Metadata-Based Phishing Detection for Credential Exfiltration Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Phishing attacks, particularly impersonation attacks, are challenging to detect in cloud-based environments due to the use of legitimate-looking links and the lack of effective protection mechanisms, leading to credential theft and data exfiltration.
Innovation Solution
A network security system utilizing metadata and machine learning algorithms, such as convolutional neural networks, to analyze webpage images and traffic data, identifies sanctioned and unsanctioned resources, and blocks the transmission of confidential information to prevent phishing attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security measures are used to detect phishing attacks, then false positives increase and legitimate traffic is blocked, but phishing detection accuracy remains low
Solution Approach 1:
The patent changes the detection parameters from traditional URL-based analysis to metadata-based analysis including HTTP headers, response codes, and webpage structure characteristics. This parameter transformation enables more accurate phishing detection while reducing false positives, as metadata provides richer contextual information about the authenticity of web resources.
Solution Approach 2:
The patent replaces traditional mechanical security filtering mechanisms with machine learning models that analyze metadata patterns. The machine learning system substitutes rule-based filtering with intelligent pattern recognition, improving detection accuracy while adapting to evolving phishing techniques without increasing false positives.
2Reliability
If comprehensive security analysis is performed on all web traffic, then security detection capability improves, but system processing time increases
Solution Approach 1:
The patent extracts only the most critical metadata elements (HTTP headers, response codes, key webpage structure) for analysis rather than examining complete webpage content. This selective extraction maintains high security detection capability while significantly reducing processing time by focusing computational resources on the most discriminative features.
Solution Approach 2:
The patent performs partial analysis by examining a subset of metadata fields that provide the highest discriminatory power for phishing detection. Rather than analyzing all possible webpage attributes, the system focuses on key metadata elements that sufficiently identify phishing attempts, achieving effective security with reduced processing overhead.
3Reliability
If metadata-based analysis is used to identify sanctioned resources, then phishing detection accuracy improves, but system complexity increases
Solution Approach 1:
The patent creates a universal metadata analysis framework that handles multiple phishing detection tasks through a single system architecture. The same metadata extraction and analysis mechanisms work across different phishing scenarios (credential theft, malware distribution, impersonation), reducing overall system complexity despite the sophisticated detection capabilities.
Data Source
AI summary
The technology disclosed intercepts a webpage rendered by a server in response to a user action executed on a client. The technology disclosed analyzes one or more images of the webpage and determines that a particular hosted service is represented by the images. It analyzes one or more fields of the webpage and determines that the fields elicit confidential information. The technology disclosed intercepts a request generated by the client in response to another user action providing the confidential information via the fields. The technology disclosed analyses the request and determines that the confidential information is being exfiltrated to an unsanctioned resource. This determination is made by comparing a resource address in the request with one or more sanctioned resource addresses used by the particular hosted service. The technology disclosed determines that the webpage is effectuating a phishing attack and blocks transmission of the confidential information to the unsanctioned resource.