RU103643U1 - ANTI-PHISH ATTACK SYSTEM - Google Patents

Abstract

 1. The system for countering phishing attacks consists of the following components:! a server designed to update the lists of IP addresses of unified resource locators (URLs), store the database of genuine resources, transfer the database of genuine resources to the client side, check for potentially phishing IP addresses, transfer the results of the check to match the list of genuine IP addresses of the resource; associated with the client module synchronization tool and consisting of:! a database of genuine resources associated with a means of polling servers of a domain name system (DNS servers) and with a means of synchronization for storing a list of URLs and sets of genuine IP addresses corresponding to each URL; ! means for interrogating servers of a domain name system associated with a database of genuine resources and with a means of synchronization for querying DNS servers to generate sets of genuine IP addresses for each URL entry from a list of URLs stored in the database of genuine resources; ! a database of phishing resources associated with the synchronization tool and designed to collect and store IP addresses of phishing resources; ! synchronization tools associated with a database of genuine resources, a means of polling servers of a domain name system, a database of phishing resources and a means of synchronizing a client module and designed to communicate with a client module of the system in order to update the client version of the database of genuine resources; to obtain specific URLs from the client module for transmission to the DNS server polling tool and then

Description

Technical field

The utility model relates to systems for ensuring information security of computer systems and more specifically to systems for countering phishing attacks.

State of the art

The word “phishing” comes from the English word “phishing”, which is consonant with the word “fishing”, which in turn translates as fishing - denotes a form of Internet fraud, the purpose of which is to gain access to user data of a confidential nature (logins, passwords, etc. .). Phishing as a form of fraud on the Internet, today the phenomenon is massive and known to many users. In classical phishing, an attacker distributes e-mails to users of social networks, online banking, and web-based email services (“cast a fishing rod”). In these letters, an attacker, on behalf of a trusted organization, formulates the reasons why the user should be informed, for example, his username and password used for identification in the specified services. The contents of the letters mislead users, forcing them to believe that they must act in accordance with the instructions given, for example, the letter may require the user to re-enter the username and password due to the introduction of additional security measures, for which it is necessary to follow the link to the service website . However, the link in the letter leads to a fake (phishing) site that mimics the site of a legal service. Users who are victims of fraud thus disclose their confidential data. User data collected as a result of phishing attacks is used by cybercriminals in a variety of ways: sending spam, extorting money to return a stolen account, stealing money, etc. Many users who actively use modern web services have more than once encountered such cases of fraud and are cautious of such phishing emails. At the same time, attackers are improving their techniques to increase the effectiveness of phishing attacks using special malicious programs.

There are anti-phishing systems described, for example, in US Pat. No. 7,634,810 and in US 20070136806 A1 and US 20070118528 A1, which use the approach of comparing requested website addresses with a black list of addresses, blocking should be found when the requested address is in the black list of addresses.

However, these systems do not allow you to fight against new fake addresses that were not blacklisted at the time of the fraud.

There are systems cited, for example, in WO 2006KR0002662, which use the approach of comparing unified web page indexes (URLs) with whitelisted URLs.

However, this system does not allow you to combat the type of phishing, in which, for example, using malicious programs, the IP address of the requested resource is replaced with the previous name and domain in the URL.

An analysis of the prior art and the possibilities that arise when using new approaches to solving the described problem, allows you to get a new system, namely a system to counter phishing attacks. The result of this system is to prevent the theft of confidential information from Internet users by fraudulently redirecting users to various Internet services that mimic original sites.

Utility Model Essence

This useful model is designed to prevent the theft of confidential information of Internet users by fraudulently redirecting users to fake imitating original sites of trusted companies and Internet services.

The technical result of this utility model is to automatically block attempts by Internet users to download a site that simulates the original Internet service in order to prevent the theft of user confidential data.

The system for countering phishing attacks consists of the following components: a server designed to update the lists of IP addresses of unified resource locators (URLs), store the database of genuine resources, transfer the database of genuine resources to the client side, check potential phishing IP addresses, transfer the results of the check to match the list of genuine IP addresses of the resource; associated with the client module by means of synchronization and consisting of: a database of genuine resources associated with a means of polling servers of a domain name system (DNS servers) and with a means of synchronization and intended to store a list of URLs and sets of genuine IP addresses corresponding to each URL; means for interrogating servers of a domain name system associated with a database of genuine resources and with a means of synchronization for querying DNS servers to generate sets of genuine IP addresses for each URL entry from a list of URLs stored in the database of genuine resources; a database of phishing resources associated with the synchronization tool and designed to collect and store IP addresses of phishing resources; synchronization tools associated with a database of genuine resources, a means of polling servers of a domain name system, a database of phishing resources and a means of synchronizing a client module and designed to communicate with a client module of the system in order to update the client version of the database of genuine resources; to obtain specific URLs from the client module for transmission to the DNS server polling tool for processing and subsequent transfer to the client module the actual IP addresses of the specified resource; and to obtain phishing IP addresses from the client module for subsequent entry into the database of phishing resources; the client module associated with the server and designed to store the client version of the database of genuine resources; identifying potentially phishing IP addresses of resources; granting or denying access to a resource with a potentially identified phishing IP address in accordance with the results of checking for coincidence with a list of genuine IP addresses of the requested resource; applying actions to provide access to a genuine resource, which provides for blocking access to a resource if a phishing attack is detected, thereby countering a phishing attack, while the client module consists of: a client version of the database of genuine resources associated with the control module and with the client synchronization tool and designed to store a list of URLs and sets of genuine IP addresses corresponding to each URL received from the server; means for registering requests associated with the control module and designed to register user requests to the user's computer operating system for providing access to Internet resources and generating data for the control module, the URLs of which are contained in the client version of the database of genuine resources; a control module intended for: comparing data received by the request registration module with data from the client version of the database of genuine resources, providing access to the resource in case of data coincidence, otherwise, for sending via the synchronization tool a request for an actual list of IP addresses of the specified resource, comparing the data received by the request registration module with the data of the current list of IP addresses, providing access to the resource in case of data coincidence, otherwise taking into account the link URL - the IP address is sent through the synchronization tool to the server and is entered into the database of information about phishing resources, and actions are taken to provide access to the genuine resource; the control module is associated with a means for registering requests, a client version of a database of genuine resources information, and a means for synchronizing a client; means for synchronizing the client module associated with the control module and the client version of the database of information of genuine resources, designed to send requests to the server for the provision of current lists of IP addresses, obtain new versions of the database of information of genuine resources and current lists of IP addresses.

In a particular embodiment of the system, the act of providing access to a genuine resource may be to provide the operating system with correct data about the requested resource.

In another particular embodiment of the system, the client module, in case of a request for access to a phishing IP address, makes an access request to each resource from the client version of the database of genuine resources in order to obtain new phishing IP addresses.

Brief Description of the Drawings

Additional objectives, features and advantages of the present utility model will be apparent from reading the following description of the implementation of the utility model with reference to the accompanying drawings, in which:

Figure 1 shows the structural diagram of the claimed system to combat phishing attacks;

Figure 2 shows the process of checking the requested resource for phishing and providing access to a legitimate resource;

Description of Embodiments of a Utility Model

The objects and features of the present utility model, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present utility model is not limited to the exemplary embodiments disclosed below, it can be embodied in various forms. The essence described in the description is nothing more than the specific details provided to assist the specialist in the field of technology in a comprehensive understanding of the utility model, and the present utility model is determined only in the scope of the attached formula.

As can be seen in FIG. 1, the system 100 for combating phishing attacks in accordance with this utility model contains several modules, namely: a server 110 consisting of a database of genuine resources 112, a means of polling servers of the domain name system 111, a database of phishing resources 114 and synchronization means 113, as well as a client module 120, consisting of a client version of the authentic resource database 122, request registration means 124, control module 123, and synchronization means 121 of the client module.

Each system module can be made in the form of either a separate or one computer containing a processor, memory, and other devices connected via a bus: input-output devices, a display, a communication device, etc.

The authentic resource database 112, associated with the server polling tool for the domain name system 111 and the synchronization tool 113, is intended to store a list of URLs and sets of authenticated verified IP addresses corresponding to each URL. The list of controlled URLs can be made up of URLs of Internet resources of banking services, state resources of remote servicing of citizens, as well as various services that are in any way connected with personal information of users.

The tool for querying the servers of the domain name system 111 is associated with a database of genuine resources 112 and with a tool for synchronizing 113 and designed to query DNS servers 130 in order to generate sets of genuine IP addresses for each URL entry from the list of URLs stored in the database of genuine resources 112 In order to avoid compromise of the DNS servers 130 in order to substitute the IP addresses of the resources, the survey is performed by trusted DNS servers via secure communication channels. The polling tool 111 can be configured for various modes of updating the database of genuine resources 112, for example, 1 time every 6 hours, or broken down by the domain update, for example, all records of the .РФ domain URLs are updated first, then .RU, then .СОМ and etc.

The database of phishing resources 114 is associated with the synchronization tool 111 and is designed to collect and store IP addresses of phishing resources obtained by suppressing the fact of phishing by the described system.

The synchronization tool 113 associated with the authentic resource database 112, the polling server of the domain name system 111, the phishing resource database 114 and the synchronization tool of the client module 121 and intended for communication with the client module 120 of the system 100, in order to update the client version of the database genuine resources 122, to obtain certain URLs from client module 120 for transmission to the DNS server 111 polling tool and then transmitting current module IP addresses to client module 120 resource and to obtain from the client module 120 phishing IP addresses for the subsequent introduction of phishing resources to the database 114.

The client version of the authentic resources database 122 is associated with the control unit 123 and with the synchronization tool 121 of the client and is intended to store a list of URLs and sets of genuine IP addresses corresponding to each URL. Creating a client version of the database of authentic resources 122 on the side of the client module 120 is designed to minimize the flow of the schedule when checking the authenticity of the IP address of the requested resource, since with this implementation there is no need to send a verification request to server 110 to verify the IP address of the requested resource. However, this option also contains a drawback - this is possibly not relevant data. This disadvantage can be considered insignificant, since updating the IP addresses of resources is extremely rare, and even in the case of accessing a new IP address, the system 100 implements additional verification of IP addresses that are not included in the client version of the database of authentic resources 122, described below.

Request registration tool 124 is associated with the control module 123 and is designed to register user requests to the user's computer operating system for providing access to Internet resources, the URLs of which are contained in the client version of the database of genuine resources 122.

The control module 123 is associated with the request registration means 124, the client version of the authentic resources information database 122 and the client synchronization means 121, and is intended to compare the information received by the requests registration means 124 with the data of the client version of the authentic resources information database 122 in order to provide access in case if the data on the results of the verification match, or the organization of the further verification described below, and the application of actions to provide access to the genuine resource.

Synchronization tools 121 of the client module is associated with the control module 123 and the client version of the database of genuine resources information 122 and is intended to send requests to the server for the provision of current lists of IP addresses, to obtain new versions of the database of information of genuine resources and current lists of IP addresses.

Next, with reference to figure 2 and figure 1, will be described in detail the operation of the system in accordance with this utility model.

After registering a new user request to the operating system for providing access to the Internet resource 200 by the request registration tool 124, the request information is transmitted to the control module 123. The control module 123 reconciles the request information and the client version of the database of genuine resources 122. If the request URL is not contained in the client version of the database of genuine resources 122, then 201 is granted access, otherwise 202 IP addresses of the requested resource are compared, learned by means of the register of requests 124, with the IP addresses of this resource from the client database of genuine resources 122. If the comparison result 202 is positive, then access to the resource is provided 201, otherwise, a request is sent to the server to provide an up-to-date list of IP addresses of the requested resource 203 through the synchronization tool 121 .

Upon receipt of a request to the synchronization tool 113 from the client for a current list of IP addresses of a specific resource 220, the server 110 polls 221 trusted DNS servers through the polling tool for the servers of the domain name system. Then, through the synchronization tool 113, the results of the survey 222 are sent to the client and the information obtained as a result of the survey 221 is entered into the database of genuine resources 112.

After receiving the actual list of IP addresses of the requested resource 204 from the server, the synchronization tool 121 of the client module makes the information received from the server 205 into the client version of the database of genuine resources 122. The following is a comparison of the IP address of the resource received by the request registration tool 124 with the IP addresses of the current address list 206. If the result of comparison 206 is positive, then access to the resource is provided 201, otherwise the user’s operating system is provided with the correct IP the address of the requested resource 207 and transmission through the synchronization tool 121 of the URL and a fake IP address to the server 208 for further recording of information in the database of phishing resources 114.

Server 110 conducts a planned survey of 210 trusted DNS servers to update the IP addresses recorded in the database of genuine resources 112. Next, server 110 stores the information obtained from the planned survey 211 in the database of genuine resources. Then, updates are sent to client versions of the database of genuine resources 212.

In conclusion, it should be noted that the information provided in the description are only examples that do not limit the scope of this utility model defined by the formula. The person skilled in the art will understand that there may be other options for implementing this utility model, consistent with the nature and scope of this utility model.

Claims (3)

1. The system for countering phishing attacks consists of the following components: a server designed to update the lists of IP addresses of unified resource locators (URLs), store the database of genuine resources, transfer the database of genuine resources to the client side, check for potentially phishing IP addresses, transfer the results of the check to match the list of genuine IP addresses of the resource; associated with the client module synchronization tool and consisting of: a database of genuine resources associated with a means of polling servers of a domain name system (DNS servers) and with a means of synchronization for storing a list of URLs and sets of genuine IP addresses corresponding to each URL; means for interrogating servers of a domain name system associated with a database of genuine resources and with a means of synchronization for querying DNS servers to generate sets of genuine IP addresses for each URL entry from a list of URLs stored in the database of genuine resources; a database of phishing resources associated with the synchronization tool and designed to collect and store IP addresses of phishing resources; synchronization tools associated with a database of genuine resources, a means of polling servers of a domain name system, a database of phishing resources and a means of synchronizing a client module and designed to communicate with a client module of the system in order to update the client version of the database of genuine resources; to obtain specific URLs from the client module for transmission to the DNS server polling tool for processing and subsequent transfer to the client module the actual IP addresses of the specified resource; and to obtain phishing IP addresses from the client module for subsequent entry into the database of phishing resources; the client module associated with the server and designed to store the client version of the database of genuine resources; identifying potentially phishing IP addresses of resources; granting or denying access to a resource with a potentially identified phishing IP address in accordance with the results of checking for coincidence with a list of genuine IP addresses of the requested resource; application of actions to provide access to a genuine resource, which provides for blocking access to a resource if a phishing attack is detected, thereby countering a phishing attack, while the client module consists of: the client version of the database of genuine resources associated with the control module and with the client synchronization tool and designed to store a list of URLs and sets of genuine IP addresses corresponding to each URL received from the server ;. means for registering requests associated with the control module and designed to register user requests to the user's computer operating system for providing access to Internet resources and generating data for the control module, the URLs of which are contained in the client version of the database of genuine resources; a control module designed for: comparing the data received by the request registration module with the data from the client version of the database of genuine resources, providing access to the resource in case of data coincidence, otherwise, to send through the synchronization tool a request for an up-to-date list of IP addresses of the specified resource, comparing the data received by the request registration module with the data of the current list of IP addresses, providing access to the resource in case of data coincidence, otherwise, a bunch of URL-IP addresses is sent through the synchronization tool to the server and entered into the database of information about phishing resources, and actions are taken to provide access to the genuine resource; the control module is associated with a means for registering requests, a client version of a database of genuine resources information, and a means for synchronizing a client; means for synchronizing the client module associated with the control module and the client version of the database of information of genuine resources, designed to send requests to the server for the provision of current lists of IP addresses, obtain new versions of the database of information of genuine resources and current lists of IP addresses. 2. The system according to claim 1, in which the action to provide access to a genuine resource may be providing the operating system with correct data about the requested resource. 3. The system according to claim 1, in which the client module, in case of a request for access to a phishing IP address, makes an access request to each resource from the client version of the database of genuine resources in order to obtain new phishing IP addresses.