Link Text Normalization for Spoofing Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques fail to effectively detect and prevent web link spoofing attacks, where illegitimate links appear visually similar to legitimate ones, leading to users unintentionally accessing malicious sites, especially due to character substitutions and internationalized domain name homograph attacks.
Innovation Solution
A normalization technique and comparison-based method are employed to identify and disable illegitimate hyperlinks by converting visually similar characters into standardized forms and comparing link text with link URLs, ensuring they match or do not match, thereby determining the safety of the link.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If visual similarity between characters is exploited to create spoofed links, then the spoofing attack becomes more effective, but the ability to detect and distinguish legitimate from illegitimate links deteriorates
Solution Approach 1:
The patent changes the parameter of character representation by normalizing visually similar characters (homographs) to their canonical forms. This allows the detection system to recognize that characters like 'a' and 'а' (Cyrillic) represent different underlying values despite visual similarity, thereby detecting spoofed links while maintaining the visual appearance that makes attacks effective
Solution Approach 2:
The patent introduces an intermediary normalization layer between the visual representation of characters and the comparison logic. This intermediary process converts visually similar but semantically different characters into distinct normalized forms, enabling accurate detection without requiring users to perceive visual differences
2Ease of operation
If link text is displayed as a URL to increase user trust, then user confidence in the link increases, but the risk of users being deceived by spoofed URLs increases
Solution Approach 1:
The patent performs preliminary normalization and comparison of link text with actual URL before the user interacts with the link. By pre-processing the link data to normalize characters and compare canonical forms, the system identifies spoofed links in advance, allowing trust indicators to be applied correctly without exposing users to phishing risks
Solution Approach 2:
The patent implements a feedback mechanism where the normalized comparison result informs the display or interaction of the link. If spoofing is detected through normalization mismatch, the system can provide feedback by blocking the link, showing warnings, or highlighting discrepancies, thereby maintaining user trust while preventing deception
3Productivity
If traditional string matching is used to verify link text against URL, then the detection method is simple and fast, but it fails to detect visually similar character substitutions
Solution Approach 1:
The patent changes the parameter of character encoding by converting visually similar characters to their normalized canonical forms before comparison. This transformation maintains the efficiency of string matching operations while dramatically improving detection accuracy, as the normalization process is computationally lightweight and enables direct comparison of semantically equivalent or different characters
Data Source
AI summary
Methods and apparatus are disclosed for detecting illegitimate or spoofed links on a web page. Illegitimate links can be detected by receiving a web link that includes link text and a link address, generating normalized link text based upon the link text, wherein characters in the link text that are visually similar are represented by a single normalized character identifier in the normalized text, determining whether the normalized link text is in the format of a link address, and determining that the text is safe when the normalized link text is not in the format of a link address. The techniques disclosed herein further involve determining whether the normalized link text matches the link address, determining that the text is safe when the normalized link text matches the link address, and determining that the text is unsafe when the normalized link text does not match the link address.