Phishing detection and targeted remediation system and method
AssigneeCoreLogic Solutions, LLC
InventorsMatthew David COHEN, Daniel W. Ray, Paul S. Hethmon
Life of this patent
Estimating the term…
Abstract
A system and method exploit information gained by observing abnormal commonality factors from multiple accounts over a predetermined time frame. The presence of an abnormal commonality factor serves as an indication that a group of accounts may have been compromised by a common actor via information gained by successful phishing of multiple users' information to improperly gain access to their respective accounts. Once this commonality associated with phishing is detected, the system provides a mechanism and process to rapidly respond to the phishing-originated attack to minimize information security damage to the affected accounts.
Claims20
A computer-implemented method of protecting user accounts potentially compromised by a common phishing attack, comprising:
- receiving information of logon activity in multiple accounts with logon credentials that have been potentially compromised in a common phishing attack on the multiple accounts;
- creating a record pattern for a phishing detection event and storing the record pattern in a storage medium, the record pattern including a commonality of a logon attributes in the multiple accounts;
- identifying the multiple accounts as being part of the phishing detection event by matching at least a portion of the record pattern with logon attributes for the multiple accounts;
- and
- denying access for the identified multiple accounts to a hosted web application, installed application, API or identity provider for a computer attempting to use the logon credentials or being from a particular geographic area.
A non-transitory computer readable medium, having instructions stored therein that when executed by a processor perform a method of protecting user accounts potentially compromised by a common phishing attack, the method comprising:
- receiving information of logon activity in multiple accounts with logon credentials that have been potentially compromised in a common phishing attack on the multiple accounts;
- creating a record pattern for a phishing detection event and storing the record pattern in a storage medium, the record pattern including a commonality of a logon attributes in the multiple accounts;
- identifying the multiple accounts as being part of the phishing detection event by matching at least a portion of the record pattern with logon attributes for the multiple accounts;
- and
- denying access for the identified multiple accounts to a hosted web application, installed application, API or identity provider for a computer attempting to use the logon credentials or being from a particular geographic area.
A system for protecting user accounts potentially compromised by a common phishing attack, comprising:
- a storage medium;
- and
- circuitry configured to
- receive information of logon activity in multiple accounts with logon credentials that have been potentially compromised in a common phishing attack on the multiple accounts,
- create a record pattern for a phishing detection event and storing the record pattern in the storage medium, the record pattern including a commonality of a logon attributes in the multiple accounts,
- identify the multiple accounts as being part of the phishing detection event by matching at least a portion of the record pattern with logon attributes for the multiple accounts, and
- deny access for the identified multiple accounts to a hosted web application, installed application, API or identity provider for a computer attempting to use the logon credentials or being from a particular geographic area.
Dependencies are inferred from the claim text.