based on the existence of specific data among multiple site-specific data stored in a similarity DB, the similarity between the string and image data extracted from the first web page screen exceeding a threshold value, i) scripts and comments included in a specific site corresponding to the specific data, and ii) scripts and comments extracted from the first web page screen.

4. In paragraph 3, By performing OCR (optical character recognition) on the first web page screen, a string on the first web page screen is extracted, A method wherein the target URL is identified as being associated with a phishing site if the above string is not associated with the above script, the above comment, and the above image data.

5. In paragraph 3, If there is no specific data in the similarity DB whose similarity exceeds the threshold value, it is determined that it is not identified whether the target URL is associated with a phishing site based on the plurality of types of data. A method in which the artificial intelligence model is trained to output information related to the target URL, including at least one of a type of site corresponding to the target URL, a probability that the target URL is associated with a phishing site, and a description of the site corresponding to the target URL output based on the first web page, based on the plurality of types of data.

6. In paragraph 1, Based on the text message being entered in an application executing a method for detecting a URL associated with the phishing site or in a chat room associated with the application, information related to the target URL is transmitted through the control UI (user interface) of the device or the chat room, A method in which access to the target URL is blocked based on the target URL being associated with a phishing site.

7. In paragraph 1, The step of storing information related to the above target URL in the above result DB is: A step of generating a first block based on a first hash value corresponding to information related to the target URL; A step of obtaining information indicating a difference between the first website screen and the second website screen based on the website screen corresponding to the target URL being changed from the first website screen to the second website screen; A step of generating a second block based on a second hash value corresponding to the information indicating the acquired difference; and A method further comprising the step of connecting the second block to the first block and storing the blockchain related to the target URL in the result DB.

8. In a device for detecting a uniform resource locator (URL) associated with a phishing site, the device: One or more memories; and Containing one or more processors, One or more of the above processors: Performing a preprocessing operation on a first URL included in a text message to obtain a target URL associated with the first URL; Checking whether the target URL is included in at least one of a first database (DB) storing information about a plurality of phishing sites or a second DB storing information about a plurality of non-phishing sites; Based on the determination that the target URL is not included in at least one of the first DB or the second DB, capturing the first web page screen corresponding to the target URL after accessing the target URL; and Based on the identification of whether the target URL is associated with a phishing site based on multiple types of data acquired through the first web page screen, information related to the target URL is stored in a result DB, A device configured to input the plurality of types of data into a first artificial intelligence model to obtain information related to the target URL based on whether it is not identified whether the target URL is associated with a phishing site based on the plurality of types of data, and to store the information related to the target URL in the result DB.

9. In paragraph 8, The preprocessing operation for the above first URL is: A device comprising an action of removing spaces included in the first URL, an action of converting at least one special character included in the first URL into a general character, an action of converting lowercase letters included in the first URL into uppercase letters, an action of removing subdirectory information from the first URL, and an action of obtaining redirect information connected to the first URL.

10. In paragraph 9, The above multiple types of data are: Contains strings, scripts, comments, and image data extracted from the first web page screen, A device for identifying whether the target URL is associated with a phishing site based on the existence of specific data among multiple site-specific data stored in a similarity DB, the similarity between the string and image data extracted from the first web page screen exceeding a threshold value, i) scripts and comments included in a specific site corresponding to the specific data, and ii) scripts and comments extracted from the first web page screen.

11. In paragraph 10, By performing OCR (optical character recognition) on the first web page screen, a string on the first web page screen is extracted, A device wherein the target URL is identified as being associated with a phishing site if the above string is not associated with the above script, the above comment, and the above image data.

12. In paragraph 10, If there is no specific data in the similarity DB whose similarity exceeds the threshold value, it is determined that it is not identified whether the target URL is associated with a phishing site based on the plurality of types of data. A device wherein the artificial intelligence model is trained to output information related to the target URL, including at least one of a type of site corresponding to the target URL, a probability that the target URL is associated with a phishing site, and a description of the site corresponding to the target URL output based on the first web page, based on the plurality of types of data.

13. In paragraph 8, Based on the text message being entered in an application executing a method for detecting a URL associated with the phishing site or in a chat room associated with the application, information related to the target URL is transmitted through the control UI (user interface) of the device or the chat room, A device in which access to the target URL is blocked based on the target URL being associated with a phishing site.

14. In paragraph 8, One or more of the above processors, Generate a first block based on a first hash value corresponding to information related to the target URL; Based on the website screen corresponding to the target URL being changed from the first website screen to the second website screen, information indicating a difference between the first website screen and the second website screen is acquired; Generating a second block based on a second hash value corresponding to the information indicating the obtained difference; and A device configured to store a blockchain related to the target URL in the result DB by connecting the second block to the first block.

Images