Poisoned Credential Tracking for Phishing Login Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing EASM solutions are unable to actively track or respond to phishing web sites that steal credentials, making it difficult to identify the source of malicious activity and secure enterprise networks effectively.

Innovation Solution

A system and method to detect phishing web sites, enter poisoned credentials, and collect data on malicious actors using these credentials, enabling proactive security measures and improved network performance.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If poisoned credentials are distributed and tracked on phishing web sites, then network security is improved, but device complexity increases

Engineering Contradiction:

Improvenetwork securityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system performs preliminary actions by proactively distributing poisoned credentials to phishing websites before actual credential theft occurs. This allows the system to establish tracking mechanisms in advance, so when malicious actors attempt to use these credentials, their activities are automatically detected and logged, enabling preemptive security measures

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary system that acts as a mediator between legitimate enterprises and phishing websites. This intermediary distributes poisoned credentials and tracks their usage without requiring direct access to enterprise networks or manual monitoring of phishing sites, thereby improving security while managing system complexity through automation

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If active tracking and data collection on malicious actors is implemented, then security response capability is improved, but loss of time increases

Engineering Contradiction:

Improvesecurity response capabilityVSAvoidtracking and data collection time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system implements continuous tracking and data collection on malicious actors through automated monitoring of phishing website activities. By maintaining continuous observation of credential usage patterns and malicious login attempts, the system eliminates gaps in monitoring that would otherwise require periodic manual checks, thereby improving response capability without significant time loss

Inventive Principle:

Principle #20Continuity of useful action

Solution Approach 2:

The tracking system operates autonomously by automatically collecting data on malicious actors, logging their activities, and generating security alerts without requiring continuous human intervention. This self-service capability allows the system to maintain persistent monitoring and rapid response capabilities while minimizing the time investment required from security personnel

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS12531901B2Poisoning and tracking credentials for phishing web sites

Publication Date: 2026.01.20 FORTINET INC

AI summary

Poisoned credentials are entered to the login section of phishing web sites automatically identified as related to a legitimate web site. The poisoned credentials are not valid credentials with respect to the login section of the legitimate web site. Later, a login attempt to the legitimate web site is detected on the enterprise network by a malicious actor making use of the poisoned credentials. Data about a malicious actor is collected using the poisoned credentials including an IP address and a time. A security action can also be taken against the malicious actor with respect to the poisoned credentials.