Patent Document ID: 10021134
Application ID: 15165503
Patent Flag: 1

Claim One:
1. A method, comprising: identifying a link in an email; downloading a webpage identified by the identified link in the email; from the downloaded webpage, computing a features vector comprising a plurality of phishing features whose values are determined according to the downloaded webpage, at least some of the plurality of phishing features of the features vector being brand-dependent and at least some other ones of the plurality of phishing features of the phishing vector being non brand-dependent, the features vector being computed by: determining a value of each of a first plurality of non brand-dependent phishing features; determining whether the features vector computed with the determined values of the first plurality of non brand-dependent phishing features enables an identification of an existing brand; when the features vector computed with the determined values of the first plurality of non brand-dependent phishing features does not enable an identification of an existing brand, determining a value of each of a second plurality of non brand-dependent phishing features; when the features vector computed with the determined values of the first plurality of non brand-dependent phishing features enables an identification of an existing brand, determining a value of each of a plurality of brand-dependent phishing features and determining the value of each of the second plurality of non brand-dependent phishing features; using the computed features vector, computing a probability that the link comprises a phishing attempt; determining whether the link in the email is a phishing link that is indicative of a phishing attempt, based upon the computed probability; and carrying out one of determining that the email is likely a phishing email, deleting the email and placing the email in a predetermined folder, depending upon the computed probability.