# US 9,521,165 B2 · Method of detecting potential phishing by analyzing universal resource locators

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,521,165 B2
- Document ID: US9521165B2
- Status: Granted
- Kind: B2
- Application number: 14/728,286
- Filed: 2015-06-02
- Published: 2015-09-17
- Granted: 2016-12-13
- Earliest claimed: 2009-06-05
- Assignees: AT&T Intellectual Property I, L.P.
- Applicants: AT&T Intellectual Property I, L.P.
- Inventors: Junlan Feng; Valerie Torres; Daniel G. Sheleheda
- Web page: https://patentgrep.com/patent/US9521165B2

## CPC

- H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)}
- G06F 16/9566: {URL specific, e.g. using aliases, detecting broken or misspelled links}
- G06F 21/554: {involving event detection and direct action}
- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- H04L 63/0245: {Filtering by information in the payload}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46)
- G06F 2221/2101: Auditing as a secondary aspect
- G06F 2221/2119: Authenticating web pages, e.g. with suspicious links
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A method for detecting potential phishing URLs includes extracting a URL from a document, analyzing the URL context, and comparing the URL to stored trusted URLs and stored known phishing URLs. The URL context includes anchor text and surrounding content associated with the URL. The method further includes generating a phishing alert based on the comparing and the analyzing.

## Claims

### Claim 1

A system comprising:
a memory that stores instructions;
a processor that executes the instructions to perform operations, the operations comprising:
determining an encoded distance between a first character of a hostname of a universal resource locator and a next character of the hostname of the universal resource locator, wherein the encoded distance is an integral distance between the first character and the next character in a machine encoding;
determining if the encoded distance exceeds a first threshold value;
adding the encoded distance to a hostname distance if the encoded distance is determined to not exceed the first threshold value, wherein the hostname distance is a sum of encoded distances between consecutive pairs of characters of the hostname; and
transmitting a first notification that indicates that the universal resource locator is associated with phishing if the hostname distance is determined to exceed a threshold hostname distance value.

### Claim 2 (depends on 1)

The system of claim 1, wherein the operations further comprise transmitting a second notification that indicates that the universal resource locator is associated with phishing if the encoded distance is determined to exceed the first threshold value.

### Claim 3 (depends on 1)

The system of claim 1, wherein the operations further comprise determining if the hostname distance exceeds the threshold hostname distance value.

### Claim 4 (depends on 1)

The system of claim 1, wherein the operations further comprise enabling access to the universal resource locator if the hostname distance is determined to not exceed the threshold hostname distance value.

### Claim 5 (depends on 1)

The system of claim 1, wherein the operations further comprise calculating a word value for a first word in the universal resource locator.

### Claim 6 (depends on 5)

The system of claim 5, wherein the operations further comprise identifying a second word from a white list that is similar to the first word in the universal resource locator.

### Claim 7 (depends on 6)

The system of claim 6, wherein the operations further comprise determining an edit distance between the first word and the second word.

### Claim 8 (depends on 7)

The system of claim 7, wherein the operations further comprise determining the edit distance by determining a number of changes required to change the first word into the second word.

### Claim 9 (depends on 6)

The system of claim 6, wherein the operations further comprise determining if the edit distance is below a second threshold value.

### Claim 10 (depends on 9)

The system of claim 9, wherein the operations further comprise transmitting an alert if the edit distance is below the second threshold value.

### Claim 11

A method comprising:
calculating an encoded distance between a first character of a hostname of a universal resource locator and a next character of the hostname of the universal resource locator, wherein the encoded distance is an integral distance between the first character and the next character in a machine encoding;
determining, by utilizing instructions from memory that are executed by a processor, if the encoded distance exceeds a first threshold value;
adding the encoded distance to a hostname distance if the encoded distance is determined to not exceed the first threshold value, wherein the hostname distance is a sum of encoded distances between consecutive pairs of characters of the hostname; and
generating a first notification that indicates that the universal resource locator is associated with phishing if the hostname distance is determined to exceed a threshold hostname distance value.

### Claim 12 (depends on 11)

The method of claim 11, further comprising transmitting a second notification that indicates that the universal resource locator is associated with phishing if the encoded distance is determined to exceed the first threshold value.

### Claim 13 (depends on 11)

The method of claim 11, further comprising enabling access to the universal resource locator if the hostname distance is determined to not exceed the threshold hostname distance value.

### Claim 14 (depends on 11)

The method of claim 11, further comprising calculating a word value for a first word in the universal resource locator.

### Claim 15 (depends on 14)

The method of claim 14, further comprising determining an edit distance between the first word and a second word that is identified from a list as being similar to the first word.

### Claim 16 (depends on 15)

The method of claim 15, further comprising determining if the edit distance is below a second threshold value.

### Claim 17 (depends on 16)

The method of claim 16, further comprising triggering an event if the edit distance is below the second threshold value.

### Claim 18

A computer-readable device comprising instructions, which, when loaded and executed by a processor, cause the processor to perform operations, the operations comprising:
calculating an encoded distance between a first character of a hostname of a universal resource locator and a next character of the hostname of the universal resource locator, wherein the encoded distance is an integral distance between the first character and the next character in a machine encoding;
determining if the encoded distance exceeds a first threshold value;
adding the encoded distance to a hostname distance if the encoded distance is determined to not exceed the first threshold value, wherein the hostname distance is a sum of encoded distances between consecutive pairs of characters of the hostname; and
providing a first notification that indicates that the universal resource locator is associated with phishing if the hostname distance is determined to exceed a threshold hostname distance value.

### Claim 19 (depends on 18)

The computer-readable device of claim 18, wherein the operations further comprise triggering an event if the encoded distance is determined to exceed the first threshold value.

### Claim 20 (depends on 18)

The computer-readable device of claim 18, wherein the operations further comprise enabling access to the universal resource locator if the hostname distance is determined to not exceed the threshold hostname distance value.