Client-Side Credential Baiting for Fast Phishing Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current phishing detection machine learning models are under stress to perform at high accuracy, face challenges in determining the cost of false positives versus false negatives, and are slow to adapt due to the imbalanced nature of legitimate versus phishing websites, making them ineffective in quickly identifying and blocking phishing attempts.
Innovation Solution
A client-side anti-phishing solution, known as 'Bait-n-Switch', intercepts login credentials and submits dummy credentials to unknown websites, allowing or blocking access based on acceptance, thereby reducing false positives and negatives without relying on complex ML models.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If machine learning models are used for phishing detection, then detection accuracy can be improved, but the system becomes slow to adapt to new phishing techniques due to extensive data collection and retraining time
Solution Approach 1:
The system performs preliminary actions by proactively submitting dummy credentials to websites before actual user login attempts. This early verification allows the system to identify phishing sites in advance, building a preemptive defense mechanism that doesn't require waiting for ML model retraining cycles.
Solution Approach 2:
The system employs self-service by using automated credential submission and automatic website classification without requiring external retraining data or manual intervention. The anti-phishing module independently verifies websites by submitting credentials and automatically updating its classification based on the responses received.
2Reliability
If high accuracy is demanded from phishing detection models, then both false positives and false negatives can be reduced, but the system becomes extremely difficult to balance between the two error types
Solution Approach 1:
The system introduces an intermediary verification mechanism using dummy credential submission as a mediator between the user and the website. This intermediary action provides clear binary feedback (acceptance or rejection of credentials) that simplifies the classification decision process, avoiding the complexity of balancing false positives and negatives in traditional ML approaches.
3Measurement precision
If traditional ML models are retrained frequently to catch new phishing techniques, then detection accuracy improves, but the time and computational resources required increase significantly
Solution Approach 1:
The system skips the lengthy ML retraining process by directly performing credential submission verification. Instead of rushing through data collection and model retraining cycles that take six months to a year, the system immediately tests websites by submitting dummy credentials, achieving rapid verification without the time-consuming ML pipeline.
Data Source
AI summary
A client-side anti-phishing solution provides an anti-phishing browser plug-in and an anti-phishing module on a user device for initiating an anti-phishing operation on the user device as a user enters a login credential on a web page originating from a website. The anti-phishing operation comprises generating a random number of phishing credentials based on the login credential, randomly selecting, from the random number of phishing credentials, a phishing credential, and causing a browser application on the user device to submit the phishing credential to the website on behalf of the user. Depending upon whether the phishing credential is accepted by the website, access to the website is blocked or allowed. Since the client-side anti-phishing solution does not need to rely on complex machine learning models to classify unknown websites, active phishing websites can be quickly and effectively blocked from procuring user credentials before submission.