Back to results
US 8,769,695 B2Granted
Phish probability scoring model
AssigneeBank of America Corporation
InventorsPhillip L. Richards, Michael J. Mayer, David M. Andersen
Life of this patent
Estimating the term…
Abstract
In general, embodiments of the invention relate to systems, methods, and computer program products for determining the probability that a given website is conducting or is related to fraudulent activity, including phishing activity. More particularly, embodiments of the invention relate to automatically monitoring and scoring URLs for fraudulent activity by parsing keywords, combinations of keywords, and other relevant data from an input communication, such as an email, and analyzing the data obtained against a database containing a plurality of grading factors.
Claims20
A system comprising:
- a processor for execution of a threat detection application for determining the probability that a current website link is associated with fraudulent activity;
- a communication device associated with the processor for receiving a website link;
- and
- a database associated with the processor, the database comprising:
- a plurality of different keyword combinations that have been identified in previously received website links received at a time prior to a time the current website link was received, where each of the keyword combinations comprises at least two distinct keywords;
- and
- for each of the different keyword combinations, a total count number representing a number of instances a previously received website link, received at a time prior to a time the current website link was received and containing the respective keyword combination, has been received by the system, a threat number representing a number of instances the previously received website link, received at a time prior to a time the current website link was received and containing the respective keyword combination, was associated with fraudulent activity, and a non-threat number representing a number of instances the previously received website link, received at a time prior to a time the current website link was received and not containing the respective keyword combination, was not associated with fraudulent activity;
- wherein the threat detection application executed by the processor is configured to:
- receive at least one current website link;
- review each current website link received by the system to determine that none of the plurality of keyword combinations exactly match words included in the current website link under review;
- in response to determining that none of the plurality of the keyword combinations exactly match words included in the current website link, review each previously received website link to identify each of the pluralities of the keyword combinations, from the database, that include at least one keyword that matches at least one word in the current website link, thereby indicating keyword combinations that partially match the current website link;
- for each of the keyword combinations that partially matches the current website link, retrieve, from the database, the plurality of threat numbers and/or for each of the keyword combinations that does not match the current website link, retrieve, from the database, and the plurality of non-threat numbers, update the threat numbers and/or the non-threat numbers by an increment of one;
- retrieve, from the database, the plurality of total count numbers from each of the different keyword combinations, update the total count numbers by an increment of one;
- divide the total threat number by the total count number from each of the different keyword combination, thereby resulting in a probability of threat of the current website link;
- and/or divide the total non-threat number by the total count number, thereby resulting in a probability of non-threat of the current website link;
- compare the probability of threat to a first threshold and/or compare the probability of non-threat to a second threshold;
- and
- based on the comparison, determine that the current website link is a threat if the probability is equaled or greater than the first threshold, non-threat if the probability is equaled or less than the second threshold.
15 more elements
A method comprising:
- storing in a database the following information:
- a plurality of different keyword combinations that have been identified in previously received website links;
- and
- for each of the different keyword combination, a total number of instances a previously received website link containing the respective keyword combination has been received by the system and a number of instances a previously received website link containing the respective keyword combination was associated with fraudulent activity, where each of the keyword combinations comprises at least two distinct keywords;
- using a processor to access the database and execute a threat detection application for determining the probability that a current website link, received at a time after times the previously received website links were received, is associated with fraudulent activity;
- for each of the different keyword combinations, a total count number representing a number of instances a previously received website link, received at a time prior to a time the current website link was received and containing the respective keyword combination, has been received by the system, a threat number representing a number of instances a previously received website link, received at a time prior to a time the current website link was received and containing the respective keyword combination, was associated with fraudulent activity, and a non-threat number representing a number of instances a previously received website link, received at a time prior to a time the current website link was received and not containing the respective keyword combination, was not associated with fraudulent activity;
- wherein the threat detection application executed by the processor is configured to:
- receive at least one current website link;
- review each current website link received by the system to determine that none of the plurality of keyword combinations exactly match words included in the current website link under review;
- in response to determining that none of the plurality of the keyword combinations exactly match words included in the current website link, review each previously received website link to identify each of the pluralities of the keyword combinations, from the database, that include at least one keyword that matches at least one word in the current website link, thereby indicating keyword combinations that partially match the current website link,
- for each of the keyword combinations that partially matches the current website link, retrieve, from the database, the plurality of threat numbers and/or for each of the keyword combinations that does not match the current website link, retrieve, from the database, the plurality of non-threat numbers, update the threat numbers and/or the non-threat numbers by an increment of one;
- retrieve, from the database, the plurality of total count numbers from each of the different keyword combinations, update the total count numbers by an increment of one;
- divide the total threat number by the total count number from each of the different keyword combination, thereby resulting in a probability of threat of the current website link;
- and/or divide the total non-threat number by the total count number, thereby resulting in a probability of non-threat of the current website link;
- compare the probability of threat to a first threshold and/or compare the probability of non-threat to a second threshold;
- and
- based on the comparison, determine that the current website link is a threat if the probability is equaled or greater than the first threshold, non-threat if the probability is equaled or less than the second threshold.
14 more elements
A computer program product for determining the probability that a current website link is associated with fraudulent activity, the computer program product comprising a non-transient computer-readable medium having computer-executable instructions embodied therein, said computer-executable instructions comprising:
- first instructions configured to store in a database a plurality of different keyword combinations that have been identified in previously received website links where each of the keyword combination comprises at least two distinct keywords;
- second instructions configured to receive from a client device, a current website link in question;
- third instructions configured to review each current website link received by the system to determine whether any of the plurality of keyword combinations exactly match words included in the current website link under review;
- fourth instructions configured to, in response to determining that none of the plurality of the keyword combinations exactly match words included in the current website link, review each previously received website link to identify each of the pluralities of the keyword combinations, from the database, that include at least one keyword that matches at least one word in the current website link, thereby indicating keyword combinations that partially match words included in the current website link, wherein retrieving, from the database, the total count number from each of the different keyword combinations, update the total count number by an increment of one, used the total count number as threat score denominator;
- fifth instructions configured to retrieve from the database, a number of previously received website links that partially match any word in the current website link and that were associated with fraudulent activity to be used as a threat score numerator wherein for each of the keyword combinations that partially matches the current website link, retrieve, from the database, the plurality of threat numbers update the threat numbers by an increment of one;
- sixth instructions configured to determine the probability that the current website link in question is associated with fraudulent activity by dividing the threat score numerator by the threat score denominator.
3 more elements
Dependencies are inferred from the claim text.