Website Phishing Detection Through Spelling and Grammar Artifacts

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Modern phishing websites are difficult to detect due to their sophisticated design, which often includes unusual misspellings and grammatical artifacts, making them visually similar to legitimate websites, and existing detection methods struggle to identify these subtle anomalies.

Innovation Solution

A system that analyzes websites for grammatical and spelling irregularities using spell check and case-sensitive usage checks, combining scores to identify potential phishing sites, supplementing existing detection mechanisms.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If sophisticated design is used to make phishing websites visually similar to legitimate websites, then the phishing websites become more convincing and harder to detect, but the detection difficulty increases

Engineering Contradiction:
Improvephishing detection accuracyVSAvoiddetection difficulty
Core Design Contradiction:
ReliabilityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent extracts and analyzes specific linguistic features (spelling patterns, grammatical structures, punctuation usage) from website content separately from the overall visual design. By isolating these textual artifacts, the system can detect phishing websites based on their linguistic characteristics rather than relying on visual similarity alone, thus resolving the contradiction between visual sophistication and detectability

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The patent applies different analysis methods to different parts of the website content. Instead of treating the entire website uniformly, it focuses on specific local linguistic features such as spelling patterns in URLs, grammatical artifacts in text content, and punctuation anomalies in forms. This localized analysis enables detection of phishing websites even when they visually mimic legitimate sites

Inventive Principle:
Principle #3Local quality

2Reliability

If existing detection methods are used to identify phishing websites, then the detection process becomes complex and resource-intensive, but the detection capability remains insufficient

Engineering Contradiction:
Improvephishing detection capabilityVSAvoiddetection system complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent replaces complex visual and behavioral analysis mechanisms with simpler linguistic pattern recognition. Instead of analyzing website layout, graphics, and user interactions, the system uses spell check algorithms and grammatical analysis to detect phishing websites. This substitution dramatically reduces computational complexity while maintaining or improving detection capability

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent employs lightweight, computationally inexpensive linguistic analysis methods that can be executed quickly with minimal resources. By using simple spell checking and grammatical artifact detection rather than heavy machine learning models or complex analysis systems, the patent achieves efficient phishing detection that is both resource-friendly and effective

Inventive Principle:
Principle #27Cheap short-living objects (Disposable)

Data Source

PatentUS12401687B2Phishing detection via grammatical artifacts
Publication Date: 2025.08.26 MCAFEE LLC
  • US12401687B2 patent drawing
  • US12401687B2 patent drawing
  • US12401687B2 patent drawing

AI summary

There is disclosed a method of mitigating phishing, including extracting text from a website under analysis; using a spell check algorithm to compare extracted words or phrases to a language dictionary of words or phrases selected from web pages known to be phishing targets, and using a spell counter to count misspell hits from the spell check algorithm; comparing the extracted words or phrases to a case-sensitive usage reference, and using a usage counter to count mismatched usage hits from the case-sensitive usage reference; combining the spell counter and the usage counter into a combined counter; and using the combined counter to identify the website under analysis as a suspected phishing website and taking a phishing mitigation action.