Preventing phishing attacks
AssigneeMicrosoft Corporation
InventorsDinei A. Florencio, Cormac E. Herley
Life of this patent
Estimating the term…
Abstract
A system for protecting against information security breaches comprises a credential module that maintains a list of protected security credentials that are each associated with a known computing system and that detects when a security credential in the list is used. The system also includes a protection module that detects use of the security credential in connection with a computing system other than the known computing system with which the security credential is associated and that reports such use to a security server. Methods for using the system are also provided.
Claims19
A system for protecting against information security breaches, comprising:
- a client computer including a processor coupled to computer-readable storage media containing instructions executable by the processor for implementing a credential module that maintains a set of security credentials that are each associated with corresponding known computing systems, wherein the credential module detects when security credentials of the set of security credentials are to be used;
- and
- a protection module implemented by the processor that detects use of security credentials of the set of security credentials in connection with an unverified computing system other than the associated known computing systems, wherein the protection module is configured to report the use of the security credentials with the unverified computing system in a report to a security server,
- wherein the security server determines that the unverified computing system is engaged in malicious activity when a number of reports of the use of the security credentials with the unverified computing system received from the client computer and one or more other client computers exceeds a predetermined threshold.
A method for protecting against attempts to obtain security credentials, comprising:
- employing a processor executing computer-executable instructions stored on a computer-readable storage medium to cause a security server to implement the following acts:
- receiving, at the security sever from a plurality of client computers, domain names of trusted sites that are associated with security credentials for each of the client computers;
- maintaining a set of the domain names of the trusted sites that are associated with security credentials for each of the client computers in a trusted data store accessible by the security server;
- receiving reports at the security server from a plurality of the client computers that indicates that security credentials associated with one or more of the trusted sites are being used by the plurality of client computers at an unverified site that is not one of the trusted sites;
- maintaining a counter that tracks the reports of the security credentials associated with the one or more trusted sites being used at the unverified site, wherein the counter is incremented each time one of the reports is received for the unverified site;
- and
- flagging the unverified site as engaging in suspected malicious activity when the counter of the number of reports received exceeds a predetermined threshold.
A system for protecting against attempts to obtain security credentials, comprising:
- a security server including a processor coupled to computer-readable storage media containing instructions executable by the processor for:
- receiving a report from a client that a security credential associated with a first trusted site is being used at an unverified site;
- whether the reported use of the security credential is in conjunction with a malicious site based at least in part on aggregate data obtained from a plurality of reports received from a plurality of clients indicating that the plurality of clients have submitted security credentials associated with trusted sites to the unverified site;
- and
- determining, based upon the analyzing, that the reported use of the security credential is in conjunction with a suspected malicious site when a number of the reports received exceeds a predetermined number.
Dependencies are inferred from the claim text.