System and method for selectively evolving phishing detection rules

A method for selectively evolving phishing detection rules with a computing system, the method comprising:

• intercepting data with the computing system, the intercepted data being sent from a server and intended for a client;
• examining, with the computing system, the intercepted data against a rule set, the rule set comprising a plurality of rules related to potential phishing indicia of the intercepted data, the examining including—
• determining, as a result of the examining, a categorization from the plurality of categories of the intercepted data,
• determining, as a result of the examining, at least one categorization-specific phishing detection criteria of the intercepted data, and
• determining, as a result of the examining, at least one parameter score, the at least one parameter score comprising a likelihood of a presence of phishing content in the intercepted data based on at least the categorization-specific phishing detection criteria;
• comparing the at least one parameter score against at least one rule generation criteria;
• generating, with the computing system, a new rule and adding the new rule to the rule set to establish a second rule set if the at least one parameter score satisfies the at least one rule generation criteria;
• and
• recursively examining, with the computing system, the intercepted data against the second rule set.

A computing system for selectively evolving phishing detection rules, the system comprising:

• means for intercepting data sent from a server and intended for a client;
• means for examining the intercepted data against a rule set, the rule set comprising a plurality of rules related to potential phishing indicia of the intercepted data, the examining including—
• means for determining a categorization from the plurality of categories of the intercepted data,
• means for determining at least one categorization-specific phishing detection criteria of the intercepted data,
• means for determining at least one parameter score, the at least one parameter score comprising a likelihood of a presence of phishing content in the intercepted data based on at least the categorization-specific phishing detection criteria,
• means for comparing the at least one parameter score against at least one rule generation criteria;
• means for generating a new rule and adding the new rule to the rule set to establish a second rule set with the computing system if the at least one parameter score satisfies the at least one rule generation criteria;
• and
• means for recursively examining the intercepted data against the second rule set.

A method for evolving phishing detection rules over a plurality of generations for a plurality of categories with a computing system, the method comprising:

• generating, with the computing system, a first phishing detection rule applicable to a first category of data based on a set of intercepted data;
• applying, with the computing system, the first phishing detection rule to the set of intercepted data in accordance with the first category of data, the first category of data including a first set of phishing indicators specific to the first category and a first set of parameters specific to the first category;
• evaluating, with the computing system, a decision criteria for evolving a subsequent generation of rules based on the first phishing detection rule application to the set of intercepted data;
• if the decision criteria is satisfied, generating, with the computing system, a second phishing detection rule applicable to a second category of data, the second category of data being different than the first category of data;
• and
• applying, with the computing system, the second phishing detection rule to the set of intercepted data in accordance with the second category of data, the second category of data including a second set of phishing indicators specific to the second category and a second set of parameters specific to the second category.