Phishing Website Detection Using Institution-Specific ML Classifiers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security products are ineffective in protecting users from sophisticated phishing attacks, particularly those targeting specific financial institutions, as they lack institution-specific features and often rely on broad, non-targeted approaches.
Innovation Solution
A machine learning-based classifier engine is developed to identify phishing websites by extracting institution-specific features from URL and HTML information, using a training dataset to generate a classifier engine that can predict phishing sites, and optionally utilizing blacklists and whitelists for immediate identification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If broad, non-targeted security approaches are used, then general phishing protection is provided, but effectiveness against sophisticated institution-specific attacks deteriorates
Solution Approach 1:
The patent applies local quality by making the classifier engine institution-specific. Instead of using a single general security approach for all users, the system creates specialized classifier engines tailored to each financial institution's characteristics, branding, and communication patterns. This allows the security system to adapt locally to institution-specific phishing attacks while maintaining overall system reliability through the specialized detection capabilities.
Solution Approach 2:
The patent segments the security system into multiple institution-specific classifier engines. Each classifier is trained on data specific to a particular financial institution, dividing the broad security problem into specialized sub-problems. This segmentation enables more effective detection of targeted phishing attacks while maintaining general protection through the ensemble of specialized classifiers.
2Measurement precision
If machine learning-based classification is used, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The patent applies preliminary action by pre-training institution-specific classifier engines before deployment. The classifiers are trained offline on historical phishing and legitimate website data specific to each financial institution, extracting salient features and establishing detection patterns in advance. This preliminary training reduces the complexity of real-time detection, as the pre-trained classifiers can quickly evaluate new websites without requiring complex real-time analysis.
Solution Approach 2:
The system applies self-service by automatically training and updating classifier engines using collected website data. The machine learning system autonomously extracts features, identifies patterns, and refines detection capabilities without requiring manual configuration or intervention. This self-service approach manages the complexity of maintaining high detection accuracy through automated model updates and adaptation.
Data Source
AI summary
Salient features are extracted from a training data set. The training data set includes, for each of a subset of known legitimate websites and a subset of known phishing websites, Uniform Resource Locators (URLs) and Hypertext Markup Language (HTML) information. The salient features are fed to a machine learning engine, a classifier engine to identify potential phishing websites is generated by applying the machine learning engine to the salient features, and parameters of the classifier engine are tuned. This enables identification of potential phishing websites by parsing a target website into URL information and HTML information, and identifying predetermined URL features and predetermined HTML features. A prediction as to whether the target website is a phishing website or a legitimate website, based on the predetermined URL features and the predetermined HTML features, is received from the classifier engine.