Patent ID: 8839418
Filing Date: 2014-09-16
Classification: G06F,H04L

Abstract:
1. In a computing environment, a method for determining whether a site accessible by a network is likely a phishing site, the method comprising: recording a plurality of properties and features corresponding to a site, the properties and features being received from a plurality of data sources, each data source of the plurality of data sources comprising: tracking each of the plurality of properties at each of a plurality of distinct time resolutions, wherein tracking each property of the plurality of properties comprises: tracking a URL associated with the site, tracking a domain associated with the site, tracking an IP address associated with the site; wherein each of the plurality of distinct time resolutions comprises a span of time during which the raw data associated with each of the plurality of properties is tracked and collected; processing information from at least one data source of the plurality of data sources related to a known phishing site; based upon the recorded plurality of properties and features and based upon the information from at least one data source related to a known phishing site, building a plurality of predictive models using machine learning based on a plurality of different sets of training data; and constructing a decision tree based upon a plurality of classified training examples, the decision tree having leaf nodes which correspond to the probability of a site being a phishing site based upon the node path used in reaching the leaf node; and using the predictive models to determine a probability value that the site is a phishing site.