Web Agent Phishing Detection via Server Attribute Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Phishing websites that copy and modify original website code to deceive users are difficult to detect, as they resemble legitimate sites, and existing methods lack effective mechanisms to identify unauthorized use and malicious modifications of web code.
Innovation Solution
A web agent is embedded into the web code of protected websites, which upon download and execution on a client computer, identifies server attributes, detects malicious use, and transmits a notification beacon to a security server, including features to analyze URLs, IP addresses, and server certificates to differentiate between legitimate and phishing sites.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If phishing websites copy and modify original website code to deceive users, then the phishing sites become more convincing and difficult to detect, but the ability to detect unauthorized use and malicious modifications deteriorates
Solution Approach 1:
The system performs preliminary actions by embedding a web agent into the original website code before it can be copied. This agent remains dormant during local testing but activates when the code is deployed to a remote server, automatically detecting phishing attempts before they can deceive users. The agent pre-establishes detection capabilities within the code itself, allowing it to identify unauthorized modifications and malicious usage patterns.
Solution Approach 2:
The web agent acts as an intermediary between the original website code and the phishing detection system. It embeds detection logic directly within the web code, serving as a mediator that can identify when the code is being used maliciously without requiring external analysis. The agent transmits information about suspicious activity to security servers, enabling detection of phishing sites while maintaining the functionality of the original code.
2Productivity
If web code is distributed widely across multiple servers, then the reach and impact of the website increases, but the risk of unauthorized copying and phishing attacks increases
Solution Approach 1:
The web agent implements a feedback mechanism that continuously monitors the environment where the web code is executed. When the code runs on a remote server, the agent detects server attributes, analyzes them for suspicious patterns, and transmits information about potential phishing attempts to security servers. This feedback loop enables real-time detection and reporting of unauthorized use, allowing the system to respond to security threats while the code is distributed widely.
Solution Approach 2:
The system changes the behavioral parameters of the web code by embedding a web agent that alters how the code executes in different environments. The agent remains dormant during local development but activates specific detection and reporting functions when deployed remotely. This parameter change enables the same code to be both widely distributed for productivity and simultaneously monitored for security threats.
3Reliability
If security detection mechanisms are added to web code, then the ability to detect phishing attacks improves, but the complexity of the web code increases
Solution Approach 1:
The security detection mechanism is implemented using the nested doll principle by embedding a compact web agent directly within the existing web code structure. The agent is nested as a small, self-contained component that leverages the surrounding code environment rather than adding separate, complex security systems. This nesting approach minimizes the increase in overall code complexity while maintaining reliable phishing detection capabilities.
Data Source
AI summary
Methods, apparatuses and computer program products implement embodiments of the present invention that include monitoring use of web code by providing a web agent for embedding into the web code of a protected web site, and upon downloading the web code from a server to a client computer and running the web code on the client computer, identifying, by the web agent, attributes of the server. The attributes are analyzed by the web agent so as to detect malicious use of the web code, and a notification beacon is transmitted by the web agent in response to detecting the malicious use of the web code.