Fuzzy inclusion based impersonation detection

Abstract

Aspects of this disclosure include fuzzy inclusion based impersonation detection technology. In one embodiment, a reverse n-gram map is created for the list of protected entities. A suspicious string may be broken into n-grams, and each n-gram of the suspicious string is to be searched in the reverse n-gram map for corresponding protected entities. A fuzzy inclusion of a protected entity may be detected in the suspicious string depending on the protected entities found during the search. Subsequently, impersonation can be identified based on the characteristics of the fuzzy inclusion. In this way, a communication system can detect impersonation techniques by using visually similar text, and accordingly take various actions to help user mitigate risks caused by impersonation.

Description

Background technique [0001] Phishing is usually accomplished by forging emails or instant messages pretending to be trustworthy entities in electronic communications. Phishing attackers often trick users into replying to emails, opening attachments, or visiting bogus websites that are nearly identical to their legitimate counterparts. Phishing attackers continue to develop new techniques to bypass existing anti-phishing systems. [0002] Impersonation is a typical phishing technique. Email spoofing attacks attempt to impersonate a celebrity or well-known person, trademark, or trusted organization by forging headers or email addresses, creating misleading URLs, or using other methods to create something that appears to be from a legitimate source but is actually malicious email, etc. [0003] An advanced cloaking technique is to embed substrings that visually resemble legitimate entities into email headers or email bodies. Such abusive techniques can put the public at risk ...

AI Technical Summary

Problems solved by technology

Traditional anti-phishing systems may not detect this new cloaking technique because the substring does not match a legitimate entity via string comparison

Furthermore, given the exponential growth of electronic communications in our modern lives, anti-phishing scans are computationally expensive

Images