Patent ID: 9009824
Filing Date: 2015-04-14
Classification: H04L

Abstract:
1. A method of detecting phishing comprising: receiving emails and Internet protocol (IP) addresses of a plurality message transfer agents (MTAs) that sent the emails; creating an MTA map comprising a plurality of points, with each point in the plurality of points representing an MTA in the plurality of MTAs; connecting points on the MTA map based on hashes of the emails; identifying a plurality of reference MTA groups from the MTA map; detecting that a first MTA sent a first email having a same hash as that of emails sent by MTAs in a first reference MTA group from the plurality of reference MTA groups, the first MTA not being a member of the first reference MTA group; and in response to detecting that the first MTA sent the first email, deeming the first MTA to be phishing, wherein connecting points on the MTA map comprises comparing hashes of emails sent from the plurality of points and determining a number of emails having a same hash sent by two points in the plurality of points, and wherein identifying the plurality of reference MTA groups from the MTA map comprises determining betweenness centrality of each point in the plurality of points, identifying a first point in the plurality of points with a highest betweenness centrality, removing the first point from the MTA map, and identifying a group of MTAs isolated from other groups of MTAs upon removal of the first point from the MTA map.