Back to results
US 8,990,933 B1Granted
Securing networks against spear phishing attacks
AssigneeIntuit Inc.
InventorVladimir Magdalin
Life of this patent
Estimating the term…
Abstract
The disclosed embodiments provide a system that secures a network. During operation, the system obtains a request for a resource from a client connected to the network. Next, the system uses a domain name from the request to obtain one or more properties associated with the domain name and assesses a level of risk associated with the domain name based on the one or more properties. Finally, the system processes the request based on the assessed level of risk.
Claims17
A computer-implemented method for securing a network, comprising:
- obtaining a request for a resource from a client connected to the network;
- using a domain name from the request to obtain one or more properties associated with the domain name, wherein the one or more properties comprise a visual representation of the resource, and wherein obtaining the visual representation of the resource involves:
- transmitting a request for the resource over an external network;
- receiving the resource;
- and
- generating a rendered screenshot of the received resource;
- assessing, by computer, a level of risk associated with the domain name based on the one or more properties, wherein assessing the level of risk involves:
- performing a reverse image search by comparing the rendered screenshot to a database of rendered screenshots of websites, each of the websites associated with a different domain name that is different from the domain name from the request;
- determining the level of risk based on the reverse image search;
- and
- calculating the level of risk as a sum of numerical risk values associated with the one or more properties;
- and
- processing the request based on the assessed level of risk.
10 more elements
A system for securing a network, comprising:
- a processor;
- a memory storing instructions that are executable by the processor, the instructions comprising:
- instructions for obtaining a request for a resource from a client connected to the network;
- instructions for using a domain name from the request to obtain one or more properties associated with the domain name, wherein the one or more properties comprise a visual representation of the resource, and
- wherein obtaining the visual representation of the resource involves:
- transmitting a request for the resource over an external network;
- receiving the resource;
- and
- generating a rendered screenshot of the received resource;
- and
- instructions for assessing a level of risk associated with the domain name based on the one or more properties, wherein assessing the level of risk involves:
- performing a reverse image search by comparing the rendered screenshot to a database of rendered screenshots of websites each of the websites associated with a different domain name that is different from the domain name from the request;
- determining the level of risk based on the reverse image 24 search;
- and
- calculating the level of risk as a sum of numerical risk values associated with the one or more properties;
- and
- instructions for processing the request based on the assessed level of risk.
14 more elements
A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for securing a network, the method comprising:
- obtaining a request for a resource from a client connected to the network;
- using a domain name from the request to obtain one or more properties associated with the domain name, wherein the one or more properties comprise a visual representation of the resource, and wherein obtaining the visual representation of the resource involves:
- transmitting a request for the resource over an external network;
- receiving the resource;
- and
- generating a rendered screenshot of the received resource;
- assessing a level of risk associated with the domain name based on the one or more properties, wherein assessing the level of risk involves:
- performing a reverse image search by comparing the rendered screenshot to a database of rendered screenshots of websites, each of the websites associated with a different domain name that is different from the domain name from the request;
- determining the level of risk based on the reverse image search;
- and
- calculating the level of risk as a sum of numerical risk values associated with the one or more properties;
- and
- processing the request based on the assessed level of risk.
10 more elements
Dependencies are inferred from the claim text.