基于可信域名的网络钓鱼治理机制研究【荐】.pdfVIP

计 算 机 系 统 应 用 2010 年 第 19 卷 第 10 期 基于可信域名的网络钓鱼治理机制研究① 李海灵 1,2,3 王 伟 1,2 毛 伟 1,2 (1. 中国科学院计算机网络信息中心 北京 100190 ； 2. 中国互联网络信息中心 北京 100190 ；3.中国科学院研究生院 信息学院 北京 100190) 摘 要： 反钓鱼技术是近年的研究热点。讨论了域名、域名系统与网络钓鱼攻击的联系，提出了一个基于可信 域名的网络钓鱼治理框架。从三个不同区域采取措施保证域名及其应用的可信要素。介绍了框架内的 关键技术、核心子系统，并与基于邮件的反钓鱼框架进行了比较。分析表明从基础资源着手解决网络 钓鱼问题有着检测信息来源广泛、响应速度快、管理审计便捷的优势，对当前的互联网不良应用治理 有着启发和借鉴意义。 关键词：网络钓鱼;域名;可信要素;可信域名;反钓鱼框架 Anti-Phishing Method Based on Trustworthy Domain Names LI Hai-Ling1,2,3 , WANG Wei 1,2 , MAO Wei 1,2 (1. Computer Network Information Center, Chinese Academy of Sciences, Beijing 100190, China; 2. China Internet Network Information Center, Beijing 100190, China; 3. Graduate University of Chinese Academy of Sciences, Beijing 100190, China) Abstract: Anti-phishing technology has been a research hotspot in recent years. In this paper, the relationship of domain names, domain name system and phishing is discussed. A novel anti-phishing framework based on trustworthy domain names is put forward with methods to secure the trustworthy factors of domain name from three domains. Key technologies and subsystems are described subsequently, and a comparison is done with an email-based phishing webpage detection system. Analysis shows that address phishing issues from basic resources have the advantage of a wider range of information resources, a faster response time, a more convenient management system and an audit, which is also instructive for bad Internent governance. Keywords: phishing; domain name; trustworthy factors; trustworthy domain names; anti-phishing framework 1 引言 其中网络钓鱼事件占 27.04%。随着钓鱼攻击日益猖 2009 年底中国网民规模达 3.84 亿[1] ，居世界第