System and method for automated phishing detection rule evolution

Patent metadata

Field	Value
Publication number	US-9253208-B1
Application number	US-201514639871-A
Country	US
Kind code	B1
Filing date	Mar 5, 2015
Priority date	Mar 5, 2015
Publication date	Feb 2, 2016
Grant date	Feb 2, 2016

Abstract

System and method for automatically developing phishing detection rules. Based on detected phishing indicia, a quantitative score is computed for each of a plurality of predefined parameters, with each of the parameters relating to at least one of the phishing indicia. A requirement for evolving a phishing detection rule is assessed, and a new phishing detection rule is generated based on selected parameter scores meeting the rule evolution criteria and on corresponding content of the phishing indicia relating to those selected parameter scores. New phishing detection rules are applied recursively to detect phishing indicia, and more new rules can be further evolved in recursive fashion.

First claim

What is claimed is:

1. In a computing system that includes a processor, data storage, and input/output devices including a network interface device, a method for automatically developing detection rules, the method comprising:
(a) obtaining, by the computing system, incoming data directed to a destination;
(b) detecting, by the computing system, any indicia of phishing present in the incoming data, the detecting being performed by application of a plurality of phishing detection rules;
(c) computationally determining, by the computing system, a quantitative score for each of a plurality of predefined parameters, each of the parameters relating to at least one of the phishing indicia, and each quantitative score representing a likelihood of a presence of phishing content in the incoming data for the at least one of the phishing indicia;
(d) assessing, by the computing system, a requirement for evolving a phishing detection rule, including applying a predefined set of rule evolution criteria to a combination of the determined quantitative scores of a plurality of parameters;
(e) in response to an assessment of the requirement for evolving a phishing rule, generating, by the computing system, a new phishing detection rule based on selected parameter scores meeting the rule evolution criteria and on corresponding content of the phishing indicia relating to those selected parameter scores;
by the computing system, recursively performing (b)-(e) based on any new phishing detection rules having been evolved in (e);
identifying, by the computing system, any phishing-related objects based on selected parameter scores exceeding a phishing detection threshold and on corresponding content of the phishing indicia relating to those selected parameter scores;
modifying, by the computing system, content relating to the phishing-related objects in the incoming data to remove or reduce maliciousness of the phishing-related objects.

2. The method of claim 1 , wherein in obtaining the incoming data, the destination to which the incoming data is directed is a remote client computer system.

3. The method of claim 1 , wherein obtaining the incoming data includes intercepting incoming data prior to arrival of the incoming data at the destination.

4. The method of claim 1 , wherein detecting any indicia of phishing present in the incoming data includes emulating, in an isolated computing environment, any code that is present in the incoming data.

5. The method of claim 1 , further comprising:
categorizing, by the computing system, items of content of the intercepted data into a plurality of predefined categories representing different types of content, wherein each category is associated with a corresponding set of the parameters.

6. The method of claim 5 , wherein generating a new phishing detection rule includes re-categorizing certain items of content of the intercepted data into other categories, and applying phishing detection rules for those other categories to those certain items of content.

7. The method of claim 1 , wherein in computationally determining the quantitative score for each of the parameters, at least one quantitative score represents a result of application of a combination of different phishing detection rules to detect a related combination of phishing indicia.

8. The method of claim 1 , wherein the rule evolution criteria includes a first rule evolution threshold against which the combination of the determined quantitative scores are applied.

9. The method of claim 8 , wherein the first rule evolution threshold is different from the phishing detection threshold.

10. The method of claim 8 , wherein the first rule evolution threshold is the same as the phishing detection threshold.

11. The method of claim 8 , wherein the rule evolution criteria includes a second rule evolution threshold against which the combination of the determined quantitative scores are applied, the second rule evolution threshold being lower than the first rule evolution threshold, wherein the rule evolution criteria is met when any individual quantitative score of the combination exceeds the first rule evolution threshold, and wherein the rule evolution criteria is independently met when a specified plurality of quantitative scores of the combination exceeds the second rule evolution threshold.

12. The method of claim 1 , wherein the rule evolution criteria includes a rule evolution threshold against which the an aggregation of the determined quantitative scores of the combination are applied.

13. The method of claim 1 , wherein in recursively performing (b)-(e), multiple successive iterations of (b)-(e) are performed, and wherein each new phishing detection rule is applied to the same incoming data from a previous iteration.

14. A system for automatically developing detection rules for detecting phishing content, the system comprising:
a computing platform having a processor, data storage, and a network interface device the computing platform containing instructions that, when executed by the computing platform, cause the computing platform to implement:
a data capture engine configured to obtain incoming data directed to a destination;
a phishing content detection engine operatively coupled to the data capture engine and configured to detect any indicia of phishing present in the incoming data, the detection being based on application of a plurality of phishing detection rules, and to determine a quantitative score for each of a plurality of predefined parameters, each of the parameters relating to at least one of the phishing indicia, and each quantitative score representing a likelihood of a presence of phishing content in the incoming data for the at least one of the phishing indicia;
a rule development engine operatively coupled to the phishing content detection engine and configured to:
assess a requirement for evolving a phishing detection rule, based on application of a predefined set of rule evolution criteria to a combination of the determined quantitative scores of a plurality of parameters by the phishing content detection engine;
generate a new phishing detection rule based on selected parameter scores meeting the rule evolution criteria and on corresponding content of the phishing indicia relating to those selected parameter scores in response to an assessment of the requirement for evolving a phishing rule;
pass the new phishing detection rule to the phishing content detection engine to cause the phishing content detection engine to apply the new phishing detection rule to the incoming data;
recursively assess the requirement for evolving a phishing detection rule, and generate a new phishing rule in response to application of a new phishing detection rule to the incoming data;

a phishing content identifier engine operatively coupled to the phishing content detection engine and the rule development engine, and configured to identify any phishing-related objects based on selected parameter scores exceeding a phishing detection threshold and on corresponding content of the phishing indicia relating to those selected parameter scores; and
a modification engine configured to modify content relating to the phishing-related objects in the incoming data to remove or reduce maliciousness of the phishing-related objects.

15. The system of claim 14 , wherein the destination to which the incoming data is directed is the computing platform.

16. The system of claim 14 , wherein the data capture engine is part of a proxy.

17. The system of claim 14 , wherein the data capture engine is implem

Assignees

• Kaspersky Lab Zao
• AO Kaspersky Lab

Inventors

• Koshelev Maxim G

Classifications

• G06F17/30598

  Physics · mapped topic

• H04L63/0263

  Rule management · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/0245

  Filtering by information in the payload · CPC title

• H04L63/14

  for detecting or protecting against malicious traffic · CPC title