Method and system for detecting credential stealing attacks
AssigneeSlashnext, Inc.
InventorAtif Mushtaq
Life of this patent
Estimating the term…
Abstract
An Active Vision detection method and system for detecting credential stealing attacks using an automated machine-learning page examination engine is provided that may be used to detect both brand-based and custom credential stealing attacks. The approach employs similarity analysis in a two-stage process that may be achieved through supervised or self-learning machine learning techniques and is comparable to human analysis. The Active Vision System is capable of self-learning; every new attack detected by the system becomes part of system's long-term memory making it incrementally more accurate in future predictions using its past experience.
Claims17
A method for detecting a credential stealing attack comprising:
- a. loading a candidate web page into a browser memory;
- b. interacting with the candidate web page by responding to one or more tests presented by the candidate web page;
- c. collecting data related to a behavior of the candidate web page from the browser memory;
- d. determining, using a trained machine learning algorithm, whether the candidate web page is a credential stealing page based on the collected data;
- and
- e. displaying information regarding the candidate web page on a graphical user interface, wherein the displayed information comprises:
- (i) an identity of an infected machine on a network that has accessed the candidate web page if the candidate web page is determined to be a credential stealing page;
- and (ii) a feature of the infected machine, wherein the feature is selected from the group consisting of a machine location, a machine usage, a MAC ID, a type of machine, a machine operating system, and an identity of a machine user, and wherein the graphical user interface further allows a user to select the infected machine to view at least one of the following:
- nature or details regarding a specific machine-specific attack, a specific incident, a compiled set of attacks performed by a particular group, attacks on a particular day or time, and attacks that have occurred from a particular location or region.
A system for detecting a credential stealing attack comprising:
- (i) a memory for storing a set of software instructions,
- (ii) one or more processors configured to execute the set of software instructions to implement a page examination engine, wherein the page examination engine is configured to:
- a. load a candidate web page into a browser memory;
- b. interact with the candidate web page by responding to one or more tests presented by the candidate web page;
- c. collect data related to a behavior of the candidate web page from the browser memory;
- d. determine, using a trained machine learning algorithm, whether the candidate web page is a credential stealing page based on the collected data;
- and
- e. displaying information regarding the candidate web page on a graphical user interface, wherein the displayed information comprises:
- (i) an identity of an infected machine on a network that has accessed the candidate web page if the candidate web page is determined to be a credential stealing page;
- and (ii) a feature of the infected machine, wherein the feature is selected from the group consisting of a machine location, a machine usage, a MAC ID, a type of machine, a machine operating system, and an identity of a machine user, and wherein the graphical user interface further allows a user to select the infected machine to view at least one of the following:
- nature or details regarding a specific machine-specific attack, a specific incident, a compiled set of attacks performed by a particular group, attacks on a particular day or time, and attacks that have occurred from a particular location or region.
Dependencies are inferred from the claim text.