Patent Document ID: 9253208
Application ID: 14639871
Patent Flag: 1

Claim One:
1. In a computing system that includes a processor, data storage, and input/output devices including a network interface device, a method for automatically developing detection rules, the method comprising: (a) obtaining, by the computing system, incoming data directed to a destination; (b) detecting, by the computing system, any indicia of phishing present in the incoming data, the detecting being performed by application of a plurality of phishing detection rules; (c) computationally determining, by the computing system, a quantitative score for each of a plurality of predefined parameters, each of the parameters relating to at least one of the phishing indicia, and each quantitative score representing a likelihood of a presence of phishing content in the incoming data for the at least one of the phishing indicia; (d) assessing, by the computing system, a requirement for evolving a phishing detection rule, including applying a predefined set of rule evolution criteria to a combination of the determined quantitative scores of a plurality of parameters; (e) in response to an assessment of the requirement for evolving a phishing rule, generating, by the computing system, a new phishing detection rule based on selected parameter scores meeting the rule evolution criteria and on corresponding content of the phishing indicia relating to those selected parameter scores; by the computing system, recursively performing (b)-(e) based on any new phishing detection rules having been evolved in (e); identifying, by the computing system, any phishing-related objects based on selected parameter scores exceeding a phishing detection threshold and on corresponding content of the phishing indicia relating to those selected parameter scores; modifying, by the computing system, content relating to the phishing-related objects in the incoming data to remove or reduce maliciousness of the phishing-related objects.