Patent ID: 9065850
Filing Date: 2015-06-23
Classification: H04L

Abstract:
1. A phishing site detection method, comprising: receiving, at a distributed security system comprising one or more computers configured to monitor all traffic to and from a protected system, a request for a site, where the distributed security system is external from the protected system, where the distributed security system monitors all the traffic at one or more processing nodes via a tunnel, a transparent proxy, a forward proxy, or redirection to the distributed security system, where the one or more processing nodes each comprise a detection processing filter to quickly detect via a guard table if the site has been checked as a phishing site; and if the site has not been checked as a phishing site, performing steps of: determining, via the distributed security system, if the site should be excluded as one of a plurality of phishing sites based on one or more exclusion elements; determining, via the distributed security system, if the site should be included as one of the plurality of phishing sites based on one or more inclusion elements; if the site is not excluded based on the first determining step and is not included based on the second determining step, scoring, via the distributed security system, the site based on a plurality of phishing elements to determine if the site is one of the plurality of phishing sites, where the scoring is performed based on the site having none of the one or more exclusion elements and none of the one or more inclusion elements, and the plurality of phishing elements comprise known phishing techniques; implementing the determining and scoring steps based on a single transaction comprising the request by a device in the protected system to the site and the reply received by the distributed security system from the site; and updating other processing nodes in the distributed security system with the plurality of phishing sites through one or more authority nodes in the distributed security system.