System and method for anti-phishing system
View Patent ↗A system and method for detecting a phishing site is disclosed. A message from a client to the site is intercepted by a security gateway. The security gateway determines if the site is a known-site or an unknown-site. If it is a known site, a reputation of the site is checked. If the site is a known-site with a bad reputation, connection between the client and the site is reset. If the site is a known-site with a good reputation, known-site testing is performed for possible phishing attack. If the site is an unknown-site, unknown-site testing for possible phishing attack is performed.
1. A method for detecting a phishing site, comprising:
intercepting, by a security gateway, a message from a client to a site;
determining, by the security gateway, if the site is a known-site or an unknown-site;
checking, by the security gateway, reputation of the site, and
if the site is a known-site with a good reputation, performing, by the security gateway, known-site testing for possible phishing attack, wherein, the known-site testing includes:
identifying a page of the site being accessed;
determining if a reputation for the page of the site being accessed is known or unknown; and
if the reputation for the page of the site being accessed is unknown, performing an unknown page testing for possible phishing attack, wherein, the unknown page testing including:
generating a page risk score for the page;
comparing the page risk score with a threshold value; and
if the page risk score is greater than the threshold value, performing additional risk assessment, wherein, the additional risk assessment including:
determining claims made on the page;
determining claims made on the site;
comparing claims made on the page with claims made on the site for a match; and
if there is a match, forwarding the message from the client to the site.
2. The method of claim 1 , wherein,
if the page risk score is less than or equal to a threshold value, forwarding the message from the client to the site.
3. The method of claim 1 , wherein, if there is no match, performing additional testing of the page for possible phishing activity.
4. The method of claim 1 , wherein claims made on the page includes one or more of copyright notice, patent owned and company name.
5. A system for detecting a phishing site, comprising:
a security gateway configured to
intercept a message from a client to a site;
determine if the site is a known-site or an unknown-site; and
if the site is known-site with a good reputation, perform a known-site test for possible phishing attack, wherein, the known-site test including:
identify a page of the site being accessed;
determine if a reputation for the page of the site being accessed is known or unknown; and
if the reputation for the page of the site being accessed is unknown, perform an unknown page test for possible phishing attack, wherein, the unknown page test including:
generate a page risk score for the page;
compare the page risk score with a threshold value; and
if the page risk score is greater than the threshold value, perform additional risk assessment, wherein, the additional risk assessment includes:
determine claims made on the page;
determine claims made on the site;
compare claims made on the page with claims made on the site for a match; and
if there is a match, forward the message from the client to the site.
6. The system of claim 5 , wherein, if the page risk score is less than or equal to a threshold value, forward the message from the client to the site.
7. The system of claim 5 , wherein, if there is no match, perform additional testing of the page for possible phishing activity.
8. The system of claim 5 , wherein claims made on the page includes one or more of copyright notice, patent owned and company name.