Credential Spearphishing Detection via Email and Web Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection systems are ineffective in detecting spearphishing attacks, particularly credential spearphishing attacks, which use personalized emails and zero-day vulnerabilities to bypass filters and trick users into submitting sensitive information, often lacking characteristics typical of spam and exploiting human interaction.
Innovation Solution
A credential spearphishing detection system that captures and analyzes network traffic using static and dynamic analysis logic, including email, URL, and web page analysis, with virtual machine processing and expert system correlation to determine if a URL directs to a phishing site, and generates alerts for potential threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional spam filters are used to detect phishing attacks, then filtering of obvious spam is improved, but detection of personalized spearphishing attacks deteriorates because spearphishing emails lack typical spam characteristics
Solution Approach 1:
The detection system segments the analysis into multiple independent components: email header analysis, URL analysis, web page content analysis, and credential harvesting detection. Each component analyzes specific aspects separately and combines results to detect spearphishing attacks that lack traditional spam characteristics.
Solution Approach 2:
The system performs preliminary analysis of email headers, URLs, and web page content before the user interacts with the email. It proactively detects suspicious patterns, analyzes domain reputation, and identifies credential harvesting forms in advance, rather than waiting for traditional spam indicators.
2Object-affected harmful factors
If email filters block suspicious content, then protection against malicious emails is improved, but legitimate personalized emails are incorrectly blocked because spearphishing uses legitimate-looking content
Solution Approach 1:
The system introduces an intermediary analysis layer that examines URLs and web page content without blocking the original email. It acts as a mediator between the email filter and the user, providing additional verification through URL analysis and web page rendering in a controlled environment before allowing interaction.
Solution Approach 2:
The detection system combines multiple analysis methods into a composite detection approach: header analysis, URL reputation checking, web page content scanning, form validation, and credential harvesting detection. This composite approach provides robust protection while reducing false positives through multi-factor verification.
3Productivity
If static analysis alone is used to detect phishing URLs, then analysis speed is improved, but detection of dynamic credential harvesting sites deteriorates
Solution Approach 1:
The system performs preliminary static analysis of URLs and web page content to identify obvious phishing indicators quickly. For URLs that pass initial screening or show suspicious patterns, it then triggers dynamic analysis by rendering the web page in a controlled environment to detect credential harvesting forms and malicious behavior.
Solution Approach 2:
The system dynamically adjusts the analysis depth based on initial findings. It starts with fast static analysis and automatically transitions to more resource-intensive dynamic analysis when needed, allowing it to maintain high speed for benign emails while thoroughly investigating suspicious ones.
4Reliability
If comprehensive multi-stage analysis is performed on all emails, then detection accuracy is improved, but system resource consumption increases
Solution Approach 1:
The system applies partial analysis to all emails (header and basic URL checks) and excessive/detailed analysis only to suspicious emails. It performs comprehensive multi-stage analysis including web page rendering and form detection only when initial indicators suggest potential spearphishing, avoiding resource-intensive analysis on clearly benign emails.
Solution Approach 2:
The system applies different levels of analysis quality to different parts of the email processing workflow. Routine emails receive basic filtering, while emails showing suspicious patterns trigger enhanced local analysis of specific components like URLs, attachments, and web page content, optimizing resource allocation based on local risk assessment.
Data Source
AI summary
A non-transitory computer readable storage medium having stored thereon instructions when executable by a processor perform operations including responsive to receiving an email including a URL, conducting an analysis of the email including: (i) analyzing a header and a body, and (ii) analyzing the URL; analyzing contents of a web page directed to by the URL; generating a score indicating a level of confidence the email is associated with a phishing attack based on at least one of the analysis of the email or the analysis of the contents of the web page; and responsive to the score being below a threshold, virtually processing the web page to determine whether the web page is associated with the phishing attack is shown.