Phishing Detection via Malicious Budget Code Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting phishing attacks, such as IP reputation, email authentication, and content-based identification, are ineffective due to the difficulty in maintaining blacklists, the similarity of phishing and legitimate content, and the reuse of compromised legitimate websites by cybercriminals, leading to laborious URL collection and missed attacks.
Innovation Solution
The system identifies and blocks malicious URLs by detecting known malicious budget codes and compromised websites through a watch list generated by analyzing network traffic, which includes a URL analyzer to automatically identify and distribute malicious budget codes and compromised domains to endpoint computers for real-time phishing detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IP reputation and DNS-based blacklist are used to block phishing attacks, then some phishing attacks can be blocked, but the black hole list becomes very difficult to maintain due to the sheer number of malicious servers
Solution Approach 1:
The patent extracts the essential identifying feature (budget code) from the complex malicious URL structure. Instead of tracking entire URLs or IP addresses, the system isolates and monitors only the budget code parameter, which is the core identifier used by phishing campaigns to track referral sources and manage budgets. This extraction simplifies the blacklist maintenance task significantly.
Solution Approach 2:
The system performs preliminary analysis by proactively identifying and adding budget codes to the watch list before phishing attacks occur. By continuously monitoring and pre-adding suspicious budget codes to the watch list, the system prepares defensive measures in advance, enabling immediate blocking when phishing URLs containing these budget codes are encountered.
2Reliability
If legitimate servers are blocked to prevent phishing attacks, then phishing protection is improved, but legitimate emails are also blocked because the servers are compromised
Solution Approach 1:
The patent extracts and monitors only the budget code parameter from URLs, rather than blocking entire domain names or IP addresses. This selective extraction allows the system to identify phishing attempts based on the presence of known malicious budget codes while permitting traffic to legitimate servers that do not contain these specific budget codes, thus avoiding false positives.
Solution Approach 2:
The system applies different treatment to different parts of the URL structure. Instead of blocking entire domains or IP addresses, it specifically targets and blocks only the budget code parameter when it matches known malicious values. This localized approach to quality control allows legitimate server traffic to pass through while blocking phishing attempts.
3Reliability
If URL collection is performed manually to identify phishing webpages, then phishing URLs can be added to block lists, but the process is laborious and by the time URLs are verified new phishing attacks have already begun
Solution Approach 1:
The system continuously monitors and proactively identifies suspicious budget codes, automatically adding them to the watch list before phishing attacks occur. This preliminary action eliminates the need for manual verification and ensures that defensive measures are in place before new phishing campaigns launch, addressing the time delay problem.
Solution Approach 2:
The system performs automatic identification and classification of budget codes without requiring manual intervention. The automated process continuously analyzes URLs, extracts budget codes, determines their malicious nature, and updates the watch list independently, eliminating the laborious manual verification process and reducing response time.
4Adaptability or versatility
If cybercriminals use hundreds of webpages on compromised legitimate websites, then phishing attacks become more difficult to detect, but individual webpage verification becomes extremely laborious
Solution Approach 1:
The patent extracts and monitors only the budget code parameter from URLs, which serves as a universal identifier across all phishing webpages regardless of which compromised legitimate website they are hosted on. This extraction approach allows the system to detect phishing attempts across hundreds of different webpages by simply checking for the presence of known malicious budget codes, avoiding the need to verify each individual webpage.
Solution Approach 2:
The budget code-based detection mechanism serves as a universal identifier that works across all phishing campaigns and compromised websites. A single budget code can identify multiple phishing webpages hosted on different domains, making the detection system universally applicable and eliminating the need for separate verification processes for each webpage or domain.
Data Source
AI summary
Uniform resource locators (URLs) that include strings matching known malicious budget codes are deemed to be malicious URLs. Compromised websites and compromised IP addresses are identified from the malicious URLs. URLs obtained from network traffic to compromised domain names or compromised IP addresses are inspected to identify candidate budget codes. Candidate budget codes that are confirmed to be malicious budget codes are included in a watch list, which may be distributed to endpoint computers to detect phishing attacks.