Universal resource locator verification service with cross-branding detection
View Patent ↗A URL verification service is provided that is used to evaluate the trustworthiness of universal resource locators (URLs). As a user browses the world wide web, the URL for a web page to which the user is browsing is evaluated. A brand and a second level domain portion may be extracted from the URL and used as search engine inputs in evaluating the trustworthiness of the URL. The content of the web page can also be analyzed. Page elements may be extracted from the web page and compared to page elements in a brand indicator table to identify page brands associated with the web page. The brand extracted from the URL is compared to the page brands to detect cross-branding. If cross-branding is detected, the URL verification service helps to prevent the user from submitting sensitive information over the internet.
1. A method for determining whether web page universal resource locators (URLs) are associated with trusted or fraudulent web sites, comprising:
as a user browses the world wide web using computing equipment, obtaining by a URL verification engine on the computing equipment a URL for a web page of unknown authenticity, wherein the URL comprises a second level domain and wherein the second level domain comprises a top level domain;
extracting by the URL verification engine on the computing equipment a brand name from the URL, wherein the brand name comprises a portion of the second level domain and wherein extracting the brand name from the URL comprises discarding the top level domain;
determining by the URL verification engine on the computing equipment whether the URL is untrusted using the extracted brand name as at least one input to an internet search engine, wherein determining whether the URL is untrusted using the extracted brand name comprises:
using the extracted brand name and the second level domain to query the internet search engine to produce a link count value and a ranked list of second level domains; and
using the link count value and a position of the second level domain in the ranked list in computing a Boolean trust value and using the Boolean trust value in determining whether the URL is trusted or untrusted;
if the URL is not determined to be untrusted, evaluating by the URL verification engine on the computing equipment content in the web page to identify at least one page brand name that is associated with the web page and comparing the page brand name to the extracted brand name, wherein evaluating the content in the web page comprises:
extracting page elements from the web page; and
comparing the extracted page elements to information in a brand indicator table to identify the page brand name;
determining by the URL verification engine on the computing equipment whether cross-branding is present, wherein cross-branding is present if the page brand name is different from the extracted brand name; and
if it is determined that cross-branding is not present, notifying the user that the URL is trusted.
2. The method defined in claim 1 further comprising:
if cross-branding is determined to be present, determining by the URL verification engine on the computing equipment whether the web page can be used to collect information from the user.
3. The method defined in claim 1 further comprising:
if cross-branding is determined to be present, determining by the URL verification engine on the computing equipment whether the web page is asking the user to submit sensitive information.
4. The method defined in claim 1 further comprising:
if cross-branding is determined to be present, determining by the URL verification engine on the computing equipment whether the web page is asking the user to upload a credit card number.
5. The method defined in claim 1 further comprising:
if cross-branding is determined to be present, determining by the URL verification engine on the computing equipment whether the web page is asking the user to submit sensitive information; and
if it is determined that the web page is asking the user to submit sensitive information, notifying the user that the URL is untrusted.
6. The method defined in claim 1 wherein evaluating by the URL verification engine on the computing equipment the content in the web page further comprises
comparing the page brand name to a list of phishing target brands.
7. The method defined in claim 1 further comprising:
comparing by the URL verification engine on the computing equipment the page brand name to a list of phishing target brands; and
if comparing the page brand name to the list of phishing target brands reveals that the page brand name is not in the list of phishing target brands, notifying the user that the URL is trusted.
8. The method defined in claim 1 further comprising:
comparing by the URL verification engine on the computing equipment the page brand name to a list of phishing target brands; and
if comparing the page brand name to the list of phishing target brands reveals that the page brand name is in the list of phishing target brands, comparing the extracted brand name to the page brand name.
9. The method defined in claim 1 further comprising:
comparing by the URL verification engine on the computing equipment the page brand name to a list of phishing target brands;
if comparing the page brand name to the list of phishing target brands reveals that the page brand name is in the list of phishing target brands, comparing the extracted brand name to the page brand name; and
if comparing the extracted brand name to the page brand name produces a match, notifying the user that the URL is trusted.
10. The method defined in claim 1 further comprising:
comparing by the URL verification engine on the computing equipment the page brand name to a list of phishing target brands;
if comparing the page brand name to the list of phishing target brands reveals that the page brand name is in the list of phishing target brands, comparing the extracted brand name to the page brand name; and
if comparing the extracted brand name to the page brand name does not produce a match, determining whether the web page is asking the user to submit sensitive information.
11. The method defined in claim 1 further comprising:
comparing by the URL verification engine on the computing equipment the page brand name to a list of phishing target brands;
if comparing the page brand name to the list of phishing target brands reveals that the page brand name is in the list of phishing target brands, comparing the extracted brand name to the page brand name;
if comparing the extracted brand name to the page brand name does not produce a match, determining whether the web page is asking the user to submit sensitive information; and
if it is determined that the web page is asking the user to submit sensitive information, notifying the user that the URL is untrusted.
12. The method defined in claim 1 further comprising:
if comparing the extracted brand name to the page brand name does not produce a match, determining by the URL verification engine on the computing equipment whether the web page is asking the user to submit sensitive information; and
if it is determined that the web page is asking the user to submit sensitive information, notifying the user that the URL is untrusted.