Method of detecting potential phishing by analyzing universal resource locators
AssigneeAT&T Intellectual Property I, L.P.
InventorsJunlan Feng, Valerie Torres, Daniel G. Sheleheda
Life of this patent
Estimating the term…
Abstract
A method for detecting potential phishing URLs includes extracting a URL from a document, analyzing the URL context, and comparing the URL to stored trusted URLs and stored known phishing URLs. The URL context includes anchor text and surrounding content associated with the URL. The method further includes generating a phishing alert based on the comparing and the analyzing.
Claims20
A system comprising:
- a memory that stores instructions;
- a processor that executes the instructions to perform operations, the operations comprising:
- determining an encoded distance between a first character of a hostname of a universal resource locator and a next character of the hostname of the universal resource locator, wherein the encoded distance is an integral distance between the first character and the next character in a machine encoding;
- determining if the encoded distance exceeds a first threshold value;
- adding the encoded distance to a hostname distance if the encoded distance is determined to not exceed the first threshold value, wherein the hostname distance is a sum of encoded distances between consecutive pairs of characters of the hostname;
- and
- transmitting a first notification that indicates that the universal resource locator is associated with phishing if the hostname distance is determined to exceed a threshold hostname distance value.
A method comprising:
- calculating an encoded distance between a first character of a hostname of a universal resource locator and a next character of the hostname of the universal resource locator, wherein the encoded distance is an integral distance between the first character and the next character in a machine encoding;
- determining, by utilizing instructions from memory that are executed by a processor, if the encoded distance exceeds a first threshold value;
- adding the encoded distance to a hostname distance if the encoded distance is determined to not exceed the first threshold value, wherein the hostname distance is a sum of encoded distances between consecutive pairs of characters of the hostname;
- and
- generating a first notification that indicates that the universal resource locator is associated with phishing if the hostname distance is determined to exceed a threshold hostname distance value.
A computer-readable device comprising instructions, which, when loaded and executed by a processor, cause the processor to perform operations, the operations comprising:
- calculating an encoded distance between a first character of a hostname of a universal resource locator and a next character of the hostname of the universal resource locator, wherein the encoded distance is an integral distance between the first character and the next character in a machine encoding;
- determining if the encoded distance exceeds a first threshold value;
- adding the encoded distance to a hostname distance if the encoded distance is determined to not exceed the first threshold value, wherein the hostname distance is a sum of encoded distances between consecutive pairs of characters of the hostname;
- and
- providing a first notification that indicates that the universal resource locator is associated with phishing if the hostname distance is determined to exceed a threshold hostname distance value.
Dependencies are inferred from the claim text.