Dynamic URL Scanning Parameters for Phishing Kit Evasion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cybercriminals have developed mechanisms to evade URL scanning technologies by using phishing kits that detect and block security vendors' scanners, making it difficult for existing URL scanning technologies to effectively detect and block malicious URLs embedded in electronic messages.
Innovation Solution
The implementation of optimal scanning parameters, determined through analysis of electronic message features using decision trees and supervised learning algorithms, allows URL scanning services to scan suspicious URLs without triggering defensive actions by phishing kits, thereby enabling detection and blocking of malicious URLs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If URL scanning technologies use conventional scanning methods, then they can detect malicious URLs, but phishing kits detect and block these scanners
Solution Approach 1:
The patent applies parameter changes by dynamically adjusting scanning parameters such as User-Agent headers, IP addresses, and request timing based on the features of the electronic message. This allows the scanning service to adapt its behavior to avoid detection and blocking by phishing kits while maintaining effective malicious URL detection.
Solution Approach 2:
The system implements dynamics by making the scanning process adaptive and flexible. Scanning parameters are not fixed but are dynamically determined based on message features analyzed through machine learning models. This dynamic approach allows the scanner to change behavior in response to different phishing kit defenses.
2Speed
If URL scanning services send frequent scan requests, then detection speed improves, but phishing kits detect and block the scanner
Solution Approach 1:
The patent applies periodic action by introducing variable time intervals between scan requests. Instead of sending requests at fixed frequencies, the system uses machine learning to determine optimal timing that balances detection speed with avoiding detection. This periodic variation in request timing helps prevent phishing kits from identifying and blocking the scanner.
3Ease of operation
If URL scanning uses standardized parameters, then scanning process is simple, but phishing kits can easily identify and block the scanner
Solution Approach 1:
The patent applies local quality by customizing scanning parameters based on specific message characteristics rather than using uniform parameters for all scans. Different messages receive tailored scanning approaches determined by machine learning analysis of their features, making each scanning operation unique and harder to detect while maintaining operational simplicity through automated parameter selection.
Data Source
AI summary
A computer-implemented method may comprise collecting and storing a plurality of electronic messages and a corresponding plurality of phishing kits, each of which being associated with one or several malicious Uniform Resource Locator (URL) and extracting a set of features from each of the plurality of electronic messages. For each of the extracted set of features, the method may comprise determining a set of optimal scanning parameters using one or more decision trees, trained with a supervised learning algorithm based on programmatically or manually examining or reverse-engineering the source code of the phishing kits, or trained with a supervised learning algorithm based on a function that iteratively requests data from the websites pointed to by the malicious URLs and examines data and codes returned by such requests. These optimal scanning parameters may then be used to scan a malicious URL with a reduced likelihood that a defensive action will be taken to hide the existence of the malicious content pointed to by the malicious URL.