Anti-phishing protection

Patent metadata

Field	Value
Publication number	US-9774624-B2
Application number	US-201414299087-A
Country	US
Kind code	B2
Filing date	Jun 9, 2014
Priority date	Aug 16, 2005
Publication date	Sep 26, 2017
Grant date	Sep 26, 2017

Abstract

Anti-Phishing protection assists in protecting against phishing attacks. Any links that are contained within a message that has been identified as a phishing message are disabled. A warning message is shown when the phishing message is accessed. The first time a disabled link within the phishing message is selected a dismissible dialog box is displayed containing information about how to enable links in the message. After the user dismisses the dialog, clicking on a disabled link causes the warning message to flash drawing the user's attention to the potential severity of the problem. The links may be enabled by the user by selecting the warning message and choosing the appropriate option. Once the user enables the links, future displays of the message show the links as enabled.

First claim

What is claimed is:

1. A method executing on a computing device for protecting against phishing attacks, comprising:
receiving an unsolicited message including a link to an external source;
determining that the received message is likely a phishing message based at least in part on an analysis of a URL in the received message;
displaying a first warning indicating that the received message is the phishing message and that the link to the external source is disabled;
receiving a selection of the disabled link within the received message;
displaying a second warning indicating that the link is potentially unsafe;
receiving a dismissal of the second warning; and
activating the link; and
in response to activating the link, marking the message with a property, wherein the property indicates the link will be activated in future accesses of the received message.

2. The method of claim 1 , wherein the first warning is provided by a phishing filter interfacing with the computing device.

3. The method of claim 2 , wherein the phishing filter analyzes characteristics of the URLs contained within the received message to determine the probability that the received message is a phishing message.

4. The method of claim 2 , wherein the phishing filter provides at least one of a suspicious level and a neutral level.

5. The method of claim 1 , wherein the dismissal of the second warning maintains the link as selectable.

6. The method of claim 1 , wherein the first warning further comprises an indication that the received message further includes an image and wherein the link and the image are disabled independently.

7. A system for protecting against phishing attacks, comprising: a processing unit;
a computer-readable storage device; and
a filter component using the processing unit, the processing unit configured to:
receive an unsolicited message including a link to an external source;
determining that the received message is likely a phishing message based at least in part on an analysis of a URL in the received message;
display a first warning indicating that the received message is the phishing message and that the link to the external source is disabled;
receive a selection of the disabled link within the received message;
display a second warning indicating that the link is potentially unsafe;
receive a dismissal of the second warning; and
activate the link; and
in response to activating the link, marking the message with a property, wherein the property indicates the link will be activated in future accesses of the received message.

8. The system of claim 7 , wherein the first warning is provided by a phishing filter interfacing with the computing device.

9. The method of claim 8 , wherein the phishing filter analyzes characteristics of the URLs contained within the received message to determine the probability that the received message is a phishing message.

10. The method of claim 8 , wherein the phishing filter provides at least one of a suspicious level and a neutral level.

11. The method of claim 7 , wherein the dismissal of the second warning maintains the link as selectable.

12. The method of claim 7 , wherein the first warning further comprises an indication that the received message further includes an image and wherein the link and the image are disabled independently.

13. A computer-readable medium having computer-executable instructions that are executed on a computing device for protecting against phishing attacks, comprising:
receiving an unsolicited message including a link to an external source;
determining that the received message is likely a phishing message based at least in part on an analysis of a URL in the received message;
displaying a first warning indicating that the received message is the phishing message and that the link to the external source is disabled;
receiving a selection of the disabled link within the received message;
displaying a second warning indicating that the link is potentially unsafe;
receiving a dismissal of the second warning; and activating the link; and
in response to activating the link, marking the message with a property, wherein the property indicates the link will be activated in future accesses of the received message.

14. The system of claim 13 , wherein the first warning is provided by a phishing filter interfacing with the computing device.

15. The method of claim 14 , wherein the phishing filter analyzes characteristics of the URLs contained within the received message to determine the probability that the received message is a phishing message.

16. The method of claim 14 , wherein the phishing filter provides at least one of a suspicious level and a neutral level.

17. The method of claim 13 , wherein the dismissal of the second warning maintains the link as selectable.

18. The method of claim 13 , wherein the first warning further comprises an indication that the received message further includes an image and wherein the link and the image are disabled independently.

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Xavier Joseph
• Mitchell Aime M
• Tsang Brian J
• Herbert George A
• Savastano Hernan I
• Khandelwal Lubdha
• Pengelly Robert C J
• Novitskey Robert
• Grant Iii Stanley

Classifications

• H04L63/1483 Primary

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• G06Q10/107

  Computer-aided management of electronic mailing [e-mailing] · CPC title

• G06F21/562 Primary

  Static detection · CPC title