Phishing Detection via FQDN Feature Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing phishing detection solutions rely on lists of known malicious websites, which are ephemeral and often fail to protect against new, short-lived phishing threats due to the time lag between website creation and listing, leaving mobile devices particularly vulnerable.
Innovation Solution
A statistical model using machine learning algorithms classifies network resources as malicious or non-malicious based on features extracted from network resource identifiers, such as FQDNs, allowing for immediate detection of new phishing threats without relying on pre-existing lists, and can be implemented for real-time analysis or batch processing of identifiers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If lists of known phishing websites are used for detection, then protection against known threats is provided, but new ephemeral phishing websites remain undetected during the exposure period
Solution Approach 1:
The system performs preliminary classification of network resources using a statistical model trained on phishing characteristics before users access them. By pre-analyzing and categorizing resources as phishing or non-phishing, the system eliminates the exposure period inherent in list-based approaches, as new phishing sites are detected immediately upon appearance without waiting for list updates.
Solution Approach 2:
The patent replaces the mechanical list-maintenance system (manual discovery, addition, and distribution of phishing URLs) with an automated statistical classification system. This substitution enables real-time detection of new phishing threats through automated analysis of network resource characteristics, eliminating the time lag inherent in manual list updating processes.
2Productivity
If manual list maintenance and distribution is used, then known phishing sites are blocked, but there is significant delay in protecting against new threats
Solution Approach 1:
The statistical classification system is self-updating and automatically adapts to new phishing threats without requiring manual intervention for list maintenance. The system continuously classifies new network resources independently, eliminating the delays associated with manual list creation, verification, and distribution while maintaining comprehensive detection coverage.
Solution Approach 2:
The system dynamically adjusts its classification parameters and statistical models based on evolving phishing patterns. By changing the parameters used to analyze network resource characteristics, the system rapidly adapts to new threat types and deployment methods, maintaining both high productivity in threat response and comprehensive reliability in detection coverage.
3Loss of time
If statistical model classification is used, then immediate detection of new phishing threats is achieved, but the system complexity increases
Solution Approach 1:
The patent extracts and utilizes specific, easily measurable characteristics of network resources (such as URL patterns, domain features, and resource metadata) for classification. By focusing on a targeted set of extractable features rather than analyzing entire network resources, the system achieves immediate detection of new phishing threats while keeping the computational complexity manageable through selective feature extraction.
Data Source
AI summary
A computer implemented method of detecting a phishing threat using a pre-defined statistical model to determine whether a network resource is a potential phishing threat based on features extracted from a network resource identifier for the network resource. The method includes: receiving a request to access a network resource; determining, from the request, a network resource identifier for the requested network resource; extracting one or more features from the network resource identifier; applying the pre-defined statistical model to the extracted features; and classifying the network resource as a phishing threat if the output of the statistical model, when applied to the extracted features, determines that the network resource is a potential phishing threat.