Phishing Campaign Detection Through Pattern-Based Email Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing phishing detection solutions fail to identify phishing emails effectively, especially in phishing campaigns where attackers introduce variations in sender addresses, recipient addresses, and subject lines to evade detection, leading to missed detections and compromised security.
Innovation Solution
A method that clusters emails based on a pattern comprising a constant and variable component, analyzing data fields such as sender address, recipient address, attachment names, subject lines, and URLs, and evaluates the number of unique features to identify phishing campaigns using harmonic mean and anomaly scoring.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing solutions analyze each email separately using content analysis (antivirus scanning, domain reputation, URL analysis), then the detection process is simple and fast, but phishing emails are missed because attackers add variations to bypass controls
Solution Approach 1:
The patent merges multiple emails into clusters based on pattern matching of constant components (e.g., similar subject lines, attachment names, URLs). By combining emails that share common patterns, the system achieves collective detection that improves reliability while maintaining manageable complexity through automated clustering algorithms.
Solution Approach 2:
The patent transitions from single-email analysis to multi-dimensional cluster analysis. Instead of evaluating one email in isolation, the system analyzes groups of emails across multiple dimensions (subject line patterns, attachment patterns, URL patterns, sender/recipient patterns) to detect phishing campaigns, thereby improving detection accuracy through dimensional expansion.
2Adaptability or versatility
If attackers add variation across files, filenames, and sender addresses to bypass phishing controls, then the phishing campaign can reach more targets, but existing per-email detection solutions fail to identify the coordinated nature of these attacks
Solution Approach 1:
The patent performs preliminary pattern identification and clustering before final detection. By pre-processing emails to identify constant components and group them into clusters, the system prepares the data structure needed for accurate phishing detection, enabling it to recognize coordinated attacks even when individual emails show variations.
Solution Approach 2:
The patent uses pattern copying to identify phishing campaigns. By extracting constant components (patterns) from multiple emails and using these as templates for cluster identification, the system can recognize that varied emails belong to the same phishing campaign, thereby maintaining detection precision despite attacker adaptations.
3Ease of manufacture
If existing solutions rely heavily on past knowledge of phishing attacks and known malware domains, then the detection process is straightforward, but novel phishing attacks are not identified
Solution Approach 1:
The patent implements a dynamic detection approach that adapts to new phishing patterns. Instead of relying solely on static knowledge bases of known phishing domains and malware, the system dynamically identifies patterns in incoming email clusters and adjusts detection criteria accordingly, enabling reliable detection of novel attacks while maintaining operational simplicity.
Data Source
AI summary
Methods, systems, and techniques for detecting phishing campaigns are disclosed, comprising: determining a pattern in a dataset of inbound emails, the pattern comprising a constant component and a variable component; determining a cluster of emails that share the pattern among the inbound emails; determining a number of unique features for a plurality of data fields among the cluster of emails; and determining whether the cluster of emails belong to a phishing campaign based on an evaluation of the number of unique features.