标题： 基于登录页面透明度和视觉相似性的零日钓鱼防御协议 显示英文标题

标题： A Login Page Transparency and Visual Similarity Based Zero Day Phishing Defense Protocol

摘要： 网络钓鱼是一种常见的网络攻击，它使用类似网站来欺骗用户透露敏感信息。 互联网社区和安全组织已经做出了大量努力来检测、防止或培训用户以避免成为网络钓鱼攻击的受害者。 多年来，大多数相关研究都高度多样化且面向应用，通常作为HTTP客户端、服务器或第三方的独立解决方案。 然而，针对开发全面或主动的协议导向解决方案以有效应对网络钓鱼攻击的研究却有限。 受证书透明度概念的启发，该概念允许客户端公开验证由证书颁发机构（CAs）颁发的证书，从而提高透明度，我们提出了一种称为页面透明度（PT）的概念。 所提出的PT要求捕获用户敏感信息的登录页面通过PLS进行公开记录，并向网络客户端提供以供验证。 这些页面通过加密证明进行验证，以确保其已被记录。 由于所有页面都在PLS上进行记录，并通过全面的视觉页面匹配算法与现有页面进行视觉比较，攻击者无法在PLS上注册欺骗性的类似页面并获得客户端验证所需的加密证明。 所有实现都在客户端进行，这通过引入一个新的HTTP PT头得以实现，从而无需进行平台特定的更改或安装第三方解决方案来防范网络钓鱼。 显示英文摘要

摘要： Phishing is a prevalent cyberattack that uses look-alike websites to deceive users into revealing sensitive information. Numerous efforts have been made by the Internet community and security organizations to detect, prevent, or train users to avoid falling victim to phishing attacks. Most of this research over the years has been highly diverse and application-oriented, often serving as standalone solutions for HTTP clients, servers, or third parties. However, limited work has been done to develop a comprehensive or proactive protocol-oriented solution to effectively counter phishing attacks. Inspired by the concept of certificate transparency, which allows certificates issued by Certificate Authorities (CAs) to be publicly verified by clients, thereby enhancing transparency, we propose a concept called Page Transparency (PT) for the web. The proposed PT requires login pages that capture users' sensitive information to be publicly logged via PLS and made available to web clients for verification. The pages are verified to be logged using cryptographic proofs. Since all pages are logged on a PLS and visually compared with existing pages through a comprehensive visual page-matching algorithm, it becomes impossible for an attacker to register a deceptive look-alike page on the PLS and receive the cryptographic proof required for client verification. All implementations occur on the client side, facilitated by the introduction of a new HTTP PT header, eliminating the need for platform-specific changes or the installation of third-party solutions for phishing prevention.