System and method for anti-phishing system
AssigneeCiphercloud, Inc.
InventorsMeenakshi Sundaram Lakshmanan, Ram Goda, Shailesh Patel
Life of this patent
Estimating the term…
Abstract
A system and method for detecting a phishing site is disclosed. A message from a client to the site is intercepted by a security gateway. The security gateway determines if the site is a known-site or an unknown-site. If it is a known site, a reputation of the site is checked. If the site is a known-site with a bad reputation, connection between the client and the site is reset. If the site is a known-site with a good reputation, known-site testing is performed for possible phishing attack. If the site is an unknown-site, unknown-site testing for possible phishing attack is performed.
Claims8
A method for detecting a phishing site, comprising:
- intercepting, by a security gateway, a message from a client to a site;
- determining, by the security gateway, if the site is a known-site or an unknown-site;
- checking, by the security gateway, reputation of the site, and
- if the site is a known-site with a good reputation, performing, by the security gateway, known-site testing for possible phishing attack, wherein, the known-site testing includes:
- identifying a page of the site being accessed;
- determining if a reputation for the page of the site being accessed is known or unknown;
- and
- if the reputation for the page of the site being accessed is unknown, performing an unknown page testing for possible phishing attack, wherein, the unknown page testing including:
- generating a page risk score for the page;
- comparing the page risk score with a threshold value;
- and
- if the page risk score is greater than the threshold value, performing additional risk assessment, wherein, the additional risk assessment including:
- determining claims made on the page;
- determining claims made on the site;
- comparing claims made on the page with claims made on the site for a match;
- and
- if there is a match, forwarding the message from the client to the site.
A system for detecting a phishing site, comprising:
- a security gateway configured to
- intercept a message from a client to a site;
- determine if the site is a known-site or an unknown-site;
- and
- if the site is known-site with a good reputation, perform a known-site test for possible phishing attack, wherein, the known-site test including:
- identify a page of the site being accessed;
- determine if a reputation for the page of the site being accessed is known or unknown;
- and
- if the reputation for the page of the site being accessed is unknown, perform an unknown page test for possible phishing attack, wherein, the unknown page test including:
- generate a page risk score for the page;
- compare the page risk score with a threshold value;
- and
- if the page risk score is greater than the threshold value, perform additional risk assessment, wherein, the additional risk assessment includes:
- determine claims made on the page;
- determine claims made on the site;
- compare claims made on the page with claims made on the site for a match;
- and
- if there is a match, forward the message from the client to the site.
Dependencies are inferred from the claim text.