Phishing URL Detection Using Keyword Search and Domain Ranking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Phishing attacks are frequent and harmful, requiring time-consuming incident response, and existing security measures struggle to effectively detect suspicious URLs without labeled training data.
Innovation Solution
A method and system that analyze digital communications for phishing URLs by extracting keywords, analyzing web page content, and using heuristics such as domain matching, logo recognition, and feature-based approaches to generate alerts for potential phishing attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing security measures are used to detect phishing URLs, then detection capability is limited, but the system requires labeled training data which is time-consuming to prepare
Solution Approach 1:
The system performs self-learning by automatically analyzing web page content, extracting keywords, and generating phishing indicators without requiring external labeled training data. The security apparatus autonomously improves its detection capability through continuous analysis of incoming communications and web page characteristics.
Solution Approach 2:
The system pre-computes and stores phishing indicators, keywords, and web page characteristics before actual phishing attacks occur. By maintaining a pre-built database of domain patterns, logo hashes, and suspicious URL features, the system enables rapid real-time detection without time-consuming analysis during incident response.
2Measurement precision
If multiple security layers are deployed to improve detection accuracy, then detection precision improves, but system complexity increases
Solution Approach 1:
The patent combines multiple detection techniques into a unified security apparatus that simultaneously performs domain matching, logo recognition, URL feature analysis, and web page content extraction. This merged approach maintains high detection accuracy while reducing overall system complexity compared to separate independent security layers.
Solution Approach 2:
The security apparatus is designed as a multi-functional system that can detect phishing through multiple methods (domain comparison, logo hashing, URL pattern recognition, keyword extraction) within a single integrated platform, eliminating the need for multiple specialized security tools.
3Object-affected harmful factors
If traditional anti-virus and intrusion detection systems are used, then basic security protection is provided, but they cannot effectively detect sophisticated phishing URLs
Solution Approach 1:
The system replaces traditional signature-based detection mechanisms with content-based analysis using keyword extraction, statistical modeling, and machine learning algorithms. This substitution enables detection of novel phishing URLs without relying on pre-existing threat signatures or labeled training data.
Solution Approach 2:
The security apparatus analyzes multiple parameters of web pages including textual content, HTML structure, domain characteristics, logo images, and URL features. By monitoring changes and patterns across these diverse parameters, the system can identify phishing attempts even when individual parameters appear normal.
Data Source
AI summary
Methods, storage systems and computer program products implement embodiments of the present invention for protecting a computing device. These embodiments include detecting that a digital communication is received by the computing device, the digital communication including a Uniform Resource Locator (URL) for a web page in a first domain. The web page is retrieved from the domain, and a set of keywords are extracted from the retrieved web page. A query included the set of keywords is submitted to a search engine, and a response to the query is received from the search engine, the response indicating a set of second domains and their respective rankings. An alert is generated if it is determined that a ranking associated with a second domain corresponding to the first domain does not satisfy a specified ranking threshold