Phishing Domain Detection via Feature Comparison and Registrar Query
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current phishing detection technologies are not reliable or efficient in identifying and preventing communications from phishing domains, which are increasingly used in fraudulent activities.
Innovation Solution
A system and method that uses machine learning algorithms to extract features from communications, compares them with a training dataset, and proactively identifies potential phishing domains by querying domain name registrars, while implementing firewall configurations or domain registration to block or reroute suspicious communications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If machine learning algorithms are used to extract and compare features from communications, then phishing domain detection accuracy is improved, but system complexity increases
Solution Approach 1:
The system segments the phishing detection process into distinct modules: feature extraction module that extracts communication features, comparison module that compares features against training data, and decision module that determines phishing status. This segmentation improves detection accuracy while managing system complexity through modular design.
Solution Approach 2:
The patent introduces intermediary components including a feature vector representation that mediates between raw communication data and the comparison process, and a training dataset that serves as an intermediary reference for evaluating new communications. These intermediaries enhance detection reliability without proportionally increasing overall system complexity.
2Reliability
If the system proactively queries domain name registrars to detect potential phishing domains, then detection capability is improved, but loss of time increases
Solution Approach 1:
The system performs preliminary actions by proactively querying domain name registrars to detect potential phishing domains before they are actively used for attacks. It extracts features from these domains and compares them against the training dataset in advance, enabling early detection and prevention while managing time loss through efficient preprocessing.
Solution Approach 2:
The system dynamically adjusts its detection approach by querying domain registrars based on risk indicators and communication patterns. It adapts the depth and scope of proactive queries based on the specificity of domain patterns matched, optimizing the balance between detection capability and time consumption.
3Object-affected harmful factors
If firewall configurations are implemented to block phishing communications, then security protection is improved, but ease of operation decreases
Solution Approach 1:
The system implements self-service functionality by automatically generating and applying firewall configurations based on detected phishing domains. The firewall module is configured programmatically using the detected domain information, eliminating manual intervention and maintaining operational simplicity while enhancing security protection.
4Measurement precision
If multiple features are extracted and compared from communications, then detection precision is improved, but device complexity increases
Solution Approach 1:
The system segments feature extraction into multiple independent feature types (domain name features, communication content features, metadata features), each processed separately and then combined for comprehensive comparison. This segmentation improves detection precision by capturing multiple dimensions of phishing indicators while managing complexity through modular feature processing.
Solution Approach 2:
The feature comparison mechanism is designed as a universal system that handles multiple feature types through a common comparison framework. The same comparison logic is applied across different feature categories, reducing the need for separate processing pathways and managing complexity while maintaining high detection precision.
Data Source
AI summary
A system for phishing domain detection receives a communication associated with a particular domain. The system extracts a first set of features from the communication, the first set of features including a name of the sender, a name of the domain, a time of receipt, a sentiment message, and attachment file associated with the communication. The system compares the first set of features with a second set of features associated with a historical communication labeled with a phishing domain. In response to determining that the first set of features corresponds to the second set of features, the system determines that the particular domain is the phishing domain.