Phishing URL Detection via Whitelist Blacklist Regular Expression Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current phishing prevention methods are incomplete, unresponsive, and reliant on end-user cooperation, leading to significant delays and financial losses due to the inability to timely detect and mitigate phishing attacks effectively.
Innovation Solution
A two-stage method using regular expressions to classify network traffic, where URLs are first checked against a whitelist and then a blacklist, with a matching score determining the legitimacy of unknown URLs, allowing for proactive detection and mitigation of potential phishing URLs without end-user participation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If user reports and manual updates are used to maintain phishing blacklists, then the system is easy to operate, but the responsiveness and completeness of phishing detection deteriorate due to delays in detecting new phishing URLs
Solution Approach 1:
The system performs preliminary actions by proactively generating phishing URLs using simulated phishing techniques before actual attacks occur. These pre-generated URLs are added to the blacklist in advance, enabling the system to detect and block phishing attempts before they can harm users, thus improving responsiveness without requiring manual updates
Solution Approach 2:
The system serves itself by automatically generating phishing URLs through simulated phishing techniques and maintaining the blacklist without human intervention. This self-service mechanism continuously updates the blacklist with new phishing patterns, improving both responsiveness and completeness while reducing operational complexity
2Reliability
If client-side software is deployed to protect end-users, then the system can provide real-time protection, but the ease of operation deteriorates because users must install and configure additional software
Solution Approach 1:
The system introduces an intermediary component that acts as a proxy or gateway between users and the internet. This intermediary handles phishing detection and URL filtering centrally, providing real-time protection without requiring users to install or configure client-side software, thus maintaining both reliability and ease of operation
Solution Approach 2:
The system creates a universal solution that serves multiple functions through a single centralized mechanism. The same phishing URL generation and blacklist maintenance system protects all users simultaneously, eliminating the need for individual client-side installations while providing comprehensive real-time protection across the entire user base
3Measurement precision
If blacklists contain complete URLs of phishing sites, then the detection precision improves, but the adaptability deteriorates because minor variants of phishing URLs can escape detection
Solution Approach 1:
The system applies local quality by focusing on specific critical characteristics of phishing URLs rather than storing complete URLs. By identifying and prioritizing key local features such as domain name patterns, path structures, and parameter configurations, the system achieves high detection precision while maintaining adaptability to URL variants through pattern matching on these essential local qualities
4Loss of time
If the system proactively generates phishing URLs using simulated phishing techniques, then the responsiveness and completeness of phishing detection improve, but the device complexity increases due to the need for URL generation and matching mechanisms
Solution Approach 1:
The system applies segmentation by dividing the complex phishing URL generation and detection process into distinct modular components. Each component handles a specific aspect such as domain generation, path construction, parameter manipulation, or pattern matching. This segmentation reduces overall device complexity by making each component manageable and independently maintainable while enabling proactive phishing URL generation that improves responsiveness
Data Source
AI summary
According to an aspect of this invention, a method to detect phishing URLs involves: creating a whitelist of URLs using a first regular expression; creating a blacklist of URLs using a second regular expression; comparing a URL to the whitelist; and if the URL is not on the whitelist, comparing the URL to the blacklist. False negatives and positives may be avoided by classifying Internet domain names for the target organization as “legitimate”. This classification leaves a filtered set of URLs with unknown domain names which may be more closely examined to detect a potential phishing URL. Valid domain names may be classified without end-user participation.