Edge Service Phishing Detection via Web Page Comparison

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Phishing attacks pose significant damage to individuals and businesses by masquerading as trustworthy entities, making it difficult for existing technologies to effectively detect and mitigate such threats, particularly through spoofed emails with links leading to malicious websites that resemble legitimate sign-in pages.

Innovation Solution

An edge service is implemented to examine incoming emails for web links, retrieve and compare the linked web pages to protected pages, and take mitigation steps if a phishing attack is detected, such as blocking the email or providing tracking credentials to monitor potential login attempts.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If phishing detection technology is implemented to examine emails and compare web pages, then detection accuracy improves, but computing resources and system performance deteriorate

Engineering Contradiction:
Improvephishing detection accuracyVSAvoidcomputing resource consumption
Core Design Contradiction:
Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The system pre-loads protected web pages into memory before they are needed for comparison. This preliminary action stores legitimate web page content in advance, so when an email with a link is detected, the comparison can be performed quickly using pre-cached data rather than fetching and analyzing pages in real-time, thus reducing the computational burden during actual phishing detection operations

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The system focuses computational resources on examining only specific critical elements of web pages rather than analyzing entire pages. By concentrating analysis on key distinguishing features and elements that indicate phishing, the system achieves high detection accuracy while minimizing overall computing resource consumption

Inventive Principle:
Principle #3Local quality

2Reliability

If comprehensive phishing detection is performed on all incoming emails, then security reliability improves, but processing time and productivity worsen

Engineering Contradiction:
Improvesecurity reliabilityVSAvoidemail processing throughput
Core Design Contradiction:
ReliabilityVSProductivity

Solution Approach 1:

The system applies phishing detection selectively rather than uniformly to all emails. It focuses intensive analysis on emails that contain suspicious elements such as external links or emails from untrusted senders, while applying lighter or no analysis to clearly safe emails. This partial action approach maintains high security reliability for risky emails while preserving overall email processing throughput

Inventive Principle:
Principle #16Partial or excessive action

Solution Approach 2:

The system performs preliminary filtering to identify emails that require full phishing detection analysis. By pre-screening emails for suspicious characteristics and only subjecting potentially malicious emails to comprehensive web page comparison, the system maintains both high security reliability and efficient processing throughput

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP3417590B1Phishing attack detection and mitigation
Publication Date: 2020.03.25 MICROSOFT TECHNOLOGY LICENSING LLC
  • EP3417590B1 patent drawingFigure 1
  • EP3417590B1 patent drawingFigure 2
  • EP3417590B1 patent drawingFigure 3

AI summary

An edge service is disclosed herein that performs an anti-phishing attack function, to detect and mitigate against phishing attacks. In an implementation, the edge service examines incoming emails for any that include links to web pages. When such an email is encountered, the edge service opens the suspect web page and compares it to at least one protected page. When warranted by the result(s) of the comparison, the edge service takes steps to mitigate the phishing attack, such as by not delivering the email to a recipient.