Methods and systems for implementing a phishing assessment

Patent metadata

Field	Value
Publication number	US-11140191-B2
Application number	US-201916673556-A
Country	US
Kind code	B2
Filing date	Nov 4, 2019
Priority date	Oct 29, 2015
Publication date	Oct 5, 2021
Grant date	Oct 5, 2021

Abstract

A system, method, and computer program product for implementing a phishing assessment of a target computer network that includes a phishing assessment platform for generating parameters for the phishing assessment; generating the phishing assessment parameters includes identifying a target domain name for the phishing assessment; identifying a pseudo domain name based on the target domain name; generating a pseudo web page using one or more features and attributes of an entity; and implementing the phishing assessment using the pseudo domain name and pseudo web page.

First claim

What is claimed is:

1. A method for testing a security of a computer system, the method comprising:
verifying the testing of the security of the computer system is authorized by a target entity;
generating a plurality of phishing domain names based on a legitimate domain name associated with the target entity;
rating each of the plurality of phishing domain names based on a visual similarity of the phishing domain name to the legitimate domain name;
selecting a phishing domain name of the plurality of phishing domain names based on a respective rating of the selected phishing domain name;
building one or more phishing communications using at least the selected phishing domain name; and
implementing, by one or more computer processors, a test phishing campaign against the computer system of the target entity, wherein the implementing comprises:
scaling a level of difficulty of the test phishing campaign based on the selecting of the phishing domain name according to a respective rating of the phishing domain name;
receiving one or more responses to the one or more phishing communications; and
collecting information based on the one or more responses.

2. The method according to claim 1 , wherein generating the phishing domain name includes:
selecting two or more distinct homoglyphic transformation techniques from a plurality of distinct homoglyphic transformation techniques; and
automatically generating the phishing domain name based on transforming the legitimate domain name using a combination of the two or more distinct homoglyphic transformation techniques.

3. The method according to claim 1 , further comprising:
selecting a plurality of phishing targets of the target entity;
setting one or more phishing communication vectors for each of the plurality of phishing targets,
wherein:
setting the one or more phishing communication vectors includes:
setting a first phishing communication vector, and
setting a second phishing communication vector that is distinct from the first phishing communication vector; and

building the one or more phishing communications includes:
building a first phishing communication for the first phishing communication vector, and
building a second phishing communication for the second phishing communication vector.

4. The method according to claim 3 , wherein
the first phishing communication is transmitted through the first phishing communication vector, and
the second phishing communication is transmitted through the second phishing communication vector.

5. The method according to claim 3 , wherein
the first phishing communication vector, working in concert with the second phishing communication vector, includes the first phishing communication that directs a distinct phishing target to the second phishing communication vector comprising the second phishing communication.

6. The method according to claim 1 , further comprising:
selecting a plurality of phishing targets of the target entity;
setting one or more phishing communication vectors for each of the plurality of phishing targets, wherein
setting one or more phishing communication vectors for each of the plurality of phishing targets includes:
identifying an optimal phishing communication vector for each of the plurality of phishing targets based on identifying a vector usage for each of the plurality of phishing targets; and
setting the optimal phishing communication vector as at least one of the one or more phishing communication vectors for each of the plurality of phishing targets.

7. The method according to claim 1 , further comprising:
setting a deployment schedule for deploying the test phishing campaign according to a spaced repetition technique that increases a length of time between distinct deployments of the test phishing campaign based on a successful identification by a distinct phishing target of the test phishing campaign.

8. The method according to claim 1 , wherein implementing the test phishing campaign includes implementing the test phishing campaign via a web-based software platform operable on a web server or a distributed computing system.

9. The method according to claim 1 , further comprising
authorizing an administrator to administer the test phishing campaign, wherein authorizing the administrator includes:
setting an expiring authorization for the administrator that limits a duration that the administrator can deploy the test phishing campaign.

10. The method according to claim 1 , further comprising:
setting a deployment schedule for deploying the test phishing campaign based on network communication metrics of the target entity, wherein the deployment schedule includes one or more deployment times that correspond to a highest computer network communication traffic period of the target entity.

11. The method according to claim 3 , further comprising:
setting a level of testing difficulty from a plurality of conditional levels of difficulty for the test phishing campaign.

12. The method of claim 11 , wherein:
setting the level of difficulty of the test phishing campaign is based on a sophistication classification of the plurality of phishing targets,
setting the level of difficulty of the test phishing campaign includes a first sophistication level when the sophistication classification is below a sophistication threshold, and
setting the level of difficulty of the test phishing campaign includes a second sophistication level when the sophistication classification satisfies or exceeds the sophistication threshold.

13. The method of claim 3 , further comprising:
setting a testing duration of the test phishing campaign to a predetermined period, wherein setting the testing duration includes randomly selecting a subset of the plurality of phishing targets to test via the test phishing campaign over predetermined sub-periods of the predetermined period until all phishing target of the plurality of phishing targets have been tested.

14. A system that tests for vulnerabilities in a computer network, the system comprising:
a phishing assessment computing server comprising one or more computer processors configured to test the computer network by:
verifying the testing of a security of the computer network is authorized by a target entity;
generating a plurality of phishing domain names based on a legitimate domain name associated with the target entity;
rating each of the plurality of phishing domain names based on a visual similarity of the phishing domain name to the legitimate domain name;
selecting a phishing domain name of the plurality of phishing domain names based on a respective rating of the selected phishing domain name;
building one or more phishing communications using at least the selected phishing domain name;
implementing a test phishing campaign against the computer network of the target entity, wherein the implementing comprises scaling a level of difficulty of the test phishing campaign based on the selecting of the phishing domain name according to a respective rating of the phishing domain name;
receiving one or more responses to the one or more phishing communications; and
collecting information based on the one or more responses.

15. One or more computer readable storage mediums comprising instructions that when executed configure hardware processing circuitry to perform operations that test a susceptibility of a computer network to a phishing attack, the operations comprising:
at a web-based software platform implemented by one or more web computing servers:
verifying the testing of a security of the computer netw

Assignees

• Duo Security Inc
• Cisco Tech Inc

Inventors

• Oberheide Jon

Classifications

• H04L63/1483

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L63/1491

  using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment · CPC title

• H04L63/105

  Multiple levels of security · CPC title