Phishing Detection via Fuzzy Hash Code Segment Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cybersecurity systems face challenges in accurately identifying phishing websites, particularly due to increased inconclusiveness from whitelist/blacklist analyses and time constraints in computer vision-based techniques, leading to issues with false negatives and false positives.
Innovation Solution
A phishing detection system that analyzes code segments associated with suspect web pages by retrieving and parsing display code, recovering additional code segments via links, performing analytics, and generating fuzzy hash comparisons to determine correlation with known phishing web pages, while adjusting correlation thresholds based on threat landscapes to minimize false positives and negatives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If whitelist/blacklist analyses are used to identify phishing websites, then the system can provide quick initial filtering, but the analysis becomes inconclusive and produces false negatives and false positives
Solution Approach 1:
The patent segments the phishing detection process into multiple independent analysis components: whitelist/blacklist filtering, computer vision analysis of display elements, and domain evaluation. Each segment operates independently and contributes to the overall detection decision, allowing the system to maintain speed while improving accuracy through cumulative evidence from multiple segments.
Solution Approach 2:
The patent merges multiple detection methodologies (whitelist/blacklist, computer vision, domain analysis) into a unified detection system that combines their results. This integration allows the system to leverage the speed of whitelist/blacklist filtering while compensating for its inaccuracies through additional analysis layers, thereby resolving the contradiction between productivity and precision.
2Measurement precision
If computer vision-based techniques are used to analyze display elements of web pages, then the system can identify visual similarities to legitimate pages, but time constraints limit the number of elements that can be analyzed, reducing thoroughness
Solution Approach 1:
The patent extracts and prioritizes specific display elements for analysis based on their phishing relevance. Instead of analyzing all elements uniformly, the system identifies and focuses on critical elements such as input fields, buttons, and layout structures that are most indicative of phishing attempts. This selective extraction maintains detection accuracy while reducing the time required for analysis.
Solution Approach 2:
The patent implements partial analysis by examining only the most critical display elements rather than performing exhaustive analysis of all page components. This partial action approach provides sufficient detection accuracy for security purposes while significantly reducing processing time, resolving the contradiction between thoroughness and speed.
3Reliability
If the system performs thorough analysis of all displayable elements to reduce false negatives, then detection accuracy improves, but the time required per web page increases
Solution Approach 1:
The patent implements dynamic analysis depth adjustment based on risk assessment. The system initially performs rapid screening of display elements and dynamically increases analysis depth only for suspicious elements or pages that trigger risk indicators. This dynamic approach ensures thorough analysis where needed while maintaining high throughput for low-risk pages, resolving the contradiction between reliability and productivity.
Data Source
AI summary
A system and method for detecting phishing cyberattacks. The method involves parsing a code segment retrieved using a suspect uniform resource locator (URL) to identify any links included in the code segment. From these links, additional code segments may be recovered in accordance with a code segment recovery scheme. Thereafter, analytics are performed on the retrieved and possibly recovered code segments. The analytics include determining whether any of the code segments is correlated with a code segment associated with a known prior phishing cyberattack. Upon completing the analytics, an alert message including meta-information associated with results from the analytics is generated to identify that the URL is associated with a known prior phishing cyberattack when one or perhaps a combination of code segments associated with the URL are correlated to any code segment associated with a known prior phishing cyberattack.