Preventing phishing using DNS
AssigneeInternational Business Machines Corporation
InventorsAntonio Bagarolo, Paolo Ottaviano, Gianluca Perreca, Pasquale Maria Mascolo Montenero, Marco Imperia, Maximiliano Cammisa
Life of this patent
Estimating the term…
Abstract
Methods and systems for preventing phishing attacks using the domain name system are disclosed. A method includes: receiving, by a computing device, a domain name system (DNS) request comprising a domain name; determining, by the computing device, at least one domain name that is similar to the domain name; and sending, by the computing device, the at least one domain name that is similar to the domain name as a response to the DNS request.
Claims20
A method comprising:
- receiving, by a local domain name server, a domain name system (DNS) request comprising a domain name from a web browser of a remote user computing device;
- determining, by a phishing prevention engine program module of the local domain name server, at least one preexisting domain name that is similar to the domain name in the DNS request;
- determining, by the local domain name server, an Internet Protocol (IP) address associated with the domain name in the DNS request;
- sending, by the local domain name server, the IP address to the web browser of the remote user computing device in response to the DNS request;
- and
- sending, by the phishing prevention engine program module of the local domain name server, the at least one preexisting domain name that is similar to the domain name in the DNS request to the web browser of the remote user computing device in response to the DNS request.
A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a recursive local domain name server to cause the recursive local domain name server to:
- receive a domain name system (DNS) resolution request from a web browser of a remote user computing device comprising the first domain name;
- send a request for DNS resolution including the first domain name to a registrar name server;
- receive a TXT field in a DNS record associated with the first domain name in response to the request for DNS resolution, the TXT field comprising a list of one or more preexisting domain names similar to the first domain name and similarity scores associated with respective ones of the one or more preexisting domain names similar to the first domain name;
- generate, by a phishing prevention engine program module of the recursive local domain name server, a filtered list of the preexisting domain names similar to the first domain name by filtering the list of one or more preexisting domain names similar to the first domain name based on the similarity scores;
- and
- send the filtered list of preexisting domain names similar to the first domain name to the web browser of the remote user computing device as a response to the DNS resolution request, wherein the filtered list of preexisting domain names similar to the first domain name indicate to the remote user computing device that the first domain name is likely a fraudulent website that should not be loaded by the remote user computer device.
A system comprising:
- a hardware processor, a computer readable memory, and a computer readable storage medium associated with a computing device;
- program instructions to send a domain name system (DNS) request for records associated with a domain name to a local domain name server;
- program instructions to receive and store at least one preexisting domain name that is similar to the domain name as a response to the DNS request;
- program instructions to determine that the domain name is associated with a fraudulent website using the received at least one preexisting domain name that is similar to the domain name,
- wherein the program instructions are stored on the computer readable storage medium for execution by the hardware processor via the computer readable memory.
Dependencies are inferred from the claim text.