Expedition of web phishing detection for suspicious sites
AssigneeMcAfee, Inc.
InventorsGerman Lancioni, Cedric Cochin
Life of this patent
Estimating the term…
Abstract
There is disclosed in one example a computing apparatus, including: a processor and a memory; a uniform resource locator (URL) reputation store; a network interface; and instructions encoded within the memory to instruct the processor to: receive via the network interface a request for a reputation for a URL; query the URL reputation store and determine that the URL does not have a known reliable reputation; add the URL to a URL analysis queue; perform a rough analysis of the URL, and determine from the rough analysis that the URL potentially is for a phishing website; and move the URL ahead in the analysis queue.
Claims20
A computing apparatus, comprising:
- a processor and a memory;
- a uniform resource locator (URL) reputation store;
- a network interface;
- and
- instructions encoded within the memory to instruct the processor to:
- receive via the network interface a request for a reputation for a URL;
- query the URL reputation store and determine that the URL does not have a known reliable reputation;
- add the URL to a URL analysis queue;
- perform a rough analysis of the URL comprising comparing a web page at the URL to a plurality of n most popular websites for targeting by phishing attackers, wherein n>1, and determine from the rough analysis that the URL potentially is for a phishing website;
- and
- based at least in part on the determination that the URL potentially is for a phishing website, move the URL ahead in the URL analysis queue.
One or more tangible, non-transitory computer-readable mediums having stored thereon executable instructions to instruct a processor to:
- receive a reputation request for a uniform resource locator (URL);
- determine that the URL has no cached reputation;
- queue the URL for into an analysis queue comprising a prioritized list of URLs for later full analysis by an analysis engine;
- perform an initial analysis of the URL, the initial analysis comprising comparing a web page at the URL to a plurality of n most popular websites for targeting by phishing attackers, wherein n>1, and determine from the initial analysis that the URL potentially is for a phishing website;
- and
- based at least in part on the initial analysis, assign the URL elevated priority in the analysis queue, wherein the full analysis is separate and different from the initial analysis.
A computer-implemented method of providing URL-based anti-phishing services, comprising:
- identifying a plurality of URLs that lack a reliable phishing-related reputation;
- queuing the URLs in a first-in-first-out full analysis queue, the queue for prioritizing the URLs for full analysis;
- periodically identifying within the full analysis queue a batch of URLs that have not received an initial analysis;
- subjecting a URL of the batch to an initial analysis, the initial analysis comprising comparing a web page at the URL to a plurality of n most popular websites for targeting by phishing attackers, wherein n>1, and determining from the initial analysis that the URL potentially is for a phishing website;
- and
- based at least in part on the determining, accelerating the URL's priority in the full analysis queue.
Dependencies are inferred from the claim text.