Phishing URL Detection Using Keyword and Domain Mismatch Heuristics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Phishing attacks are a prevalent and harmful security threat, often deceiving users into clicking malicious links that can install malware or exfiltrate sensitive data, and existing security systems struggle to effectively detect such attacks without requiring extensive training data.
Innovation Solution
A method and system that analyze digital communications for phishing URLs by extracting keywords, analyzing web page content, and using heuristics such as domain matching, logo recognition, and URL features to generate alerts for potential phishing attacks, without the need for labeled training data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing security systems use traditional detection methods, then they can detect some phishing attacks, but they require extensive training data and struggle with adversarial phishing attacks
Solution Approach 1:
The patent replaces traditional machine learning models that require extensive training data with a heuristic-based system using multiple detection rules. The system evaluates URL features, domain characteristics, web page content, and email metadata through predefined heuristics rather than relying on trained models, thereby eliminating the need for large training datasets while maintaining detection effectiveness
Solution Approach 2:
The patent changes the detection parameters from model-based predictions to rule-based evaluations. It uses specific measurable parameters such as URL length, domain age, presence of login forms, screenshot analysis results, and keyword matching to make detection decisions, replacing the abstract parameter space of trained machine learning models
2Measurement precision
If security systems analyze multiple features of URLs and web pages, then detection accuracy improves, but the complexity of the detection system increases
Solution Approach 1:
The patent segments the phishing detection process into five independent heuristic modules: URL feature analysis, domain characteristic evaluation, web page content inspection, screenshot visual analysis, and email metadata examination. Each module operates independently with its own set of rules, making the complex detection task manageable and maintainable while achieving high detection precision through the combination of multiple specialized analyses
Solution Approach 2:
The patent creates a multi-functional detection system where a single heuristic-based framework performs multiple detection tasks simultaneously. The same system analyzes URLs, domains, web pages, screenshots, and email metadata using unified heuristic rules, eliminating the need for separate specialized systems for each detection task while maintaining high precision across all analysis types
3Reliability
If the system uses multiple heuristics including screenshot analysis and domain matching, then detection effectiveness against adversarial attacks improves, but processing time increases
Solution Approach 1:
The patent performs preliminary analysis of easily computable features first, such as URL structure validation, domain age checking, and keyword scanning, before proceeding to more time-consuming analyses like screenshot generation and visual comparison. This staged approach allows the system to quickly filter out obvious phishing attempts while applying heavier processing only when necessary, thereby reducing average processing time while maintaining high detection reliability
Data Source
AI summary
Methods, storage systems and computer program products implement embodiments of the present invention for protecting a computing device. These embodiments include detecting that an email is received by the computing device, the email including a Uniform Resource Locator (URL) for a web page in a first domain. The web page is retrieved from the domain, and a set of keywords are extracted from the retrieved web page. A query included the set of keywords is submitted to a search engine, and a response to the query is received from the search engine, the response indicating a set of second domain. Finally, in response to detecting that the first domain does not match any of the second domains, an alert for a phishing attack is generated.