Domain Profiling System for Phishing Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Phishing attacks, particularly those utilizing enterprise style failover and redundancy techniques, pose a challenge due to their sophisticated nature and frequent use of throw-away domain names, making it difficult for existing anti-phishing solutions to reliably detect fraudulent domains.
Innovation Solution
A domain profiling system that monitors outbound communications, profiles domains by testing for properties associated with legitimate and fraudulent domains, calculates a trustworthiness score, and compares it to a threshold to determine legitimacy, enabling the detection and potential blocking or warning of fraudulent domains.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional anti-phishing solutions are used to detect fraudulent websites, then basic phishing attempts can be identified, but sophisticated phishing attacks using enterprise style failover and redundancy techniques cannot be reliably detected
Solution Approach 1:
The patent segments the domain detection process into multiple independent profiling components: DNS profile analysis, SSL certificate verification, domain age assessment, and reputation scoring. Each component evaluates specific aspects of domain legitimacy separately, allowing the system to comprehensively assess sophisticated phishing attacks that may pass individual checks but fail the aggregate evaluation.
Solution Approach 2:
The patent changes multiple parameters simultaneously to detect phishing: domain registration date, DNS record patterns, SSL certificate validity, hosting infrastructure characteristics, and traffic behavior metrics. By monitoring changes across these parameters rather than relying on a single indicator, the system can identify sophisticated phishing attacks that attempt to mimic legitimate domains.
2Object-generated harmful factors
If throw-away domain names are used by phishing groups, then the ability to detect attacks is reduced, but the cost of maintaining fraudulent infrastructure increases
Solution Approach 1:
The patent performs preliminary profiling and validation of domains before they can be used for phishing attacks. By pre-establishing baseline profiles for legitimate domains and pre-identifying suspicious patterns, the system detects fraudulent throw-away domains quickly, preventing their effective use even though phishing groups may register numerous domains.
Solution Approach 2:
The patent implements feedback mechanisms where detected phishing patterns from throw-away domains are fed back into the profiling system to update detection rules. This continuous learning process improves the system's ability to recognize new throw-away domain patterns, making detection more effective as phishing groups attempt to use increasingly numerous disposable domains.
Data Source
AI summary
Outbound communication from a computer is monitored, and requests to access remote links are identified. This process identifies attempts by users to access links provided by third parties in emails and such, as well other attempts by users to access remote domains. Domains in the identified requests are profiled, by testing them for properties associated with known legitimate domains, and for properties associated with known fraudulent domains. A trustworthiness score for a domain is calculated based on the results of the profiling. The trustworthiness score is compared to a predetermined threshold, and from the results it is determined whether or not the domain is legitimate. If the domain is fraudulent, appropriate action is taken, such as blocking the attempt to access the domain.