Semi-automatic rule generator

An article of manufacture having thereon a non-transitory computer readable medium for storing computer readable code for generating a first set of longest common sequences from a plurality of known malicious webpages, said first set of longest common sequences representing input data which is used to generate a set of regular expressions for detecting phishing webpages, comprising:

• code for obtaining source strings from said plurality of known malicious webpages;
• code for transforming said source strings to reduce the number of at least one of stop words and repeated tags, thereby obtaining a set of transformed source strings;
• code for performing string alignment on said set of transformed source strings, thereby obtaining at least a scoring matrix;
• code for obtaining a second set of longest common sequences responsive to said performing said string alignment;
• code for filtering said second set of longest common sequences, thereby obtaining said first set of longest common sequences;
• code for using said first set of longest common sequences to generate the set of regular expressions;
• and
• code for using the set of regular expressions to detect a phishing attack.

A computer-implemented method for generating a first set of longest common sequences from a plurality of known malicious webpages, said first set of longest common sequences representing input for generating a set of regular expressions for detecting phishing webpages, comprising:

• obtaining HTML source strings from said plurality of known malicious webpages;
• transforming said HTML source strings to reduce the number of at least one of stop words and repeated tags, thereby obtaining a set of transformed source strings;
• performing string alignment on said set of transformed source strings, thereby obtaining at least a scoring matrix;
• obtaining a second set of longest common sequences responsive to said performing said string alignment;
• filtering said second set of longest common sequences, thereby obtaining said first set of longest common sequences;
• and
• using said first set of longest common sequences to generate the set of regular expressions for use in detecting a phishing attack.