Systems and methods for electronic fraud prevention

• US 8,695,100 B1
• Filed: 12/31/2007
• Issued: 04/08/2014
• Est. Priority Date: 12/31/2007
• Status: Active Grant

• Current Assignee: Bitdefender IPR Management Limited (Bitdefender LLC)
• Original Assignee: Bitdefender IPR Management Limited (Bitdefender LLC)
• Inventors: Cosoi, Catalin A.
• Primary Examiner(s): Arani, Taghi
• Assistant Examiner(s): Plecha, Thaddeus
• Application Number:
  US11/967,563
• Time in Patent Office: 2,290 Days
• Field of Search: 726/26
• US Class Current: 726/26
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

In some embodiments, a phishing detection method includes computing a first phishing indicator of a target webpage; when the target webpage is considered suspicious of phishing according to the first phishing indicator, computing a second phishing indicator of the target webpage, and deciding whether the webpage is a phishing site according to the first and second phishing indicators. Computing the second phishing indicator comprises comparing a word content (semantic content) of the target webpage to a word content of each of a plurality of reference webpages. Comparing the word contents may include counting the number of visible words which are common to the target and reference webpages, and/or computing a ratio of a number of words which are common to the target and reference webpages to the total number of words in both the target and reference webpages.

Claims

1. A computer-implemented method comprising employing at least one computer processor to perform the steps of:

generating a target sequence of target word indexes for a set of visible words of a target webpage, wherein the target word indexes are ordered in the target sequence according to a display order of visible words in the target webpage;

computing a word content phishing indicator for the target webpage by determining a relationship between an index of a word within the target sequence of target word indexes and an index of the word within a reference sequence of reference word indexes, wherein the reference word indexes are ordered in the reference sequence according to a display order of visible words in a reference webpage, wherein the word content phishing indicator for the target webpage is computed according to a quantity selected from a group consisting of a first inter-page word distance and a second inter-page word distance, wherein the first inter-page distance is computed as a function of

2. The method of claim 1, further comprising computing a preliminary phishing indicator for the target webpage, and computing the word content phishing indicator for the target webpage in response to computing the preliminary phishing indicator for the target webpage when the target webpage is considered suspicious of phishing according to the preliminary phishing indicator, wherein computing the preliminary phishing indicator includes comparing a location indicator of the target webpage to a reference list of location indicators.

3. The method of claim 2, wherein the reference list of location indicators includes a whitelist of location indicators corresponding to trusted webpages.

4. The method of claim 2, wherein the reference list of location indicators includes a blacklist of location indicators corresponding to phishing webpages.

5. The method of claim 1, further comprising computing a preliminary phishing indicator for the target webpage, and computing the word content phishing indicator for the target webpage in response to computing the preliminary phishing indicator for the target webpage when the target webpage is considered suspicious of phishing according to the preliminary phishing indicator, wherein computing the preliminary phishing indicator includes determining whether the target webpage includes a user authentication request.

6. The method of claim 1, further comprising identifying a user authentication word sequence formed by all visible words in a user authentication section of the target webpage, wherein the target sequence of target word indexes comprises a target sequence of user authentication word indexes ordered according to a display order of visible words in the user authentication section of the target webpage.

7. The method of claim 1, wherein the word content phishing indicator for the target webpage is computed according to the first inter-page word distance.

8. The method of claim 1, wherein the word content phishing indicator for the target webpage is computed according to the second inter-page word distance.

9. A system comprising a hardware computer processor configured to execute a set of instructions to form:

a word content phishing filter configured to compute a word content phishing indicator for a target webpage, wherein computing the word content phishing indicator for the target webpage comprises determining a relationship between an index of a word within a target sequence of target word indexes and an index of the word within a reference sequence of reference word indexes, wherein the target word indexes are ordered in the target sequence according to a display order of visible words in the target webpage, and wherein the reference word indexes are ordered in the reference sequence according to a display order of visible words in a reference webpage, wherein the word content fishing indicator for the target webpage is computed according to a quantity selected from a group consisting of a first inter-page word distance and a second inter-page word distance, wherein the first inter-page distance is computed as a function of |Δ

₁|/|A∪

B|, wherein the second inter-page word distance is computed as a function of |Δ

₂|/|A∪

B|, wherein Δ

₁={w∈

A∩

B, so that α

−

ε

≦

x_w/y_w≦

α

+ε

}, wherein Δ

₂={w∈

A∩

B, so that α

−

ε

≦

x_w−

y_w≦

α

+ε

}, wherein w represents a word w, A represents a target wordset of the target webpage, B represents a reference wordset of the reference webpage, ∩ and

∪

represent set intersection and union, respectively, |.| denotes number of elements, x_w represents an index of the word w within the target wordset, y_w represents an index of the word w within the reference wordset, and wherein α and

ε

are non-zero parameters; and

a phishing risk manager configured to determine whether the target webpage is a phishing page according to the word content phishing indicator.

10. The system of claim 9, wherein computing the word content phishing indicator comprises identifying a user authentication word sequence formed by all visible words in a user authentication section of the target webpage, wherein the target sequence of target word indexes comprises a target sequence of user authentication word indexes ordered according to a display order of visible words in the user authentication section of the target webpage.

11. The system of claim 9, wherein the word content phishing indicator for the target webpage is computed according to the first inter-page word distance.

12. The system of claim 9, wherein the word content phishing indicator for the target webpage is computed according to the second inter-page word distance.

13. A computer-implemented method comprising employing at least one computer processor to perform the steps of:

generating a target sequence of target word indexes for a set of visible words of the target document, wherein the target word indexes are ordered in the target sequence according to a display order of visible words in the target document;

computing a word content fraud indicator for the target document by determining a relationship between an index of a word within the target sequence of target word indexes and an index of the word within a reference sequence of reference word indexes, wherein the reference word indexes are ordered in the reference sequence according to a display order of visible words in a reference document, wherein the word content fraud indicator for the target webpage is computed according to a quantity selected from a group consisting of a first inter-page word distance and a second inter-page word distance, wherein the first inter-page distance is computed as a function of

14. The method of claim 13, further comprising identifying a user authentication word sequence formed by all visible words in a user authentication section of the target document, wherein the target sequence of target word indexes comprises a target sequence of user authentication word indexes ordered according to a display order of visible words in the user authentication section of the target document.

15. The method of claim 13, wherein the word content fraud indicator for the target webpage is computed according to the first inter-page word distance.

16. The method of claim 13, wherein the word content fraud indicator for the target webpage is computed according to the second inter-page word distance.