Abstract:
Computer-implemented methods, apparatus, and computer-readable media for recognizing legitimate websites. An embodiment of the inventive method comprises the steps of storing ( 200 ) a plurality of network addresses, associating ( 210 ) a unique cue with each of the plurality of network addresses, determining ( 220 ) whether a user launches a URL, and when it is determined that the user launches the URL, determining ( 230 ) whether the URL matches one of the plurality of network addresses, and when it is determined that the URL matches one of the plurality of network addresses, retrieving ( 240 ) the cue associated with the one of the plurality of network addresses and deploying ( 250 ) the associated cue.

Description:
TECHNICAL FIELD 
     This invention pertains to the field of preventing phishing scams that plague personal and other computers, and, in particular, to the deployment of site-associated cues for antiphishing purposes. 
     BACKGROUND ART 
     Phishing scams have been an immense and growing problem, and they continue to grow in frequency and sophistication. In a phishing scam, a phisher sends a legitimate-looking email that appears to originate from a targeted website, e.g., a financial institution, a shopping site, or an internet Service Provider. The phisher sends the fraudulent email in an attempt to convince the recipient to enter personal or financial information, e.g., a credit card number, a bank account number, a password, or a pin number. 
     PassMark Security, Inc. provides an antiphishing system where back-end systems at the targeted sites allow their users to associate a personal picture with the site&#39;s password form. When the user enters his or her username at the targeted site, the site displays a password form that includes a personal picture that was supplied by the user for association with the site. Thus, the user expects a particular personal picture with a request for a password at a particular site. If the user does not see the personal picture with the request for a password, the user knows not to provide the password. PassMark&#39;s system allows the user to easily recognize a phishing scam. 
     One major drawback to this antiphishing system is that a phisher can proxy requests to the targeted site, thereby obtaining the personal picture associated with a given username. Thus, in some cases, the targeted site is vulnerable to a spoofing attack where a “man-in-the-middle” can obtain the user&#39;s picture and replay an attack to steal the user&#39;s information. PassMark&#39;s system also requires the targeted site to implement its technology. If the targeted site does not implement PassMark&#39;s technology, the user of the site does not benefit from the antiphishing system. Accordingly, there is a need for a mechanism that can be easily implemented and that allows a user to easily discriminate between legitimate and spoofed versions of a targeted website. 
     DISCLOSURE OF INVENTION 
     In accordance with methods and systems consistent with the present invention, computer-implemented methods, apparatus, and computer-readable media are provided for recognizing legitimate websites. An embodiment of the inventive method comprises the steps of storing ( 200 ) a plurality of network addresses, associating ( 210 ) a unique cue with each of the plurality of network addresses, determining ( 220 ) whether a user launches a URL, and when it is determined that the user launches the URL, determining ( 230 ) whether the URL matches one of the plurality of network addresses, and when it is determined that the URL matches one of the plurality of network addresses, retrieving ( 240 ) the cue associated with the one of the plurality of network addresses and deploying ( 250 ) the associated cue. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       These and other more detailed and specific objects and features of the present invention are more fully disclosed in the following specification, reference being had to the accompanying drawings, in which: 
         FIG. 1  depicts a data processing system suitable for implementing an embodiment of the present invention. 
         FIG. 2  is a flow diagram illustrating an embodiment of the present invention. 
     
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
     Methods, apparatus, and articles of manufacture consistent with the present invention overcome the shortcomings of the prior art by deploying a site-associated cue locally on a user&#39;s machine. Using methods and systems consistent with the present invention, the user maintains a list of legitimate sites, and the user need not rely on the targeted site to protect the user from a phishing scam. By performing its tasks locally, methods and systems consistent with the present invention are not vulnerable to network-based proxy attacks. Because none of the cues used by the user for identifying targeted sites is transmitted over any network connections, the cues are not vulnerable to sniffing or Domain Name System (“DNS”) spoofing. 
       FIG. 1  depicts an exemplary data processing system  100  suitable for practicing methods and systems consistent with the present invention. Data processing system  100  is connected to a network  190 , such as a Local Area Network, Wide Area Network, or the internet. 
     Data processing system  100  contains a main memory  110 , a secondary storage device  120 , a processor  130 , an input device  140 , and a video display  150 . These internal components exchange information with one another via a system bus  160 . These components are standard in most computer systems suitable for use with practicing methods and configuring systems consistent with the present invention. 
     Memory  110  includes a program  170  having a component  180 . One having skill in the art will appreciate that program  170  can reside in a memory on a system other than data processing system  100 . Program  170  may comprise or may be included in one or more code sections containing instructions for performing their respective operations. While program  170  is described as being implemented as software, the present invention may be implemented as any combination of hardware, firmware, and software. 
     Although not shown in  FIG. 1 , like all data processing systems, data processing system  100  has an operating system that controls its operations, including the execution of program  170  by processor  130 . Also, although aspects of one implementation consistent with the principles of the present invention are described herein with program  170  stored in main memory  110 , one skilled in the art will appreciate that all or part of methods and systems consistent with the present invention may be stored on or read from other computer-readable media, such as secondary storage devices  120 , e.g., hard disks, floppy disks, and CD-ROM; a carrier wave received from a network such as the internet; or other forms of ROM or RAM, either currently known or later developed. Finally, although specific components of data processing system  100  have been described, one skilled in the art will appreciate that a data processing system suitable for use with methods and systems consistent with the present invention may contain additional or different components. 
     Component  180  includes a list of network addresses. The user may add a network address to the list either by manually typing the network address into the list, or by pressing a toolbar button integrated into a browser when the user visits the site the user wishes to add. A default list of network addresses also may be pre-installed with component  180 . This default list includes network addresses that are the most likely targets of phishing scams, for example, those of leading financial institutions. 
     A user associates each of the network addresses in the list with a specific cue. These cues may include audio signals, visual signals, or both. A cue may consist of a picture, an animation, a sound, a dialog, or a change in the appearance of a user interface such as a toolbar indicator. The cue also may launch a particular application program selected by the user. 
     The user may use the same cue for all of the sites on its list, or the user may select a specific set of cues for each site. Alternatively, the user may select a set of cues for specific sites, while using another set of cues for sites in the default list of phishing target sites. Each of the cues may be implemented separately or in combination. For example, for a given site, the user could implement a cue that flashes the picture of the user&#39;s dog three times while playing a barking sound. 
     Methods and systems consistent with the present invention provide many options regarding how to implement the cues. One option is to implement a browser plug-in or active protocol filter such as those in the Norton Internet Security (“NIS”) and other personal firewall products, e.g., those used for ad blocking or script blocking. Thus, an NIS protocol filter or a browser plug-in may activate a sound or animation when the user launches a given network address. As another option, a protocol filter may alter the HTML of associated sites to include the cues, e.g., a picture could be included as the background of the web page, or inserted at the top or bottom of the web page. Rather than modifying the HTML, a toolbar button on the browser may change its appearance, display a picture, play a sound, play an animation, or pop-up a dialog, another window or user interface element. The targeted site may be given the option to indicate where it prefers the visual cues to be inserted on its page through the use of HTML comments, custom tags, style sheet entries, etc. 
       FIG. 2  depicts a flow chart illustrating the steps performed by component  180  in one embodiment to recognize legitimate websites. Component  180  initially stores a list of network addresses (step  200 ). As discussed above, this list initially may be supplied with component  180 . This list also may be added or modified by the user. Component  180  then associates a unique cue with each network address (step  210 ). Component  180  waits for the user to launch a Uniform Resource Locator (“URL”) (step  220 ). After the user launches a URL, component  180  determines whether the URL matches one of the network addresses in the list (step  230 ). If component  180  determines that the URL matches one of the network addresses, component  180  retrieves the cue associated with the network address (step  240 ), and deploys the associated cue (step  250 ). Thus, if the associated cue for the user&#39;s bank is a picture of the user&#39;s children, upon determining that the user entered the correct address for the user&#39;s bank, component  180  retrieves the stored picture and displays it on the user&#39;s computer screen as part of the web page for the user&#39;s bank. Upon seeing the picture of his or her children, the user can then confidently enter his or her password knowing that he or she is at the correct site. If component  180  determines that the URL does not match any of the network addresses, component  180  does not launch any cues. 
     The above description is included to illustrate the operation of the preferred embodiments and is not meant to limit the scope of the invention. The scope of the invention is to be limited only by the following claims. From the above discussion, many variations will be apparent to one skilled in the art that would yet be encompassed by the spirit and scope of the present invention.