Phishing URL Detection Using ML Heuristics and Brand Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods are ineffective in quickly, correctly, and efficiently identifying uncategorized phishing sites, leading to poor user experience or latency, as new phishing sites constantly emerge and evade categorization.
Innovation Solution
A system using heuristics and scanning, employing a Machine Learning (ML) model trained with Term Frequency-Inverse Document Frequency (TFIDF) and Logistic Regression to analyze URLs, and further inspecting loaded pages for brand legitimacy, to categorize URLs as phishing or legitimate.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all new uncategorized sites are blocked, then phishing protection is improved, but user experience deteriorates due to blocking legitimate sites
Solution Approach 1:
The system changes the parameter of detection speed by using ML models to rapidly analyze URL features and site content, enabling uncategorized sites to be evaluated quickly enough to allow legitimate sites while blocking phishing sites, thus resolving the contradiction between protection reliability and user experience
Solution Approach 2:
The system replaces manual inspection of uncategorized sites with automated ML-based analysis, substituting human judgment with machine learning models that can rapidly assess URL features and site content to determine legitimacy, improving both speed and accuracy
2Measurement precision
If scanning and detailed analysis of uncategorized sites is performed, then detection accuracy is improved, but latency increases leading to poor user experience
Solution Approach 1:
The system segments the analysis into two stages: first analyzing URL features (domain structure, path patterns) for quick initial assessment, then performing detailed site content analysis only on URLs that pass the initial filter or show suspicious characteristics, reducing overall latency while maintaining accuracy
Solution Approach 2:
The system performs preliminary analysis of URL features before full site loading and scanning, using the URL structure and metadata to make quick preliminary judgments that filter out obviously legitimate or obviously malicious sites before committing to resource-intensive full scans
Data Source
AI summary
Systems and methods include obtaining a Uniform Resource Locator (URL) for a site on the Internet; analyzing the URL with a Machine Learning (ML) model to determine whether or not the site is suspicious for phishing; responsive to the URL being suspicious for phishing, loading the site to determine whether or not an associated brand of the site is legitimate or not; and, responsive to the site being not legitimate for the brand, categorizing the URL for phishing and performing a first action based thereon. The systems and methods can further include, responsive to the URL being not suspicious for phishing or the site being legitimate for the brand, categorizing the URL as legitimate and performing a second action based thereon.