Phishing Domain Detection via Certificate Transparency Logs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current phishing detection methods rely on blacklists that are often too late in identifying malicious domains, and existing systems struggle with inconsistent intelligence and detection latency, failing to effectively mark new or recurring phishing domains before they cause harm.
Innovation Solution
A system that utilizes Certificate Transparency (CT) log data, combined with passive DNS (pDNS) and domain-based lexical features, to identify phishing domains by continuously monitoring and analyzing CT logs for time-based, issuer-based, validation, and lexical features, enabling early detection of both new and long-term phishing domains.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If blacklists are used for phishing detection, then detection coverage is achieved, but detection latency increases causing domains to be added too late
Solution Approach 1:
The system performs preliminary detection by monitoring Certificate Transparency logs as soon as certificates are issued, before the phishing domains are deployed and cause harm. This allows early identification of malicious domains at the certificate issuance stage, preventing the timing problem where blacklists only add domains after they have already affected victims.
2Measurement precision
If multiple intelligence sources are aggregated, then detection accuracy improves, but system complexity increases
Solution Approach 1:
The system merges multiple data sources including Certificate Transparency logs, passive DNS data, and lexical analysis into a unified detection framework. By integrating these diverse intelligence sources through a centralized machine learning model, the system achieves improved detection accuracy while managing complexity through unified processing rather than separate analysis pipelines.
Solution Approach 2:
The machine learning classifier serves multiple functions: it analyzes CT log data, processes passive DNS information, performs lexical feature analysis, and generates detection decisions. This multi-functional approach consolidates what would otherwise require separate systems, reducing overall complexity while maintaining comprehensive detection capabilities.
3Loss of time
If CT logs are monitored continuously, then detection timeliness improves, but data processing load increases
Solution Approach 1:
The system implements partial monitoring by focusing specifically on Certificate Transparency log data rather than analyzing all possible network traffic or DNS queries. This selective approach to continuous monitoring achieves timely detection of phishing domains through targeted analysis of certificate issuance events, reducing the overall data processing load compared to comprehensive network-wide monitoring.
Data Source
AI summary
The main objective of Certificate Transparency (CT) is to detect mis-issued certificates or rouge certificate authorities. It has been observed that phishing sites have been increasingly acquiring certificates to look more legitimate and reach more victims, thus providing an opportunity to predict phishing domains early. The present disclosure provides systems and methods for early detection of phishing and benign domain traces in CT logs. The provided system may predict phishing domains early even before content is available via time-, issuer-, and certificate-based characteristics that are used to identify sets of CT-based inexpensive and novel features. The CT-features are augmented with other features including passive DNS (pDNS) and domain-based lexical features.