Royal Bank of Canada

Ilya Kolmanovich

Jamie Robert Gamble

Gadi Shpits

Cormac O'Keeffe

Cheng Chen Liu

Matin Hallaji

Vikash Yadav

Cormac O′keeffe

Transaction destinations are identified by identifying requests for a login page of a web server for a financial institution and determining a referring website for each of the requests; classifying the referring websites into classes, each of the classes having a risk rating; identifying logins to access the web server and determining a user associated with each login; associating each of the logins with one of the requests and the referring website for that request; for each of the users, identifying transactions occurring within a time period from when the login was initiated; for each of the transactions occurring within the time period, associating a transaction destination of that transaction with the referring website for that login; and assigning a risk rating to each of the transaction destinations based at least in part on a risk rating of the class of the associated referring website.

System and method for identifying suspicious destinations

A system for detecting phishing events is provided. A data receiver is configured to receive datasets representative of web traffic associated with access to or on-going usage of an application hosted on a server of a production environment by a user. Bait user credentials are generated and inserted into a malicious online resource. When the bait user credentials are used to access a secure online resource, a malicious interaction fingerprint dataset is generated for similarity analysis and classification.

System and method for detecting phishing events

Websites, having associated features, are clustered by filtering entries that may be legitimate, determining feature similarity scores between the website features, and generating an aggregated similarity matrix containing website similarity scores between the websites. Websites are clustered into clusters or groups, based in part on the aggregated similarity matrix. Each cluster is identified by a cluster identifier and represents a centroid website and other websites at a normalized similarity score from the centroid. It is determined for each website whether the normalized similarity score is less than a threshold, and if so is identified as weakly-similar. Above the threshold, the website is labelled with the cluster identifier. Further clustering and thresholding is performed on the weakly-similar websites into additional clusters.

System and method for digitally fingerprinting phishing actors

A system for detecting phishing events is provided. A data receiver is configured to receive datasets representative of web traffic associated with access to or on-going usage of an application hosted on a server of a production environment by a user. A machine learning engine is configured to generate a score based at least on the datasets representative of the web traffic indicative of whether the user is a malicious user or a non-malicious user. A routing modification engine is configured to route downstream web traffic associated with access to or on-going usage of the application by the user if the score is greater than a threshold to a server of a sandbox environment that is configured to emulate a graphic user interface of the production environment.

Growing community of inventors

Toronto, Canada

Ilya Kolmanovich