Method and apparatus for phishing and leeching vulnerability detection
AssigneeTrustwave Holdings, Inc.
InventorsRami Mizrahi, Galit Efron-Nitzan, Or Katz
Life of this patent
Estimating the term…
Abstract
A system and method for protection of Web based applications are described. Anomalous traffic can be identified by comparing the traffic to a profile of acceptable user traffic when interacting with the application. Phishing and leeching are one type of anomalous traffic that is detected. The anomalous traffic, or security events, identified at the individual computer networks are communicated to a central security manager. Various responsive actions may be taken in response to detection of phishing or leeching.
Claims8
A method for securing a web server, the method comprising:
- tokenizing, with a processor, a referrer domain name from an HTTP header of a received HTTP request to form a set of referrer tokens, each token of the set of referrer tokens representing a portion of the referrer domain name;
- tokenizing, with the processor, a host domain name from the HTTP header to form a set of host tokens, each token of the set of host tokens representing a portion of the host domain name;
- comparing at least two referrer tokens of the set of referrer tokens to at least two host tokens of the set of host tokens, the at least two referrer tokens including a first top level domain token, the at least two host tokens including a second top level domain token;
- determining whether the received request is a result of an instruction from an external source based on whether the at least two referrer tokens match the at least two host tokens;
- and
- performing a responsive action if the request is the result of the instruction from the external source.
A tangible computer-readable storage disc or storage device comprising computer-readable instructions which, when executed, cause a machine to at least:
- tokenize a referrer domain name from an HTTP header of a received HTTP request to form a set of referrer tokens, each token of the set of referrer tokens representing a portion of the referrer domain name;
- tokenize a host domain name from the HTTP header to form a set of host tokens, each token of the set of host tokens representing a portion of the host domain name;
- compare at least two referrer tokens of the set of referrer tokens to at least two host tokens of the set of host tokens, the at least two referrer tokens including a first top level domain token, the at least two host tokens including a second top level domain token;
- determine whether the received request is a result of an instruction from an external source based on whether the at least two referrer tokens match the at least two host tokens;
- and
- perform a responsive action if the request is the result of the instruction from the external source.
Dependencies are inferred from the claim text.