Collaborative phishing attack detection
DCFirst Claim
1. A method for identifying and processing email messages received at a remote computing device in connection with a simulated phishing email campaign, comprising:
- generating, by a network device, a simulated phishing email, wherein the simulated phishing email is a non-malicious email that resembles a real phishing attack by attempting to lure an individual into performing a target action on the remote computing device, wherein the simulated phishing email comprises at least one embedded hyperlink, and wherein if the individual performs the target action, performance of the target action does not compromise the remote computing device or personal information of the individual;
causing the simulated phishing email to be transmitted over a communications network to the remote computing device, the simulated phishing email comprising an identifying header, wherein the identifying header designates the simulated phishing email as a non-malicious simulated phishing email sent by the network device;
providing a plug-in for an email client at the remote computing device, the plug-in configurable for executing computer instructions for receiving a graphical user interface action performed by the individual indicating that an email, the email being either the simulated phishing email or another email, delivered in an email account associated with the individual has been identified by the individual as a possible phishing attack;
determining whether the identified email is a known simulated phishing attack by comparing one or more headers of the identified email to information identifying at least one known simulated phishing attack;
when the identified email is determined to be a known simulated phishing attack based on the comparison of the one or more headers of the identified email to information identifying at least one known simulated phishing attack, providing a graphically displayed feedback to the individual confirming that the identified email was a simulated phishing attack; and
when the identified email is determined not to be a known simulated phishing attack based on the comparison of the one or more headers of the identified email to the information identifying at least one known simulated phishing attack, sending the identified email for analysis or detection of whether or not the identified email is a phishing attack;
providing a graphical user interface element that, when selected, causes a notification to be sent to the network device, the notification triggered by the user interface action by the individual that the email delivered in the email account associated with the individual has been identified by the individual as a possible phishing attack;
receiving the notification over the communications network by the network device from the remote computing device;
if the identified email is determined to be a known simulated phishing attack based on the comparison of the one or more headers of the identified email to information identifying at least one known simulated phishing attack, electronically recording data indicating that the email has been identified as a simulated phishing attack;
if the identified email is determined not to be a known simulated phishing attack based on the comparison of the one or more headers of the identified email to information identifying at least one known simulated phishing attack, electronically recording data indicating that the email has been identified as a potential phishing attack;
causing the provisioning of an electronic training to the individual if the individual clicks on the embedded hyperlink in the simulated phishing email; and
if the email has been identified as a potential phishing attack, computing a likelihood that the identified email is a real phishing attack or is not a real phishing attack based on one or more attributes associated with the identified email.
9 Assignments
Litigations
1 Petition
Accused Products
Abstract
Described herein are methods, network devices and machine-readable storage media for detecting whether a message is a phishing attack based on the collective responses from one or more individuals who have received that message. The individuals may flag the message as a possible phishing attack, and/or may provide a numerical ranking indicating the likelihood that the message is a possible phishing attack. As responses from different individuals may have a different degree of reliability, each response from an individual may be weighted with a corresponding trustworthiness level of that individual, in an overall determination as to whether a message is a phishing attack. A trustworthiness level of an individual may indicate a degree to which the response of that individual can be trusted and/or relied upon, and may be determined by how well that individual recognized simulated phishing attacks.
338 Citations
20 Claims
-
1. A method for identifying and processing email messages received at a remote computing device in connection with a simulated phishing email campaign, comprising:
-
generating, by a network device, a simulated phishing email, wherein the simulated phishing email is a non-malicious email that resembles a real phishing attack by attempting to lure an individual into performing a target action on the remote computing device, wherein the simulated phishing email comprises at least one embedded hyperlink, and wherein if the individual performs the target action, performance of the target action does not compromise the remote computing device or personal information of the individual; causing the simulated phishing email to be transmitted over a communications network to the remote computing device, the simulated phishing email comprising an identifying header, wherein the identifying header designates the simulated phishing email as a non-malicious simulated phishing email sent by the network device; providing a plug-in for an email client at the remote computing device, the plug-in configurable for executing computer instructions for receiving a graphical user interface action performed by the individual indicating that an email, the email being either the simulated phishing email or another email, delivered in an email account associated with the individual has been identified by the individual as a possible phishing attack; determining whether the identified email is a known simulated phishing attack by comparing one or more headers of the identified email to information identifying at least one known simulated phishing attack; when the identified email is determined to be a known simulated phishing attack based on the comparison of the one or more headers of the identified email to information identifying at least one known simulated phishing attack, providing a graphically displayed feedback to the individual confirming that the identified email was a simulated phishing attack; and when the identified email is determined not to be a known simulated phishing attack based on the comparison of the one or more headers of the identified email to the information identifying at least one known simulated phishing attack, sending the identified email for analysis or detection of whether or not the identified email is a phishing attack; providing a graphical user interface element that, when selected, causes a notification to be sent to the network device, the notification triggered by the user interface action by the individual that the email delivered in the email account associated with the individual has been identified by the individual as a possible phishing attack; receiving the notification over the communications network by the network device from the remote computing device; if the identified email is determined to be a known simulated phishing attack based on the comparison of the one or more headers of the identified email to information identifying at least one known simulated phishing attack, electronically recording data indicating that the email has been identified as a simulated phishing attack; if the identified email is determined not to be a known simulated phishing attack based on the comparison of the one or more headers of the identified email to information identifying at least one known simulated phishing attack, electronically recording data indicating that the email has been identified as a potential phishing attack; causing the provisioning of an electronic training to the individual if the individual clicks on the embedded hyperlink in the simulated phishing email; and if the email has been identified as a potential phishing attack, computing a likelihood that the identified email is a real phishing attack or is not a real phishing attack based on one or more attributes associated with the identified email. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
-
-
11. A system for identifying and processing email messages received at a remote computing device in connection with a simulated phishing email campaign, comprising:
-
a network device configured for; generating a simulated phishing email wherein the simulated phishing email is a non-malicious email that resembles a real phishing attack by attempting to lure an individual into performing a target action on the remote computing device, wherein the simulated phishing email comprises at least one embedded hyperlink, and wherein if the individual performs the target action, performance of the target action does not compromise the remote computing device or personal information of the individual; causing the simulated phishing email to be transmitted over a communications network to the remote computing device, the simulated phishing email comprising an identifying header, wherein the identifying header designates the simulated phishing email as a non-malicious simulated phishing email sent by the network device; if the identified email is determined to be a known simulated phishing attack based on a comparison of the one or more headers of the identified email to information identifying at least one known simulated phishing attack, electronically recording data indicating that the email has been identified as a simulated phishing attack; if the identified email is determined not to be a known simulated phishing attack based on the comparison of the one or more headers of the identified email to information identifying at least one known simulated phishing attack, electronically recording data indicating that the email has been identified as a potential phishing attack; and causing the provisioning of an electronic training to the individual if the individual clicks on the embedded hyperlink in the simulated phishing email; and if the email has been identified as a potential phishing attack, computing a likelihood that the identified email is a real phishing attack or is not a real phishing attack based on one or more attributes associated with the identified email; the remote computing device configured for; executing a plug-in for an email client at the remote computing device for receiving a graphical user interface action performed by the individual indicating that an email, the email being either the simulated phishing email or another email, delivered in an email account associated with the individual has been identified by the individual as a possible phishing attack; determining whether the identified email is a known simulated phishing attack by comparing one or more headers of the identified email to information identifying at least one known simulated phishing attack; when the identified email is determined to be a known simulated phishing attack based on the comparison of the headers of the identified email to information identifying at least one known simulated phishing attack, providing a graphically displayed feedback to the individual confirming that the identified email was a simulated phishing attack; when the identified email is determined not to be a known simulated phishing attack based on the comparison of the one or more headers to the information identifying at least one known simulated phishing attack, sending the identified email for analysis or detection of whether or not the identified email is a phishing attack; and wherein the remote computing device is further configurable to provide a graphical user interface element that, when selected, causes a notification to be sent to the network device, the notification triggered by the user interface action by the individual that the email delivered in the email account associated with the individual has been identified by the individual as a possible phishing attack. - View Dependent Claims (12, 13, 14, 15, 16, 17, 18, 19, 20)
-
Specification