Phishing website detection by checking form differences followed by false credentials submission
View Patent ↗There is provided a method to detect phishing websites so as to protect users from sending their sensitive information to criminal servers. When browsing a web site having an input form asking sensitive information, the input fields are recorded (i.e. username field and password field). Then false credentials are generated and submitted in background. The new control layer then checks the response page content whether it includes an input form and if there is an input, it checks whether the form has the same fields as the first form. If the responded page does not have a form, or it has a form but includes different fields than the initial page's form, then the original site is identified as phishing.
1 . A method to detect a phishing website by introducing a control layer between a user and a website to be visited, where the control layer checks whether said website, requiring sensitive information, is a phishing website by comparing input forms after a false credential submission comprising:
browsing said website where said website has a first input form with username and password input fields asking sensitive information; said control layer is implemented as a web browser extension usable in real time while said user is browsing any website;
checking a whitelist and a blacklist of said control layer to determine if said browsed website is in said whitelist or in said blacklist or is unknown;
recording said input fields;
generating and submitting false credentials for said input fields in background;
enabling a user enabled permissive functionality after said false credentials are sent to said website by warning said user about phishing content detection and allowing said user to continue using said website or stop interaction with said website by having “Allow this website” button after the false credentials have been submitted once;
checking by said control layer content of a response page whether said content of said response page includes said first input form of said website; said response page having a second input form;
checking by said control layer whether said second input form of said response page has the same input fields as the first input form of said website, if said first input form of said website is included;
identifying said website as a phishing site, if said response page does not have said first input form of said website, or if said response page has said first input form of said website with different fields than the first input form of the website; and
identifying said website as a phishing site and blocking if said response page has no input form.
2 . The method according to claim 1 to detect phishing website by introducing a control layer between a user and a website to be visited, where said control layer triggers interaction with said website and analyzes its behavior before actual interaction with said user.