Phishing Detection via Address Permutation Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for blocking phishing attempts in computer networks are ineffective as they do not consider the original information of the target domain, leading to missed detections and false positives.
Innovation Solution
A system and method that generates address permutations for each asset in a computer network, compares these permutations with communication requests, and blocks requests that match, using a database of predetermined phishing addresses and calculating a phishing attempt probability rank based on visual design, SSL validity, and popularity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If general phishing detection methods are used that do not consider original target domains, then the detection mechanism is simpler to implement, but the detection accuracy decreases leading to missed detections and false positives
Solution Approach 1:
The system performs preliminary actions by generating address permutations of legitimate domains in advance and storing them in a database. When a communication request is received, the system compares the destination address against these pre-generated permutations, enabling fast and accurate detection without complex real-time analysis.
Solution Approach 2:
The detection process is segmented into distinct components: a database component that stores pre-generated address permutations, a comparison component that matches destination addresses against the database, and a blocking component that prevents malicious communications. This segmentation improves both implementation ease and detection accuracy.
2Measurement precision
If address permutations are generated and compared for every communication request, then phishing detection accuracy improves, but the system complexity and processing overhead increase
Solution Approach 1:
Address permutations are generated and stored in a database in advance, before any communication requests are processed. This preliminary action eliminates the need for complex real-time permutation generation, reducing system complexity while maintaining high detection accuracy through straightforward database comparison.
Solution Approach 2:
The system creates copies of legitimate domain addresses in various permuted forms and stores them in a database. These copies enable rapid comparison with destination addresses without requiring complex processing, simplifying the detection system while improving accuracy.
3Reliability
If a comprehensive database of predetermined phishing addresses is maintained, then the ability to block known phishing attempts improves, but the storage requirements and database management complexity increase
Solution Approach 1:
Instead of storing only original legitimate domain names, the system generates and stores multiple permuted copies of these addresses in the database. This approach increases blocking effectiveness by capturing various phishing variations while managing storage efficiently through systematic permutation generation rather than storing redundant duplicate data.
Solution Approach 2:
The system applies parameter changes to domain addresses by generating permutations that modify specific characteristics (character substitutions, transpositions, omissions). This creates a comprehensive blocking database that captures phishing variations efficiently, improving reliability without proportionally increasing storage requirements.
Data Source
AI summary
Systems and methods of blocking phishing attempts in a computer network, including receiving a list of assets of the computer network, wherein each asset is associated with at least one computer network address, generating at least one address permutation on the at least one computer network address of each asset of the computer network, wherein the generated at least one address permutation is different from the address associated with each asset of the computer network, receiving a communication request at a gateway server of the computer network, determining a destination address of the communication request, comparing the determined destination address with the at least one address permutation, and when the determined destination address is the same as at least one address permutation, blocking the communication request at the gateway server.