Phishing Detection via Automated Credential Submission

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current phishing detection methods lack the capability to detect zero-day phishing attacks and do not effectively interact with unknown web pages to analyze their behavior, leading to missed detections and potential exposure of user data.

Innovation Solution

A fully automated method that identifies phishing websites by analyzing deceptive content such as logos, URL paths, and HTML text, and submits fake credentials to determine if the website redirects to a legitimate domain, allowing for real-time behavior analysis and detection of zero-day phishing.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If blacklisting and whitelisting approaches are used to detect phishing sites, then detection of known phishing sites is improved, but zero-day phishing detection capability is lost

Engineering Contradiction:

Improvephishing detection accuracyVSAvoidzero-day phishing detection capability

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system performs preliminary actions by automatically submitting dummy user credentials to phishing websites before actual users interact with them. This proactive approach allows the system to observe and analyze the websites' responses and behaviors in advance, enabling detection of zero-day phishing attacks without relying on pre-existing blacklists or whitelists.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system employs self-service mechanisms where automated bots independently interact with suspicious websites, submit test credentials, and analyze responses without human intervention. This autonomous operation enables continuous monitoring and detection of phishing sites, including newly created ones, maintaining both reliability and adaptability.

Inventive Principle:

Principle #25Self-service

2Device complexity

If heuristic techniques with static features are used for phishing detection, then implementation simplicity is maintained, but interaction with unknown pages and behavior analysis capability are lost

Engineering Contradiction:

Improvedetection system complexityVSAvoidphishing page behavior analysis capability

Core Design Contradiction:

Device complexityVSDifficulty of detecting and measuring

Solution Approach 1:

The system replaces static, mechanical analysis of webpage features with dynamic interaction mechanisms. Instead of merely examining HTML structure, URLs, and visual elements, the system automatically submits credentials and observes runtime behaviors such as credential validation responses, redirects, and data handling, thereby detecting phishing sites that mimic legitimate ones perfectly in static analysis.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS11496510B1Fully automated target identification of a phishing web site

Publication Date: 2022.11.08 NURD LLC

AI summary

The current invention is a method of fully automated target identification of a phishing website if a website requests input data from user with deceptive contents (logo, URL path, text in html) and a randomized/wrong data is provided and the website is redirecting to a different domain related with the logo, URL path or text in html. By determining existence of relationships, the website is detected as phishing and the phishing target is automatically identified.