SaaS Phishing URL Recognition With Static and Dynamic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing phishing protections are insufficient against emerging phishing attacks, as attackers continually evolve their methods to bypass current security measures.
Innovation Solution
A platform-agnostic SaaS platform is employed to analyze and mitigate phishing URLs using a combination of static and dynamic analysis, leveraging machine learning models and real-time threat intelligence to identify and block malicious domains and URLs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional phishing detection methods are used, then existing phishing attacks can be identified, but emerging phishing attacks using SaaS platforms cannot be detected
Solution Approach 1:
The patent implements a universal phishing detection framework that works across multiple SaaS platforms (Google Workspace, Microsoft 365, Salesforce, etc.) by identifying common phishing patterns rather than platform-specific signatures. The system analyzes URLs, emails, and content across different platforms using a unified detection engine that applies the same security rules and machine learning models regardless of the underlying platform, enabling broad adaptability to emerging phishing attacks while maintaining reliable detection across all platforms.
2Speed
If static analysis alone is used, then detection speed is fast, but detection accuracy is insufficient against sophisticated phishing attacks
Solution Approach 1:
The patent combines static analysis and dynamic analysis into a unified detection system. Static analysis provides fast initial screening by examining URL structures, domains, and content without execution, while dynamic analysis executes suspicious URLs in isolated environments to observe actual behavior. The system merges results from both approaches, using static analysis for rapid filtering and dynamic analysis for deep verification of high-risk URLs, thereby achieving both speed and accuracy in phishing detection.
3Measurement precision
If dynamic analysis is used, then detection accuracy improves, but processing time and computational resources increase
Solution Approach 1:
The patent applies partial dynamic analysis by first performing static analysis on all incoming URLs to identify high-risk candidates. Only URLs that pass the static analysis threshold are subjected to resource-intensive dynamic analysis in isolated environments. This selective approach ensures that dynamic analysis is applied only when necessary (partial action), maintaining high detection accuracy for suspicious URLs while minimizing overall processing time and computational resource consumption by avoiding full dynamic analysis on all URLs.
Data Source
AI summary
Techniques for recognizing phishing URLs on Software as a Service (SaaS) platforms are disclosed. A candidate URL is received. A determination is made that the candidate URL is a SaaS hosted URL. In response to the determination, the URL is evaluated using a model trained on SaaS hosted content. A remedial action is performed in response to determining that the received URL is a phishing URL.