Phishing Detection Using URL Entropy and Uniqueness Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing sophistication and diversity of malware and phishing attacks make it difficult for users to securely access internet information channels, with existing anti-phishing solutions often providing ad hoc approaches lacking comprehensive mitigation strategies.
Innovation Solution
A malware and phishing detection and mediation (MAPDAM) platform that includes ingestion, detection, and action stages, utilizing detection engines with engineered rules, machine learning, and computer vision to identify and mitigate potential threats by analyzing URLs, website certificates, and web page content, and communicating with mitigation services to initiate preventive actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If comprehensive detection methods are implemented, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The phishing detection system is divided into multiple independent detection engines, each specializing in specific URL analysis techniques (e.g., entropy-based detection, domain analysis, path analysis). This segmentation allows each engine to focus on particular aspects of URL analysis, improving overall detection accuracy while maintaining manageable complexity through modular architecture.
Solution Approach 2:
The detection platform implements a universal framework that can execute multiple types of detection engines through a common interface. The system accepts various input data types (URLs, emails, text messages) and applies appropriate detection methods automatically, providing multi-functional capability without requiring separate specialized systems for each detection type.
2Reliability
If multiple detection engines are used, then detection capability is improved, but processing time increases
Solution Approach 1:
The system performs preliminary analysis by calculating basic URL characteristics (entropy, domain age, TLD classification) before applying more complex detection methods. This preliminary action allows the system to quickly eliminate obviously safe URLs and focus computational resources on suspicious URLs that require more thorough analysis by additional detection engines.
Solution Approach 2:
The system applies detection engines selectively based on the suspiciousness level of the URL. Not all URLs undergo the complete sequence of all detection engines - instead, the system applies partial analysis for low-risk URLs and excessive (comprehensive) analysis only for high-risk URLs, optimizing the balance between detection capability and processing time.
Data Source
AI summary
A method for phishing detection using uniform resource locators is discussed. The method includes accessing data from one or more of a monitored portion of website data and a monitored portion of emails, the data indicating a suspect Uniform Resource Locator (URL). The method includes assigning a rule score based on partial rule scores of each portion of the suspect URL, the rule score indicating a phishing potential based on URL rules. The method includes determining a uniqueness score of the suspect URL, the uniqueness score indicating a degree of uniqueness of the suspect URL from a plurality of known phishing URLs. The method also includes determining a URL phishing score based, at least in part, on the rules scores and the uniqueness score for the suspect URL.