Phishing Link Detection via URL Vectorization and Character Normalization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting phishing internet links are inefficient due to the long computational time required for analyzing and comparing website content, making it impractical to check every URL.
Innovation Solution
A computer-implemented method that preprocesses URLs by replacing visually confusing characters, removing top-level domains and subdomains, splits the URL into words using Zipf's law, converts them into word vectors, and calculates an average vector to provide a phishing score using a combination of natural language processing and machine learning techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If website content analysis and comparison methods are used to detect phishing links, then detection accuracy is improved, but computational time increases significantly
Solution Approach 1:
The patent segments the URL into multiple components (protocol, subdomain, domain name, top-level domain) and processes each segment independently. This segmentation allows the system to analyze only critical portions of the URL rather than the entire website content, significantly reducing computational time while maintaining detection accuracy through targeted analysis of suspicious patterns in each segment.
Solution Approach 2:
The patent extracts and removes non-essential components from the URL such as the protocol path (http://, https://) and common subdomains (www., mail.) before analysis. This extraction process eliminates unnecessary data that would consume computational resources, allowing the system to focus computational effort only on the critical domain name and path components that actually indicate phishing characteristics.
2Reliability
If every single website or URL is checked using content analysis, then detection coverage is improved, but processing speed decreases
Solution Approach 1:
The patent performs preliminary processing actions on URLs before full analysis, including replacing visually confusing characters (e.g., zero with 'O', one with 'l') with their standard equivalents, and normalizing the URL structure. This preliminary action ensures that all URLs are in a standardized format before analysis, enabling faster processing while maintaining comprehensive detection coverage by ensuring no phishing attempt is missed due to character substitution tricks.
Solution Approach 2:
The patent applies partial analysis by focusing only on specific critical components of the URL (domain name, path segments) rather than analyzing the entire website content. This partial action approach maintains adequate detection coverage for the vast majority of phishing cases while dramatically increasing processing speed, allowing the system to check many more URLs within the same time frame.
3Manufacturing precision
If visually confusing characters are not replaced, then character encoding accuracy is improved, but phishing link detection accuracy decreases
Solution Approach 1:
The patent applies preliminary anti-action by proactively replacing visually confusing characters (such as zero '0' with 'O', one '1' with 'l', and other lookalike characters) with their correct equivalents before the phishing detection analysis occurs. This preliminary correction prevents phishing attempts that rely on character substitution from evading detection, ensuring that the detection system sees the true intended domain name and can accurately identify phishing patterns.
Data Source
AI summary
Embodiments provide a computer implemented method for detecting a phishing internet link, wherein an internet link is a Uniform Resource Locator (URL) or a domain name, the method including: receiving the internet link; replacing one or more visually confusing characters with one or more original characters, wherein the one or more visually confusing characters are similar to the one or more original characters; removing a top-level domain from the internet link; removing a common subdomain from the internet link; splitting the remaining internet link into a list of words; converting the list of words into a list of word vectors; calculating an average word vector of the list of word vectors; and providing a phishing score for the average vector, indicating a probability of the internet link being a phishing internet link.