Trend Micro Inc.

Tse-Min Chen

Chao-Yu Chen

Sheng-chi Hsieh

Yi-Yun Tseng

Methods for detecting an attempt to perpetrate fraud on a user utilizing a client-supplied link and a client-supplied IP address from a user computer. The method ascertains a first autonomous system number ('first AS number') from the client-supplied IP address and a second autonomous system number ('second AS number') from the client-supplied link. If the first AS number and the second AS number are not AS group peers, a pharming attempt is detected. Alternatively or additionally, the method includes analyzing a content of a webpage that is accessed using the client-supplied IP address to ascertain an identity of an apparent owner of the webpage and ascertaining a third autonomous system number (&#x201c;third AS number&#x201d;) from the identity of the apparent owner of the webpage. If the first AS number and the third AS number are not AS group peers, a phishing attempt is detected.

Autonomous system-based phishing and pharming detection

An arrangement for performing active malicious web page discovery is provided. The arrangement includes a web monitor module, which is configured to monitor a plurality of potential suspicious unified resource locators (URLs). The arrangement also includes a crawler module, which is configured to download the plurality of potential suspicious URLs. The arrangement further includes a malicious page identifier (MPI), which is configured to verify a set of risk statuses for the plurality of potential suspicious URLs.

Growing community of inventors

Taipei, Taiwan

Tse-Min Chen