Anti-phishing methods based on an aggregate characteristic of computer system logins

• US 8,601,574 B2
• Filed: 03/29/2005
• Issued: 12/03/2013
• Est. Priority Date: 03/29/2005
• Status: Active Grant

• Current Assignee: Sbc Knowledge Ventures, L.P.
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Allemann, Andrew Whittier
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Pan, Joseph
• Application Number:
  US11/093,181
• Publication Number:
  US 20060224511A1
• Time in Patent Office: 3,171 Days
• Field of Search: 713/1, 713/2, 713/188, 713/194, 713/185, 380/200, 380/201, 380/255, 380/277, 726/2, 726 22- 25, 709/224, 709/229
• US Class Current: 726/22
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06Q 20/1085 involving automatic teller machines [ATMs]
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1083 Counting of PIN attempts
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

An anti-phishing method comprises monitoring a plurality of logins into a computer system over a period of time, and generating a phishing alert signal based on an aggregate characteristic of the plurality of logins.

Claims

1. An anti-phishing method comprising:

monitoring, via a processor, actions of a plurality of different users over a period of time; and

generating a single phishing alert signal in response to determining that multiple users of the plurality of different users have performed a first user action during the period of time,

wherein the first user action is indicated when a user logs in and immediately thereafter navigates directly to a first particular web page,

wherein the first user action is not indicated when the user logs in and immediately thereafter navigates directly to a second particular web page that is different than the first particular web page,

wherein the single phishing alert signal is generated only when more than one user of the plurality of different users has performed the first user action during the period of time, and

wherein the single phishing alert signal is not generated when only a single user of the plurality of different users has performed the first user action during the period of time.

2. The anti-phishing method of claim 1, wherein the first particular web page includes customer personal information.

3. The anti-phishing method of claim 2, wherein the customer personal information comprises financial information.

4. The anti-phishing method of claim 3, wherein the financial information comprises a customer bank account identifier.

5. The anti-phishing method of claim 3, wherein the financial information comprises a credit card number.

6. The anti-phishing method of claim 2, wherein the customer personal information comprises contact information.

7. The anti-phishing method of claim 1, wherein the first particular web page enables the user to initiate a password change.

8. The anti-phishing method of claim 1, wherein the actions are performed after logging in to a computer system that provides an electronic billing web site for a telecommunication provider.

9. The anti-phishing method of claim 1, further comprising identifying a source of a suspected phishing attack in response to determining that the multiple users have performed the first user action during the period of time.

10. The anti-phishing method of claim 1, further comprising initiating contact with a law enforcement authority in response to determining that the multiple users have performed the first user action during the period of time.

11. A computer-readable storage device comprising instructions that, when executed by a processor, cause the processor to perform operations comprising:

monitoring actions of a plurality of different users over a period of time; and

generating a single phishing alert signal in response to determining that multiple users of the plurality of different users have performed a first user action during the period of time,

wherein the first user action is indicated when a user logs in and immediately thereafter navigates directly to a first particular web page,

wherein the first user action is not indicated when the user logs in and immediately thereafter navigates directly to a second particular web page that is different than the first particular web page,

wherein the single phishing alert signal is generated only when more than one user of the plurality of different users has performed the first user action during the period of time, and

wherein the single phishing alert signal is not generated when only a single user of the plurality of different users has performed the first user action during the period of time.

12. The computer-readable storage device of claim 11, wherein the first particular web page includes customer personal information.

13. The computer-readable storage device of claim 12, wherein the customer personal information comprises financial information.

14. The computer-readable storage device of claim 13, wherein the financial information comprises a bank account identifier.

15. The computer-readable storage device of claim 13, wherein the financial information comprises a credit card number.

16. The computer-readable storage device of claim 12, wherein the customer personal information comprises contact information.

17. The computer-readable storage device of claim 11, wherein the first particular web page enables the user to initiate a password change.

18. The computer-readable storage device of claim 11, wherein the actions are performed after logging in to a computer system that provides an electronic billing web site for a telecommunication provider.