Systems and methods for identifying phishing websites

A method for automatic detection of phishing websites, comprising:

• detecting within network traffic a sequence of network traffic events that comprises at least:
• an initial communication from a network address to a first other network address;
• a first subsequent communication to the initial communication from the first other network address at a first time;
• and
• a second subsequent communication from the network address to a second other network address at a second time subsequent to the first time;
• classifying the first other network address as a potential phishing website;
• wherein the classifying comprises:
• determining that the second other network address is not related to the first other network address;
• and
• determining that a time difference between the second time and the first time meets predefined criteria;
• and
• taking one or more protective measures in response to the classifying, wherein the one or more protective measures comprise blocking the first other network address.

A method for protecting websites from phishing attacks, comprising:

• detecting within network traffic a communication from a network address to a target website;
• evaluating network events involving the network address prior to the detected communication to detect a communication with the network address to a website not related to the target website, wherein the evaluating comprises obtaining time measurements that are independent of network latency;
• classifying the prior website as potential phishing website;
• and
• taking one or more protective measures in response to the classifying, wherein the one or more protective measures comprise blocking the prior website.

A system for the automated detection of phishing attacks, comprising:

• a network flow correlator configured to detect within network traffic a sequence of network traffic events, wherein such sequence comprises:
• an initial communication from a network address to a first other network address;
• a first subsequent communication to the initial communication from the first other network address at a first time;
• and
• a second subsequent communication from the network address to a second other network address at a second time subsequent to the first time;
• and
• a website classifier configured to classify the first other network address as a potential phishing website;
• wherein the classifying comprises:
• a determination that the second other network address is not related to the first other network address, and
• a determination that a time difference between the second time and the first time meets predefined criteria;
• and
• wherein the system is configured to take one or more protective measures in response to the classifying, wherein the one or more protective measures comprise blocking the first other network address.