Phishing Detection via DNS and Title Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing phishing detection methods face challenges such as time lag in blacklist updates, inability to detect new phishing targets, and the need for prior knowledge of target web pages, making them ineffective against emerging phishing attacks.
Innovation Solution
A multi-scale phishing detection method that analyzes the domain name, PageRank, Alexa ranking, and title of a web page, using search engines to identify phishing websites without relying on sample data or target information, by matching title character strings with phishing sensitive words and verifying domain name servers and IP addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If blacklist detection technique is used to detect phishing websites, then detection reliability is improved for known phishing sites, but detection speed deteriorates due to time lag in blacklist updates
Solution Approach 1:
The patent performs preliminary actions by pre-establishing the relationship between domain names and their authoritative name servers before phishing detection is needed. When a phishing site is queried, the system can immediately compare the actual name server against the pre-stored authoritative name server, enabling rapid detection without waiting for blacklist updates.
2Measurement precision
If web-page-content based detection is used to analyze similarity between target web page and phishing web page, then detection precision is improved, but device complexity deteriorates due to need to collect and store大量target website content
Solution Approach 1:
The patent extracts only the essential and minimal information needed for detection - specifically domain names and their authoritative name server relationships - from the complex web page content analysis process. This extraction approach maintains detection precision by focusing on the critical identifier (name server) while dramatically reducing system complexity and data storage requirements.
Solution Approach 2:
Instead of copying and storing large amounts of web page content from target websites, the patent copies only the essential name server information from public DNS records. This creates a lightweight reference database that enables accurate phishing detection without the burden of storing and processing extensive web content.
3Ease of operation
If URL based detection is used to analyze URL structure and registration information, then ease of operation is improved as preliminary detection, but detection reliability deteriorates because it cannot detect new phishing targets without prior URL collection
Solution Approach 1:
The patent creates a universal detection mechanism that works for both known and new phishing targets by using DNS name server verification. Unlike URL-based detection that requires pre-collected URLs, this method can detect any phishing site as long as it impersonates an existing domain, making the system universally applicable without needing prior knowledge of specific phishing URLs.
Data Source
AI summary
A method for detecting a phishing website includes extracting a domain name from a target URL of a web page under investigation, and querying PageRank and/or Alexa ranking of the domain name; extracting a title character string from the title of the web page and matching the character string to phishing sensitive words; using the title of web page as a keyword to search on a search engine; querying whether Target URL and the web page in the search result with a same title as the web page under investigation have the same domain name server NS and server IP address to determine whether the website is a phishing website. The disclosed method utilizes common features of phishing websites and public resources on the Internet, and overcomes the difficulty in collecting phishing website samples, and is well adapted to detecting phishing aimed at new target websites.