Phishing Detection via Hyperlink Relationship Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing phishing detection methods rely on prior knowledge of phishing websites, making them ineffective against newly set up phishing sites, and require users to be vigilant, which is not always feasible.
Innovation Solution
A computer-implemented method that analyzes hyperlink relationships and transaction destinations in webpages to determine if a website is engaging in phishing, using bi-directional and uni-directional linking analysis to identify potential phishing attempts and trigger anti-phishing measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If URL filtering is used to detect known phishing websites, then detection accuracy for established phishing sites is improved, but the system becomes ineffective against newly set up phishing sites with new IP addresses
Solution Approach 1:
The patent performs preliminary analysis of hyperlink relationships and transaction destinations before a phishing site becomes operational. By examining the linking structure and transaction flow in advance, the system establishes detection rules that remain effective even when the phishing site uses new IP addresses or domains, thus resolving the contradiction between detecting known sites and adapting to new threats
Solution Approach 2:
The system continuously monitors and analyzes hyperlink relationships and transaction destinations, using the collected data to update detection rules dynamically. This feedback mechanism allows the system to adapt to newly created phishing sites by learning from their structural patterns, maintaining detection accuracy without relying solely on pre-existing knowledge of specific phishing URLs
2Difficulty of detecting and measuring
If users are expected to be vigilant and check website domain names, then detection capability is improved for sophisticated users, but the solution becomes inadequate for the general user population
Solution Approach 1:
The patent introduces an intermediary detection system that automatically analyzes hyperlink relationships and transaction destinations between the user and the website. This intermediary layer performs the complex analysis that would be difficult for users to conduct manually, providing protection without requiring users to become experts in detecting phishing attempts
Solution Approach 2:
The system enables automatic detection and protection mechanisms that operate without user intervention. By analyzing the structural characteristics of phishing sites through hyperlink and transaction destination analysis, the system provides self-service protection that works for all users regardless of their technical knowledge or vigilance level
Data Source
AI summary
A computer-implemented method for detecting a phishing attempt by a given website is provided. The method includes receiving a webpage from the given website, which includes computer-readable code for the webpage. The method also includes ascertaining hyperlink references in the computer-readable code. Each hyperlink reference refers to at least a component of another webpage. The method further includes performing linking relationship analysis on at least a subset of websites identified to be referenced by the hyperlink references, which includes determining whether a first website is in a bi-directional/uni-directional linking relationship with the given website. The first website is one of the subset of websites. The method yet also includes, if the first website is in the bi-directional linking relationship, designating the given website a non-phishing website. The method yet further includes, if the first website is in the uni-directional linking relationship, performing anti-phishing measures with respect to the given website.