Patent Document ID: 9578048
Application ID: 14938802

Base Claim:
1. A method of identifying phishing websites, the method comprising, at a computer system: receiving website information from a first server computer corresponding to a website; rendering a document object model (DOM) object of the website using the website information; extracting a plurality of features from the DOM object; identifying a subset of features in the plurality of features; applying a phishing model to the subset of features to determine an indication of whether the website is performing phishing, wherein the phishing model includes a hierarchical decision logic defined by a plurality of nodes, each of the plurality of nodes having a different one of a plurality of phishing rules, wherein each of the plurality of phishing rules is a conditional statement for assessing one or more of the subset of features, and wherein applying the phishing model to the subset of features includes: identifying a subset of nodes in the plurality of nodes, the subset of nodes defining a decision path in the hierarchical decision logic, wherein the subset of nodes are identified by traversing the hierarchical decision logic based on an outcome of assessing a phishing rule of each of the subset of nodes, wherein the subset of nodes includes an initial node and a final node, and wherein after the initial node is identified, each subsequent node of the subset of nodes is identified based on the outcome of assessing a phishing rule of a node that is a parent of the subsequent node in the decision path; and determining a final phishing rule of the final node of the subset of nodes of the decision path, the final phishing rule being one of the plurality of phishing rules, wherein the indication of whether the website is performing phishing is determined based on an outcome of assessing the final phishing rule; determining a classification about whether the website is performing phishing based on the indication determined by the applying of the phishing model to the subset of features; and reporting a phishing occurrence based on determining that the classification specifies the website is performing phishing.

---

Claim 2:
2. The method of claim 1 , wherein rendering the DOM object using the website information includes: executing one or more functions identified in the website information, wherein executing the one or more functions causes: a change to the DOM object, first information to be obtained from one or more remote server computers, and second information to be posted to the one or more remote server computers; and updating the DOM object in response to executing the one or more functions.