Phishing Detection via Login Behavior Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for preventing credential phishing, such as list-based, content-based, and image-based techniques, face challenges like inefficiency, noise interference, and the need for extensive database storage, making them ineffective in distinguishing legitimate from phishing websites.
Innovation Solution
A system that analyzes login behavior by checking if a website correctly identifies incorrect credentials, verifies the functionality of the 'Forgot Password' process, and compares the domains of the login and reset pages to determine if a site is phishing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If list-based techniques (whitelisting/blacklisting) are used to combat credential phishing, then the approach is efficient, but the quality is poor due to the uncountable number of websites
Solution Approach 1:
The patent changes the detection parameter from static website characteristics (URL, content) to dynamic login behavior parameters. The system monitors whether the website correctly identifies incorrect credentials and whether the reset link functionality works properly, transforming the detection approach from content-based to behavior-based parameters that can reliably distinguish phishing sites without requiring extensive databases
2Measurement precision
If content-based techniques (analyzing layout and content) are used, then they can identify phishing sites, but they fail when noise is added into the Web page
Solution Approach 1:
The patent extracts the essential functional behavior from the website content by focusing on the login validation mechanism. Instead of analyzing the entire webpage content including potential noise elements, the system isolates and tests the specific function of credential verification and reset link functionality, making the detection immune to noise in other parts of the page
3Measurement precision
If image-based techniques (analyzing favicon, OCR, computer vision) are used, then they can identify key elements, but they need to store raw information from authentic login pages in a database
Solution Approach 1:
The patent makes the website self-identify as phishing or legitimate through its own behavior. By submitting incorrect credentials and observing whether the website correctly identifies them as wrong, and by testing whether the reset link actually functions, the system lets the website's own responses reveal its true nature, eliminating the need for storing reference images or content in a database
Data Source
AI summary
A system is implemented in browser plug-in software or in endpoint agent software on a user computer. The user accesses a Web site and fills in a login request form and submits it to the Web site. The system triggers a “forgot password” feature and detects a phishing Web site by determining that it does not send a reset link to a valid user e-mail address, or, the system detects a phishing Web site by determining that it does send a reset link to an invalid e-mail address. Or, the system detects a phishing Web site by determining that it sends a reset link to a user e-mail address from a domain different from the domain of a login request form. Or, the system fills in an incorrect account name or password in a login request form and detects a phishing Web site by determining that the Web site does not indicate that the incorrect user name or incorrect password are incorrect. Or, the system submits incorrect credentials and detects a phishing Web site by determining that the Web site does not implement any way to reset the account name or password.