Granted Patent B1

US 10,601,865 · App. 14/872,016 · Granted Mar 24, 2020

Abstract

Claims (45)

1. A non-transitory computer readable storage medium having stored thereon instructions, the instructions being executable by one or more processors to perform operations including:

responsive to receiving an email including a Uniform Resource Locator (URL), conducting a static analysis of the email including:

(i) analyzing a header and a body of the email, and

(ii) analyzing the URL included in the email;

processing, within a virtual machine, the email by (i) providing, within the virtual machine, credential information to a web page directed to by the URL thereby generating a POST request, (ii) determining attributes of the POST request, and (iii) correlating the attributes of the POST request with a domain indicated by information included in the body of the email;

generating a first score indicating a first level of confidence indicating that the email is associated with a phishing attack based on the processing of the email within the virtual machine; and

responsive to the first score being below a first threshold, determining the email is associated with the phishing attack.

2. The computer readable storage medium of claim 1 further comprising:

generating a second score representing a second level of confidence indicating the email is associated with the phishing attack based on (i) the processing of the web page and (ii) at least one of the analysis of the email or the analysis of the contents of the web page.

3. The computer readable storage medium of claim 2 , wherein the phishing attack is a credential spearphishing attack.

4. The computer readable storage medium of claim 1 , wherein the analyzing of the header of the email includes extracting key attributes and correlating the extracted key attributes with known malicious actors, and

the analysis of the body of the email includes extracting and correlating at least one of one or more input forms, a location of the URL, text or an image detected in the body of the email with attributes known to be associated with a phishing attack.

5. The computer readable storage medium of claim 1 , wherein the analyzing of the URL includes at least one of a determination of an existence of a typographical error in the URL compared to predefined URLs, a correlation between a domain of the URL and content information or header attributes of the email, or a correlation between the domain and a subdomain of the URL.

6. The computer readable storage medium of claim 1 , wherein the analyzing of the contents of the web page includes extracting and correlating at least one of a server delivering the web page, metadata of the server, or whether a secure connection is used to deliver the email with one or more attributes extracted from the header or body of the email.

7. The computer readable storage medium of claim 1 , wherein subsequent to detecting an image of the web page during processing of the email, the static analysis further includes performing a correlation between the image detected on the web page with one or more stored images of predetermined companies.

8. The computer readable storage medium of claim 1 , wherein the processing of the web page includes processing HyperText Markup Language (HTML) source code of the web page in one or more virtual machines, wherein the one or more virtual machines are configured based on at least one of the analysis of the email or the analysis of the contents of the web page.

9. The computer readable storage medium of claim 8 , wherein the processing in the one or more virtual machines includes (i) generating a POST request by submitting data in one or more input fields of the web page and recording the generated POST request, and (ii) determining a first domain to which the POST request was being transmitted.

10. The computer readable storage medium of claim 9 , wherein the HTML source code is included within obfuscated network traffic and, prior to processing the HTML source, the obfuscated network traffic is deobfuscated.

11. An apparatus for detecting an association of an email with a phishing attack, the apparatus comprising:

one or more processors;

a storage device communicatively coupled to the one or more processors and having logic stored thereon including:

an email analysis logic to extract and correlate attributes of a header and a body of the email with one or more lists defining attributes known to be associated with the phishing attack;

a dynamic analysis logic including one or more virtual machines for conducting an analysis of the email by (i) providing, within a virtual machine, credential information to a web page directed to by a URL detected in the email thereby generating a POST request, (ii) determining attributes of the POST request, and (iii) correlating the attributes of the POST request with a domain indicated by information included in the body of the email; and

a score determination logic for determining a likelihood of the email being associated with the phishing attack.

12. The apparatus of claim 11 , further comprising:

a web page analysis logic for performing a screen shot analysis of a web page directed to by the URL,

wherein the screen shot analysis includes at least one of (i) a correlation between an image detected on the web page with one or more stored images of predetermined companies, or (ii) a correlation between text detected on the web page with stored text or a logo associated with one or more predetermined companies.

13. The apparatus of claim 12 , wherein the web page analysis logic extracts and correlates information of a server delivering the web with one or more attributes extracted from the header or the body of the email.

14. A method for detecting an association of an email with a phishing attack comprising:

receiving HyperText Markup Language (HTML) source code of a web page associated with a Uniform Resource Locator (URL) detected in the email; and

processing the HTML source code in a virtual machine, the processing including:

detecting a URL to a POST request on the web page,

generating a POST request by automatically simulating submitting content in an input form detected on the web page,

capturing the POST request and determining a target domain, the target domain being a first domain to which the POST request was being transmitted, and

determining whether the target domain is the same as a victim domain.

15. The method of claim 14 further comprising:

responsive to determining the victim domain is the same as the target domain, determining the web page is not associated with a phishing attack.

16. The method of claim 14 further comprising:

responsive to determining the victim domain is not the same as the target domain, applying at least one of a heuristic algorithm, a probabilistic algorithm or a machine learning algorithm to determine whether the web page is associate with a phishing attack.

17. The method of claim 16 further comprising:

determining a likelihood that the web page is associated with a phishing attack, wherein the determination of the likelihood is based on one or more of (i) a static analysis of the email, (ii) the determination the victim domain is not the same as the target domain, or (iii) the application of at least one of the heuristic algorithm, the probabilistic algorithm or the machine learning algorithm.

18. The method of claim 14 , wherein the target domain is determined by (i) extracting a link from an image detected on the web page, and (ii) utilizing an image search application programming interface (API) to determine a domain that hosts the image.

19. The method of claim 14 further comprising:

prior to processing the HTML source code, deobfuscating the HTML source code, wherein the HTML source code was received in an obfuscated manner.

20. The method of claim 14 , wherein the virtual machine is configured based on at least one of a static analysis of the email or a static analysis of the HTML source code of the web page.

Assignments (12)