Prefix Domain Matching for Anti-Phishing Pattern Matching

• US 20100154055A1
• Filed: 12/12/2008
• Published: 06/17/2010
• Est. Priority Date: 12/12/2008
• Status: Abandoned Application

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Hansen, Tony Lee
• Application Number:
  US12/333,701
• Publication Number:
  US 20100154055A1
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

Phishing uniform resource locators are detected and/or filtered. After a uniform resource locator is received, it is determined if at least a portion of a prefix of the uniform resource locator matches at least a portion of a blacklist entry and the uniform resource locator is filtered if at least a portion of the prefix of the uniform resource locator matches at least a portion of the blacklist entry. The prefix of the uniform resource locator is constrained to be a predetermined number of the highest level domain labels of the domain name in the received uniform resource locator.

Claims

1. A method of filtering uniform resource locators comprising:

receiving a uniform resource locator;

determining if a prefix of the uniform resource locator matches at least a portion of a blacklist entry; and

filtering the uniform resource locator if the prefix of the uniform resource locator matches at least a portion of the blacklist entry.

2. The method of claim 1 wherein the uniform resource locator comprises a plurality of domain names and the prefix of the uniform resource locator comprises a predetermined number of the highest level domain labels.

3. The method of claim 2 wherein the prefix of the uniform resource locator comprises the predetermined number of highest level domain labels.

4. The method of claim 1 wherein determining if the prefix of the uniform resource locator matches at least a portion of a blacklist entry comprises comparing at least a portion of the prefix of the uniform resource locator to at least a portion of a uniform resource locator entry in the blacklist.

5. The method of claim 1 further comprising:

adding the filtered uniform resource locator to a blacklist.

6. The method of claim 1 further comprising:

adding a portion of the filtered uniform resource locator to a blacklist.

7. A machine readable medium having program instructions stored thereon, the instructions capable of execution by a processor and defining the steps of:

receiving a uniform resource locator;

determining if a prefix of the uniform resource locator matches at least a portion of a blacklist entry; and

filtering the uniform resource locator if the prefix of the uniform resource locator matches at least a portion of the blacklist entry.

8. The machine readable medium of claim 7 wherein the uniform resource locator comprises a plurality of domain names and the prefix of the uniform resource locator comprises a predetermined number of the highest level domain labels.

9. The machine readable medium of claim 8 wherein the prefix of the uniform resource locator comprises the predetermined number of highest level domain labels.

10. The machine readable medium of claim 7 wherein the instructions for determining if the prefix of the uniform resource locator matches at least a portion of a blacklist entry further defines the step of:

comparing at least a portion of the prefix of the uniform resource locator to at least a portion of a uniform resource locator entry in the blacklist.

11. The machine readable medium of claim 7 wherein the instructions further define the step of:

adding the filtered uniform resource locator to a blacklist.

12. The machine readable medium of claim 7 wherein the instructions further define the step of:

adding a portion of the filtered uniform resource locator to a blacklist.

13. A method of populating a uniform resource locator blacklist comprising:

receiving a uniform resource locator;

filtering the uniform resource locator if a prefix of the uniform resource locator matches a portion of a blacklist entry;

comparing the filtered uniform resource locator to a plurality of blacklist entries;

determining a prefix pattern based on the comparison of the filtered uniform resource locator to the plurality of blacklist entries; and

updating the blacklist with the determined prefix pattern.