FIELD

The present disclosure is of a system for prevention of phishing attacks and more specifically for a phishing detection system featuring real time retrieval, analysis and assessment of phishing webpages.

BACKGROUND

Phishing aims to convince users to reveal their personal information and/or credentials. Phishers can then use the revealed information to gain access to user accounts or to impersonate the phished user. While other phishing attack vectors exist, such as forged emails, or HTML file attachments, the majority of phishing attacks start with a URL. The phishing URL is usually presented as a link in a message received by a potential victim and social engineering is used to convince the recipient to follow the link.

Multiple approaches and systems have been developed to protect users from phishing. Many of these rely on determining whether a URL leads to a phishing page including (1) semantic analysis of the URL, (2) analysis of the webpage that the URL resolves to, and (3) statistical analysis of the URLs.(1) Semantic analysis of the words within the URL relies on looking for known retail or financial brands in the URL itself or detecting characters using different encoding. This method is not effective since many phishing URLs simply use random characters that have no relation to the brand being impersonated. For example, the phishing page shown inFIG. 3Aincludes a URL302that does not mention PayPal (the impersonated brand in this case). Further, many phishing sites are “multi-brand” looking to steal credentials for any one of a number of target sites on the same phishing webpage and using generic HTTP headers and URLs that evade such methods.(2) Current phishing webpage analysis techniques are also lacking. Techniques used include: Semantic searches for brand names or keywords (such as login and password) in webpage elements; Looking for links to legitimate domains or elements fetched from other websites; Looking for hidden iframes; Detecting the absence of a favicon; Comparing a hash of the suspected phishing page to a hash of a legitimate phishing target page. These techniques are known to phishing page creators and are easily evaded. For example, phishing pages do include favicons, and hashing techniques can be evaded by making small changes that alter the hash but are not visible to potential victims viewing the page.(3) Statistical analysis of URLs—such as counting the number of times the same URL is seen in different messages, does not work when the attacker uses mass customization techniques to create “front URLs” where the URL for each potential victim (or groups of potential victims), is slightly varied creating thousands of unique new URL links pointing to the same phishing site. Also, simple counting may not be sufficient to identify targeted phishing attacks, as small numbers of link URLs will not provide enough statistical relevance to confirm a phishing site.

A further difficulty is in the actual resolution of the phishing URL. Centralized analysis by a security provider from the security provider data center allows the attacker to evade detection by identifying known security provider IP address ranges and ignoring the URL requests—resulting in the security provider dismissing the URL as a “dead link”. Alternatively the attacker can return a benign response to the security provider that is simply different to what they return to potential victims—again resulting in incorrect classification of a phishing URL as benign. A further evasion technique includes presenting different webpages to different browser types allowing phishers to target specific user types (mobile, desktop).

Another problem of existing phishing detection systems is the time taken to detect phishing sites. Many phishing detection systems begin analysis of a URL only when a user actually clicks on the URL. Where a URL is unknown (has not been seen or analyzed before) many prior art systems will allow the user to visit the URL, rather than disrupt the user's browsing experience. In parallel with the user browsing, the URL and/or webpage will be analyzed using methods as described above. Because this analysis takes time (typically minutes or hours) the “first victim”, or even multiple victims are not protected while their phishing page access is used to learn for future users.

It would be advantageous to have a phishing detection and protection system that uses improved analysis methods to overcome the evasiveness of current phishing sites. It would further be useful for the phishing analysis system to retrieve the suspect webpage using the IP address of the recipient to ensure correct resolution. Finally a phishing detection solution should ideally protect all users from actually receiving phishing URLs.

SUMMARY

The present disclosure overcomes the deficiencies of the background art by providing a phishing analysis system that uses improved analysis methods to overcome the evasiveness of current phishing sites. The solution operates from within the user environment so as to resolve suspected sites from the same IP address ranges as used by actual recipients. Further, the system as described herein provides a near real time URL inspection service that removes already-delivered emails with URLs from the messaging inboxes or message lists of users (before these are opened) such that the users are never exposed to the links and therefore do not click on them.

Improved phishing webpage retrieval and analysis methods as described herein include:Computing webpage fingerprints for multiple HTML page elements and comparing these webpage fingerprints to existing webpage fingerprints of known phishing page targets and known phishing sites;Performing image analysis and comparison of the page favicon to favicons known to be used in phishing pages and also genuine favicons of known phishing page targets;Performing machine learning based image analysis and comparison of the webpage or parts of the webpage to known phishing pages or genuine webpages or parts of genuine webpages of known phishing page targets/brands;Performing analysis of the webpage CSS and comparison of the webpage CSS to the CSS of known phishing pages or genuine webpages of known phishing page brands/targets;Performing machine learning based image analysis of images found on webpage150aiming to match the images to known genuine phishing target logos;Performing machine learning based analysis of the language used on the webpage.

The neural network analysis is based on one or more of word counting, term frequency—inverse document frequency, or cluster counting of GloVe (Global Vectors for Word Representation);Performing analysis of any web form for credential submission in the page;Fetching the webpage using multiple source IP addresses including from within the user address range;Fetching the webpage using multiple user agents (browser types)Attempting Multiple times to resolve the webpage over a configurable period of time to detect phishing pages that are intentionally kept offline following delivery and brought online after a few minutes or hours;

According to at least some embodiments of the present disclosure a method for detecting a phishing message comprises: providing a phishing detector comprising a scan engine and a fetcher; detecting a URL in the message by the scan engine; resolving the URL to a webpage by the scan engine; downloading the webpage by the fetcher; analysis of the downloaded webpage by the fetcher to determine whether the webpage is a phishing webpage; wherein when the webpage is determined to be a phishing webpage, deleting the message by the scan engine.

In some embodiments, the analysis is selected from the group consisting of: performing analysis of the CSS of the webpage and comparison of the webpage CSS to the CSS of known phishing pages or genuine webpages of known phishing page brands/targets; performing machine learning based image analysis of images found on the webpage to match the images to known genuine phishing target logos; performing analysis of web forms for credential submission on the webpage; and a combination of the above.

In some embodiments, the analysis comprises analyzing the HTML structure and HTML code for similarities to known phishing kits. In some embodiments, the analysis is selected from the group consisting of: computing webpage fingerprints for multiple HTML page elements and comparing the webpage fingerprints to existing webpage fingerprints of known phishing page targets and known phishing sites; performing image analysis and comparison of the page favicon of the webpage to favicons known to be used in phishing pages and also genuine favicons of known phishing page targets; performing machine learning based image analysis and comparison of the webpage or parts of the webpage to known phishing pages or genuine webpages or parts of genuine webpages of known phishing page targets/brands; and a combination of the above.

In some embodiments, the analysis comprises performing machine learning based analysis of the language used on the webpage. In some embodiments, the method for the downloading of the webpage is selected from the group consisting of: the webpage is downloaded multiple times each using a different source IP address; the webpage is downloaded using the an IP address from the message recipient IP address range; the webpage is downloaded using multiple user agents; and a combination of the above.

In some embodiments, the machine learning based analysis of the webpage language is based on one or more of word counting, term frequency—inverse document frequency, or cluster counting of GloVe (Global Vectors for Word Representation). In some embodiments, the method of claim1further comprises URL analysis by the scan engine for one or more of suspicious characteristics, URL metadata, or suspicious URLs. In some embodiments, the method for the downloading of the webpage comprises: by the fetcher, executing redirect code to resolve the destination web page.

In some embodiments, the method for the downloading of the webpage comprises: when the URL does not resolve, attempting multiple times to resolve the webpage over a configurable period of time until the webpage can be downloaded. In some embodiments, the webpage is downloaded using an IP address from the message recipient IP address range. In some embodiments, site content that is encrypted or obfuscated is decrypted and executed in order to generate the page HTML.

According to at least some embodiments of the present disclosure a system for detecting a phishing message comprises: a scan engine; and a fetcher; wherein the scan engine is adapted to detect a URL in the message and resolve the URL to a webpage; wherein the fetcher is adapted to download the webpage and analyze the downloaded webpage to determine whether the webpage is a phishing webpage; wherein when the webpage is determined to be a phishing webpage, the message is deleted by the scan engine. In some embodiments, the analyzing is selected from the group consisting of: computing webpage fingerprints for multiple HTML page elements and comparing the webpage fingerprints to existing webpage fingerprints of known phishing page targets and known phishing sites; performing image analysis and comparison of the page favicon of the webpage to favicons known to be used in phishing pages and also genuine favicons of known phishing page targets; performing machine learning based image analysis and comparison of the webpage or parts of the webpage to known phishing pages or genuine webpages or parts of genuine webpages of known phishing page targets/brands; performing analysis of the CSS of the webpage and comparison of the webpage CSS to the CSS of known phishing pages or genuine webpages of known phishing page brands/targets; performing machine learning based image analysis of images found on the webpage to match the images to known genuine phishing target logos; performing machine learning based analysis of the language used on the webpage; performing analysis of web forms for credential submission on the webpage; and a combination of the above.

In some embodiments, the downloading of the webpage is selected from the group consisting of: the webpage is downloaded multiple times each using a different source IP address; the webpage is downloaded using the an IP address from the message recipient IP address range; the webpage is downloaded using multiple user agents; when the URL does not resolve, attempting multiple times to resolve the webpage over a configurable period of time until the webpage can be downloaded; and a combination of the above.

According to at least some embodiments of the present disclosure a method for detecting a phishing message comprises: providing a phishing detector comprising a scan engine and a fetcher; detecting a URL in the message by the scan engine; resolving the URL to a webpage by the scan engine; downloading the webpage by the fetcher; analysis of the downloaded webpage by the fetcher to determine whether the webpage is a phishing webpage; wherein when the webpage is determined to be a phishing webpage, deleting the message by the scan engine.

In some embodiments, the analysis is selected from the group consisting of: computing webpage fingerprints for multiple HTML page elements and comparing the webpage fingerprints to existing webpage fingerprints of known phishing page targets and known phishing sites; performing image analysis and comparison of the page favicon of the webpage to favicons known to be used in phishing pages and also genuine favicons of known phishing page targets; performing machine learning based image analysis and comparison of the webpage or parts of the webpage to known phishing pages or genuine webpages or parts of genuine webpages of known phishing page targets/brands; performing analysis of the CSS of the webpage and comparison of the webpage CSS to the CSS of known phishing pages or genuine webpages of known phishing page brands/targets; performing machine learning based image analysis of images found on the webpage to match the images to known genuine phishing target logos; performing machine learning based analysis of the language used on the webpage; performing analysis of web forms for credential submission on the webpage; and a combination of the above.

In some embodiments, the method for the downloading of the webpage is selected from the group consisting of: the webpage is downloaded multiple times each using a different source IP address; the webpage is downloaded using the an IP address from the message recipient IP address range; the webpage is downloaded using multiple user agents; when the URL does not resolve, attempting multiple times to resolve the webpage over a configurable period of time until the webpage can be downloaded; and a combination of the above. In some embodiments, the machine learning based analysis of the webpage language is based on one or more of word counting, term frequency—inverse document frequency, or cluster counting of GloVe (Global Vectors for Word Representation).

According to at least some embodiments of the present disclosure a system for detecting a phishing message comprises: a scan engine; and a fetcher; wherein the scan engine is adapted to detect a URL in the message and resolve the URL to a webpage; wherein the fetcher I adapted to download the webpage and analyze the downloaded webpage to determine whether the webpage is a phishing webpage; wherein when the webpage is determined to be a phishing webpage, the message is deleted by the scan engine.

In some embodiments, the analyzing is selected from the group consisting of: computing webpage fingerprints for multiple HTML page elements and comparing the webpage fingerprints to existing webpage fingerprints of known phishing page targets and known phishing sites; performing image analysis and comparison of the page favicon of the webpage to favicons known to be used in phishing pages and also genuine favicons of known phishing page targets; performing machine learning based image analysis and comparison of the webpage or parts of the webpage to known phishing pages or genuine webpages or parts of genuine webpages of known phishing page targets/brands; performing analysis of the CSS of the webpage and comparison of the webpage CSS to the CSS of known phishing pages or genuine webpages of known phishing page brands/targets; performing machine learning based image analysis of images found on the webpage to match the images to known genuine phishing target logos; performing machine learning based analysis of the language used on the webpage; performing analysis of web forms for credential submission on the webpage; and a combination of the above.

In some embodiments, the downloading of the webpage is selected from the group consisting of: the webpage is downloaded multiple times each using a different source IP address; the webpage is downloaded using the an IP address from the message recipient IP address range; the webpage is downloaded using multiple user agents; when the URL does not resolve, attempting multiple times to resolve the webpage over a configurable period of time until the webpage can be downloaded; and a combination of the above. In some embodiments, the machine learning based analysis of the webpage language is based on one or more of word counting, term frequency—inverse document frequency, or cluster counting of GloVe (Global Vectors for Word Representation).

The term phishing as used herein refers to a cyber-attack that aims to steal user personally identifiable information (PII) or user credentials or user financial information—by tricking the user into willingly disclosing this information. Phishing sites typically “impersonate” sites of well-known brands. These well-known brands are also referred to herein as target brands, or phishing brands. Non-limiting examples of brands that are typically phished include: PayPal, Apple (iCloud), banking sites, Gmail, Yahoo mail, and so forth.

The term URL (Uniform Resource Locator) as used herein may also refer to a web link and includes a domain and optionally subdomain and other information necessary to lead a user to a resource or page on a web server. A URL is resolved as known in the art to determine the IP address of the web site or webpage.

The term “user” as used herein refers to an end user of a messaging network such as an email system or social network wherein the end user receives and sends email messages via the email system or social network messages via the social network. Non-limiting examples of private messaging networks or social networks include Facebook™ WhatsApp™, Slack™, Outlook365™, SalesForce™ and so forth.

The term “malware” as used herein describes any form of malicious or intrusive software, including computer viruses, worms, Trojan horses, rootkits, backdoors, ransomware, spyware, adware, scareware, malicious objects, and other malicious programs, and these terms may be used interchangeably herein. Malware as used herein may be in the form of executable code, scripts, active content, and other software. Antivirus (AV) may also be referred to as anti-malware and the terms may be used interchangeably herein.

As used herein the terms “machine learning” (ML) or “artificial intelligence” (AI) refer to use of algorithms on a computing device that parse data, learn from this data, and then make a determination, where the determination is not deterministically replicable (such as with deterministically oriented software as known in the art).

Implementation of the method and system of the present disclosure involves performing or completing certain selected tasks or steps manually, automatically, or a combination thereof. Moreover, according to actual instrumentation and equipment of preferred embodiments of the method and system of the present disclosure, several selected steps could be implemented by hardware or by software on any operating system of any firmware or a combination thereof. For example, as hardware, selected steps of the disclosure could be implemented as a chip or a circuit. As software, selected steps of the disclosure could be implemented as a plurality of software instructions being executed by a computer using any suitable operating system. In any case, selected steps of the method and system of the disclosure could be described as being performed by a data processor, such as a computing platform for executing a plurality of instructions.

Although the present disclosure is described with regard to a “computer” on a “computer network”, it should be noted that optionally any device featuring a data processor and the ability to execute one or more instructions may be described as a computer, computing device, or mobile computing device, or user device including but not limited to any type of personal computer (PC), a server, a cellular telephone, an IP telephone, a smartphone, a PDA (personal digital assistant), or a pager. A server as used herein may refer to any of a single server, multiple servers, distributed servers, virtual servers, or cloud computing environment. Any two or more of such devices, as listed above, in communication with each other may optionally form a computer network.

