SYSTEM AND METHOD TO PROVIDE AUTOMATIC CLASSIFICATION OF PHISHING SITES

• US 20140033307A1
• Filed: 07/24/2013
• Published: 01/30/2014
• Est. Priority Date: 07/24/2012
• Status: Active Grant

• Current Assignee: Carbonite LLC (Open Text Corporation)
• Original Assignee: Webroot Inc. (Open Text Corporation)
• Inventors: Schmidtler, Mauritius A.R.
• Granted Patent: US 9,282,117 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A phishing classification model that detects a phishing website based on one or more feature vectors for the website is provided. The phishing classification model may operate on a server and may further select a website, generate a feature vector for a landing page of the website, create a feature vector for every iframe that is a descendent of the landing page, and derive a final feature vector from the feature vectors of the landing page and the descendent iframe pages. Further, machine learning techniques may be applied to generate, or train, a classification model based upon one or more known phishing websites. Based on the feature vector, the classification modeler may classify a website as either a phishing website or as a non-phishing website. Feedback in the form of human verification may further be incorporated.

Claims

1. A method comprising:

creating a feature vector for a website; and

providing the feature vector to a model to determine whether or not the website is a phishing website.

2. The method of claim 1, further comprising:

creating one or more feature vectors for a landing page of the website;

creating one or more feature vectors for one or more iframe pages that are a descendant of the landing page; and

deriving a final feature vector from the one or more feature vectors of the landing page and the one or more feature vectors for the descendant iframe pages.

3. The method of claim 2, further comprising:

inputting the final feature vector into a model, wherein the model outputs a score associated with a probability of being a phishing site given the input;

classifying the website as a phishing website based on the determined score.

4. The method of claim 3, further comprising:

classifying the website as a phishing website given the score and a threshold.

5. The method of claim 3, wherein the final feature vector includes a concatenation of at least some of the following individual feature vectors:

a uniform resource locator (url) feature vector including at least some of a url string character n-gram, an IP address character n-gram, and url geo-location information;

an average url feature vector derived from links and hrefs on page;

average url feature vectors derived from links and hrefs on page in bins of similarity to the page url feature vector;

an html content feature vector;

a classification service classification result feature vector; and

a feature vector based on age of webpage.

6. The method of claim 3, wherein the model utilizes active learning to compute a priority in which the feature vector should be labeled.

7. The method of claim 3, wherein the model utilizes one or more labels to identify whether the website is a phishing website or not a phishing website.

8. The method of claim 3, wherein the model utilizes transductive learning.

9. The method of claim 3, further comprising:

an output score indicting an entity that is targeted by the phishing website.

10. The method of claim 1, wherein the feature vector is derived according to the following formula:

11. The method of claim 1, further comprising:

updating one or more classifiers based upon the final feature vector.

12. The method of claim 1, further comprising:

receiving input from a researcher indicating that the final feature vector should be classified as a phishing website.

14. The system of claim 12, wherein the server is further configured to create one or more feature vectors for a landing page of the website, create one or more feature vectors for one or more iframe pages that are a descendant of the landing page, and derive a final feature vector from the one or more feature vectors of the landing page and the one or more feature vectors for the descendant iframe pages.

16. The system of claim 14, wherein the page feature vectors include a concatenation of at least some of the following individual feature vectors:

a uniform resource locator (url) feature vector including at least some of a url string character n-gram, an IP address character n-gram, and url geo-location information;

an average url feature vector derived from links and hrefs on page;

average url feature vectors derived from links and hrefs on page in bins of similarity to the page url feature vector;

an html content feature vector;

a classification service classification result feature vector; and

a feature vector based on age of webpage.

17. The system of claim 14, wherein the server is further configured to update one or more classifiers based upon the final feature vector.

18. The system of claim 14, wherein the server is further configured to receive input from a researcher indicating that the final feature vector should be classified as a phishing website.

13. A system for classifying one or more websites as a phishing website, the system comprising:

a plurality of sensors for providing input data to a server configured to creating a feature vector for a website and provide the feature vector to a model to determine whether or not the website is a phishing website.

15. The system of claim 13, wherein the server is further configured to input the final feature vector to a model, wherein the model outputs a score associated with a probability of being a phishing site given the input, and classifies the website as a phishing website based on the determined score.

19. A non-transitory computer-readable medium comprising processor-executable instructions that are executable by a processor to facilitate the classification of one or more websites, the instructions comprising:

creating a feature vector for a website; and

providing the feature vector to a model to determine whether or not the website is a phishing website.

20. The computer-readable medium of claim 19, further comprising:

creating one or more feature vectors for a landing page of the website;

creating one or more feature vectors for one or more iframe pages that are a descendant of the landing page; and

deriving a final feature vector from the one or more feature vectors of the landing page and the one or more feature vectors for the descendant iframe pages.