Incorrect-Credential Response Analysis for Phishing Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Phishing attacks, particularly those that deceive users into providing credentials and circumvent two-factor authentication, pose significant challenges for cyber security, as existing methods struggle to reliably detect such threats without relying on outdated blacklists or user diligence.
Innovation Solution
A system that opens a suspected site in two instances, a visual and a headless browser session, where it sends incorrect credentials to verify the site's behavior, detecting phishing by analyzing the response, such as redirection to a different domain or requests for two-factor authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional blacklist-based methods are used to detect phishing sites, then implementation complexity is reduced, but detection reliability deteriorates due to false positives and negatives
Solution Approach 1:
The system uses the phishing site's own behavior (its response to incorrect credentials) as the detection mechanism. The site essentially reveals its true nature through its automated response, eliminating the need for external blacklist databases or complex heuristic analysis rules.
Solution Approach 2:
The system creates a headless browser session that replicates the user's interaction with the suspected phishing site. By copying the user's login attempt with incorrect credentials in a separate browser instance, the system can analyze the site's response without affecting the actual user experience.
2Reliability
If user diligence and manual verification are required to avoid phishing, then detection accuracy improves, but user convenience and productivity worsen
Solution Approach 1:
The system introduces an intermediary layer between the user and the phishing site. The headless browser session acts as a mediator that performs the credential verification test, allowing the user to simply interact with the site normally while the system independently determines safety.
Solution Approach 2:
The system performs the credential verification test before allowing the user to actually use the site. By conducting the safety check in advance through the headless browser session, the system ensures protection is established before any potential harm can occur to the user.
3Measurement precision
If the system tests site behavior by sending incorrect credentials, then detection precision improves, but potential harmful factors increase due to active probing
Solution Approach 1:
The system uses a headless browser session to create a copy of the user's interaction. By replicating the login attempt in a separate, non-visual browser instance, the system can probe the site's behavior without actually exposing real user credentials or creating visible disruptions to the user experience.
Solution Approach 2:
The system uses disposable incorrect credentials generated specifically for the test. These fake credentials are discarded after the test completes, ensuring no real user information is compromised. The temporary nature of the headless browser session also limits the window for any potential harmful effects.
Data Source
AI summary
A computer system configured to determine safety of a suspected website is provided. The computer system includes a memory and at least one processor coupled to the memory. The at least one processor is configured to receive a request to visit the suspected website; send an incorrect password to the suspected website; receive a reply from the suspected website; and determine, based on the reply to the incorrect password, whether to execute a precautionary operation. The system may proceed with the request responsive to the reply including an error notification, as identified based on one or more of: a Document Object Model (DOM) tag; a re-appearance of a sign-in control; or an Application Programming Interface (API) call. Alternatively, the system may abandon the request responsive to the reply being affirmative, for example including a prompt or input field for a one-time password.