Phishing Detection via Fake Data Submission
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current phishing detection methods rely heavily on blacklists and struggle to identify and prevent information theft from fake web pages, as they cannot easily distinguish between legitimate and phishing sites, especially when Secure Sockets Layer (SSL) protocol is used.
Innovation Solution
A method and system that receive information input from a web page, determine if it's a phishing page, and if so, transmit fake information to the address, allowing identification of malicious addresses by verifying the received information, which can then be shared to prevent further web server infringement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If black lists are used to identify phishing pages, then some phishing pages can be detected, but information stolen by phishing pages can still be masqueraded through other pages
Solution Approach 1:
The system performs preliminary actions by automatically submitting fake information to detected phishing pages before actual users can be compromised. This proactive approach captures malicious addresses in advance, preventing information theft before it occurs. The fake information submission is a preliminary defensive action that identifies and neutralizes phishing threats ahead of time.
Solution Approach 2:
The system implements feedback by using the results from fake information submission to identify malicious addresses, then sharing this information back to prevent future attacks. The captured malicious address data is fed back into the system to improve detection capabilities and protect other web servers, creating a continuous improvement loop that enhances both detection accuracy and information protection reliability.
2Reliability
If SSL protocol is used for authorization, then secure communication is established, but it becomes hard to identify if web pages are fake
Solution Approach 1:
The system introduces an intermediary mechanism that operates independently of SSL protocol validation. Instead of relying solely on SSL certificates, the system uses a separate verification approach by submitting fake information and analyzing the responses. This intermediary detection method bypasses the limitation of SSL-based identification and provides an additional layer of phishing detection that works regardless of SSL implementation.
Solution Approach 2:
The detection process is segmented into distinct phases: SSL validation for basic security, followed by active probing with fake information submission, and finally analysis of responses to identify malicious addresses. This segmentation allows the system to maintain SSL security while adding complementary detection mechanisms that address the identification difficulty without compromising communication security.
3Measurement precision
If fake information is transmitted to phishing web pages, then malicious addresses can be identified, but this requires active intervention beyond passive detection
Solution Approach 1:
The system performs self-service by automatically executing the fake information submission process without requiring manual intervention. The web server autonomously detects phishing pages, submits fake information, analyzes responses, and identifies malicious addresses. This automation reduces operational complexity despite the enhanced detection capabilities, as the system serves itself through automated workflows.
Solution Approach 2:
The system performs preliminary actions by pre-configuring fake information templates and automated submission protocols before phishing detection is needed. These preliminary preparations streamline the detection process, reducing the complexity of active intervention by having ready-to-use detection mechanisms in place before they are activated.
Data Source
AI summary
A phishing processing method includes: an information input web page comprising an information input interface, through which information is transmitted to an information receiving address, is received. Determine if the information input web page is a phishing web page. If it is determined that the information input web page is the phishing web page, fake input information is transmitted to the information receiving address. When information for verification is received from an information transmitting address, if the received information for verification is the fake input information is determined. If the received information for verification is the fake input information, it is determined that the information transmitting address is a malicious address.