US 9,253,207 B2Grant

Collaborative phishing attack detection

Issue Date:2016-02-02

•20 Claims

•5 Drawing Sheets

Abstract

Described herein are methods, network devices and machine-readable storage media for detecting whether a message is a phishing attack based on the collective responses from one or more individuals who have received that message. The individuals may flag the message as a possible phishing attack, and/or may provide a numerical ranking indicating the likelihood that the message is a possible phishing attack. As responses from different individuals may have a different degree of reliability, each response from an individual may be weighted with a corresponding trustworthiness level of that individual, in an overall determination as to whether a message is a phishing attack. A trustworthiness level of an individual may indicate a degree to which the response of that individual can be trusted and/or relied upon, and may be determined by how well that individual recognized simulated phishing attacks.

Metadata

Assignee

PhishMe, Inc.

Inventors

Aaron Higbee
Rohyt Belani
Scott Greaux

Application Information

Application Number:US 13/763,538

Filing Date:2013-02-08

Priority Date:2013-02-08

Art Unit:2491

Classifications

IPC:

G06F11/00H04L29/06G06F12/14

Field of Search:

G06F 21/577H04L 63/1408H04L 63/1475

Patent Drawings (5 sheets)

Description

Related Applications

[0001] This application is related to U.S. patent application Ser. No. 13/763,486, filed Feb. 8, 2013, (i.e., Simulated Phishing Attacks with Sequential Messages) and U.S. patent application Ser. No. 13/763,515, filed Feb. 8, 2013, (i.e., Performance Benchmarking for Simulated Phishing Attacks), the entire contents of which are incorporated herein by reference.

Field of the Invention

[0002] The present invention relates to methods, network devices and machine-readable media for detecting phishing attacks, and more specifically in one embodiment, relies upon the responses of individuals, weighted by their associated trustworthiness levels, to classify or not classify a message as a phishing attack.

Background

[0003] In a phishing attack, an individual (e.g., a person, an employee of a company, an individual of a computing device) receives a message, commonly in the form of an e-mail, directing the individual to perform an action, such as opening an e-mail attachment or following (e.g., using a cursor controlled device or touch screen) an embedded link. If such message were from a trusted source (e.g., co-worker, bank, utility company), such action might carry little risk. Nevertheless, in a phishing attack, such message is from an attacker (e.g., an individual using a computing device to perform an malicious act on another computer device user) disguised as a trusted source, and an unsuspecting individual, for example, opening an attachment to view a “friend's photograph” might in fact install malicious computer software (i.e., spyware, a virus, and/or other malware) on his/her computer. Similarly, an unsuspecting individual directed to a webpage made to look like an authentic login or authentication webpage might be deceived into submitting his/her username, password or other sensitive information to an attacker.

[0004] While there are computer programs designed to detect and block phishing emails, phishing attacks methods are constantly being modified by attackers to evade such forms of detection. The present invention addresses some shortcoming of previous attempts to counter phishing attacks.

Summary of the Invention

[0005] The inventors have observed that one effective means to counter phishing attacks is to make individuals more knowledgeable about phishing attacks. In an education process, individuals are subjected to simulated phishing attacks, which are designed to resemble actual phishing attacks. In response to a simulated attack, an individual typically either falls victim to it, ignores the attack, consciously chooses to not react or additionally reports the attack too (e.g., reports the attack to the information technology (IT) department, law enforcement, etc.). For those that fall victim to an attack, training is provided to decrease the likelihood that they will be deceived by a future simulated and/or real phishing attack. The respective responses of individuals is recorded (e.g., whether he/she fell victim to the attack, ignored the attack or reported the attack).

[0006] In the monitoring of individuals' responses, occasionally a message that is not a simulated phishing attack will be flagged (or otherwise identified) by one or more individuals as being a possible phishing attack. Such message could be an ordinary (i.e., not malicious) message that has been incorrectly identified by one or more individuals as a possible phishing attack (i.e., a false alarm), or could be a real phishing attack that has been correctly identified by one or more individuals (i.e., an accurate detection). One way to distinguish between these two possibilities is to perform an “independent” analysis of the flagged message (i.e., analysis not biased on the fact that a message has been flagged). In other words, the flagged message could be forwarded to a computer security expert who could provide an “official” determination as to the nature of the flagged message (e.g., whether it is a real phishing attack or not). Alternatively, the flagged message could be processed by computer software configured to detect phishing attacks. Such approaches which identify a phishing attack by recognizing characteristics indicative of a phishing attack (e.g., spoofed sender identifier, attachment with executable file type, etc.), however, are not the focus of the present application. Instead, the focus of the present application is to resolve the uncertainty of whether a message has been appropriately flagged by analyzing the reputation of the one or more individuals who have flagged the message. Stated differently, the key is to identify those individuals whose responses are likely to be accurate (i.e., trustworthy individuals) from others whose responses are less likely to identify the phishing attacks accurately (i.e., untrustworthy individuals). If such determination can be made, the responses of trustworthy individuals can be weighted more heavily as compared to the responses of untrustworthy individuals, or the responses of untrustworthy individuals can be ignored.

[0007] Conveniently, by conducting simulated phishing attacks on individuals and monitoring their performance, it is indeed possible to identify trustworthy individuals from untrustworthy individuals. Therefore, upon a message being identified by one or more individuals as being a possible phishing attack and such message further determined not to be a simulated phishing attack, the responses of each individual can be weighted by a trustworthiness level (e.g., based on how well he/she identified simulated phishing attacks, based on how well he/she identified real phishing attacks, and/or based on various other factors described below) in order to estimate how likely the message is a real phishing attack. The response provided by an individual may include a flag indicating a message being a possible phishing attack and/or a ranking indicative of the likelihood that a message is a possible phishing attack.

[0008] These and other embodiments of the invention are further described in the description that follows.

Brief Description of the Drawings

[0009] The present invention is illustrated by way of example, and not limitation, in the figures of the accompanying drawings in which:

[0010] FIG. 1 depicts a system diagram with a collection of interconnected network devices, computing devices and databases, according to one embodiment;

[0011] FIG. 2 depicts an example log of simulated phishing attacks, according to one embodiment;

[0012] FIG. 3 depicts example responses of individuals to simulated phishing attacks, according to one embodiment;

[0013] FIG. 4 depicts example trustworthiness levels, according to one embodiment;

[0014] FIG. 5 depicts a table recording various attributes associated with messages that have been identified as being possible phishing attacks and determined not to be simulated phishing attacks, according to one embodiment; and

[0015] FIG. 6 depicts a flow diagram of a process performed in response to a message being identified by one or more individuals as a possible phishing attack, according to one embodiment.

Detailed Description of the Invention

[0016] In the following detailed description of the preferred embodiments, reference is made to the accompanying drawings that form a part hereof, and in which are shown by way of illustration specific embodiments in which the invention may be practiced. It is understood that other embodiments may be utilized and structural changes may be made without departing from the scope of the present invention.

[0017] FIG. 1 depicts system 100 in which the present invention may be practiced, in accordance with one embodiment. In system 100, network devices 10, 12 and 14 are communicatively coupled to computing devices 16, 18 and 20 via network 22. The number of devices (3 of each, 6 in total) is exemplary in nature, and more or fewer number of devices may be present. A computing device may be one or more of a client, a desktop computer, a mobile computing device such as a smartphone, tablet computer or laptop computer, and a dumb terminal interfaced to a cloud computing system. A network device may be one or more of a server, a device used by a network administrator, and a device used by an attacker. In general, there may be very few distinctions (if any) between a network device and a computing device.

[0018] Network device 14 may be configured to send simulated phishing attacks to computing devices 16, 18 and 20. As described above, simulated phishing attacks are designed to resemble real phishing attacks in order to train the users of computing devices 16, 18 and 20 to better recognize and thwart a real phishing attack. In contrast to network device 14, network devices 10 and 12 may be locally or remotely used by an attacker to send a real phishing attack to computing devices 16, 18 and 20. A network device may be remotely used by an attacker in the event that it has been infected with malware of the attacker.

[0019] In one embodiment, three databases 24, 26 and 28 are communicatively coupled to network device 14. Database 24 stores a log of simulated phishing attacks; database 26 records the responses of individuals to simulated phishing attacks; and database 28 records the trustworthiness levels of individuals. Three databases are depicted for illustrative purposes, but in practice any number of the databases may be present within a single storage device. The databases may be located remotely from or locally within network device 14. Further, one or more of databases 24, 26 and 28 may be optional, depending on the particular implementation of system 100.

[0020] In one embodiment, network device 14 administers simulated phishing attacks to individuals of computing devices 16, 18 and 20. Each time a simulated phishing attack is transmitted to a computing device, such event may be recorded in the log of simulated phishing attacks 24. Responses (if any) of the individuals to the simulated phishing attacks may be recorded in database 26, and may include any action performed by the individuals in response to a simulated phishing attack. A response may include an individual reporting an attack (e.g., reporting an attack to an IT administrator), an individual ignoring an attack, and an individual falling victim to an attack (e.g., opening an attachment of a simulated phishing attack, following an embedded link of a simulated phishing attack, submitting personal information on an authentication webpage, etc.). Based on these responses (or based on other input), network device 14 may calculate a trustworthiness level associated with each individual of computing devices 16, 18 and 20. The trustworthiness level indicates the degree that a notification from an individual (the notification identifying a message as a possible phishing attack) should be trusted. Such trustworthiness levels may be stored in database 28.

[0021] At some point, an attacker may transmit a real phishing attack from one or more of network devices 10 and 12 to one or more of computing devices 16, 18 and 20. Individuals of one or more of computing devices 16, 18 and 20 may notify network device 14 (and/or an administrator thereof) that a received message is a possible phishing attack. Network device 14 may search through the log of simulated phishing attacks 24 to determine whether the message is a simulated phishing attack. Upon determining that the message is not a simulated phishing attack, network device 14 may estimate the likelihood that the message is a real phishing attack. Such likelihood may be calculated via statistical methods and/or heuristics (described further below), and may be a numerical value referred to as a score. In another embodiment, network device 14 may, in addition to or instead of calculating a score, classify or not classify the message as a real phishing attack. Such score and/or classification may be based on respective trustworthiness levels assigned to individuals of computing devices 16, 18 and 20.

[0022] In another embodiment, a computer program (e.g., plug-in, client-side plug-in, etc.) present at one or more of computing devices 16, 18 and 20 may determine whether a message is a simulated phishing attack or not. For clarity of discussion, suppose an individual of computing device 18 has flagged a message as a possible phishing attack. Instead of consulting network device 14, computing device 18 may determine, locally, whether the flagged message is a simulated phishing attack. A computer program at computing device 18 may examine the sender information of the flagged message in order to make such determination. For instance, there could be a list of sender e-mail addresses, phone numbers, etc. that are used by network device 14 to transmit simulated phishing attacks. If the sender information of the flagged message were included in such a list, that message could be classified as a simulated phishing attack. If the flagged message were determined not to be a simulated phishing attack (hence, flagged message is potentially a real phishing attack), computing device 18 could query network device 14 to determine the trustworthiness level of the individual who flagged the message (i.e., individual using computing device 18). Based on the trustworthiness level of the individual (i.e., if trustworthiness level is sufficiently high), computing device 18 could alert network device 14, a network security appliance (e.g., a gateway, firewall, spam filter—all not depicted), and/or a security event responder (not depicted) that a potentially malicious message was able to thwart security measures and that additional security measures should be taken to ensure that such messages (e.g., messages from same sender as flagged message) are blocked in the future.

[0023] FIGS. 2-4 illustrate examples of the contents that may be present in databases 24, 26 and 28. FIG. 2 depicts an example log of simulated phishing attacks. The log indicates that a simulated phishing attack with ID=1 was transmitted at 10:10 AM from a sender masquerading as Jane to the three recipients Ann, Bob and Chip. The subject of the simulated phishing attack was “Review Account Activity”. Further indicated in the log is a simulated phishing attack with ID=2 transmitted to Ann, Bob and Chip at 11:57 AM, 11:58 AM and 10:59 AM, respectively. For the simulated phishing attack with ID=2, the sender masqueraded as Tom. Ellipses in the last row of the log indicates that only a portion of the log is being displayed, and more entries may be present. Simulated phishing attacks with a common ID number may identify simulated phishing attacks constructed from a common simulated phishing attack template, as described in related U.S. patent application Ser. No. 13/763,515, filed Feb. 8, 2013, (i.e., Performance Benchmarking for Simulated Phishing Attacks).

[0024] FIG. 3 depicts a table which records individuals' responses to simulated phishing attacks. As indicated in FIG. 3, in response to simulated phishing attack (ID=1), Ann reported the attack, Bob reported the attack, and Chip fell victim to the attack. In response to simulated phishing attack (ID=2), Ann fell victim to the attack, Bob reported the attack, and Chip fell victim to the attack. Further entries in the table should be self-explanatory. From these responses to the simulated phishing attacks, it can be qualitatively inferred that if Ann were to identify a message as a possible phishing attack, her identification should be somewhat trusted. If Bob were to identify a message as a possible phishing attack, his identification should be trusted. In contrast, if Chip were to identify a message as a possible phishing attack, his identification should not be trusted.

[0025] FIG. 4 depicts quantitative trustworthiness levels assigned to each individual: Ann=1, Bob=4, and Chip=−2. These trustworthiness levels have been calculated according to the following rules (such rules being exemplary in nature):

- [0026] 1. Each time an individual reports a simulated phishing attack, that individual receives 1 point.
- [0027] 2. Each time an individual ignores a simulated phishing attack, that individual receives 0 points.
- [0028] 3. Each time an individual falls victim to a simulated phishing attack, that victim is penalized 1 point (i.e., receives −1 point).
  Therefore, Ann's trustworthiness level is calculated as follows: 1+−1+0+1=1. Bob's trustworthiness level is calculated as follows: 1+1+1+1=4. Chip's trustworthiness level is calculated as follows: −1+−1+1+−1=−2. Of course, such computation and point values are exemplary, and other computations and point values to arrive at a trustworthiness level are possible.

[0029] In one embodiment, point values may be based on the type of simulated phishing attack and/or its sophistication. For instance, an individual who reports a sophisticated simulated phishing attack may receive more points (e.g., 2 points) than an individual who reports an unsophisticated simulated phishing attack (e.g., 1 point), because recognizing a sophisticated simulated phishing attack may demonstrate higher recognition abilities than recognizing an unsophisticated simulated phishing attack. Likewise, an individual who falls victim to a sophisticated simulated phishing attack may be penalized fewer points (e.g., penalized 1 point) than an individual who falls victim to an unsophisticated simulated phishing attack (e.g., penalized 2 points). In the former case, falling victim to a sophisticated phishing attack might be more a result of the sophistication of the phishing attack than low recognition abilities of the individual, and hence the penalty should be lower. In contrast, in the latter case, falling victim to an unsophisticated phishing attack is more likely the result of low recognition abilities of the individual, and hence the penalty should be higher.

[0030] As mentioned above, point values may also be based on the type of simulated phishing attack. More specifically, the type of a simulated phishing attack may refer to the type of target action or the delivery mechanism. For instance, in response to recognizing a simulated phishing attack with a fraudulent attachment, an individual might receive 3 points; falling victim to same might result in a deduction of 3 points. In response to recognizing a simulated phishing attack with a fraudulent embedded link, an individual might receive 2 points; falling victim to same might result in a deduction of 2 points. In response to recognizing a simulated phishing attack delivered via e-mail, an individual might receive 3 points; falling victim to same might result in a deduction of 3 points. In response to recognizing a simulated phishing attack delivered via a text message, an individual might receive 1 point; falling victim to same might result in a deduction of 1 point.

[0031] FIG. 5 depicts a table which helps to illustrate how trustworthiness levels may be used in computing a likelihood that a message is a real phishing attack and further to classify whether a message is a real phishing attack. As depicted in FIG. 5, message 1 was reported by Bob and Chip as a possible phishing attack. In one embodiment, an estimation of a likelihood that a message is a real phishing attack (i.e., called a “score” in short) is the sum of the respective trustworthiness levels of individuals who reported the message. Therefore, the score for message 1 is Bob's trustworthiness level plus Chip's trustworthiness level (i.e., 4+−2) which equals 2. The score for message 2 is computed as Ann's trustworthiness level plus Bob's trustworthiness level (i.e., 1+4) which equals 5. The score for message 3 is Chip's trustworthiness level which equals −2. In one embodiment, a determination as to whether to classify a message as a real phishing attack is based on comparing the score to a threshold. In the example of FIG. 5, the threshold is chosen as 4, and any message with a score that exceeds the threshold (i.e., 4) is classified as a real phishing attack. Therefore, messages 1 and 3 are not classified as a real phishing attack, whereas message 2 is classified as a real phishing attack. The particular numerical value selected for the threshold, of course, is exemplary, and other values may be used. In one embodiment, the threshold is an adjustable parameter, adjusted according to one or more of the number of false alarms and the number of missed detections.

[0032] FIG. 6 depicts a flow diagram 48 of a process performed in response to a message being identified by one or more individuals as a possible phishing attack, according to one embodiment. Such flow diagram is described primarily from the perspective of network device 14 (or a similar device). In step 50, network device 14 receives a notification that a message has been identified by one or more individuals as a possible phishing attack, the message having been received on a computing device of each of the one or more individuals. Such notification may be received via e-mail (e.g., the suspicious e-mail forwarded to a network administrator of network device 14). In one embodiment, a plug-in built into an e-mail client (e.g., MICROSOFT® OUTLOOK®, IBM® LOTUS NOTES®, etc.) or a web-based e-mail client (GMAIL® from GOOGLE INC®, YAHOO! MAIL® from YAHOO! INC®) may provide users of the mail client with a toolbar and/or graphical user interface element that, when selected, automatically reports an e-mail as a suspicious message (and more specifically, as a possible phishing attack) to network device 14 (or administrator thereof) or a network device other than network device 14 (e.g., an e-mail security analysis engine). Further, a single graphical user interface action (e.g., one-click of a button, one-touch of a button) may be sufficient to trigger the notification to be sent to the network device. In the reporting, the suspicious message may be included in its entirety, partially included, or omitted. Identifying characteristics of the suspicious message may be sent to network device 14, including one or more of a sender identifier of the message, a recipient identifier of the message, a subject of the message, a time of transmission of the message, and a header of the message. Network device 14 may be notified that a message has been identified by one or more individuals as a possible phishing attack by means other than e-mail, including a Short Message Service (SMS) text message, a telephone call, an instant message (IM), etc.

[0033] In step 52, network device determines whether the message is a simulated phishing attack. In one embodiment, such step may be accomplished by comparing identifying characteristics of the message (e.g., including one or more of a sender identifier of the message, a recipient identifier of the message, a subject of the message, a time of transmission of the message, and message headers) with a log of transmitted simulated phishing attacks. Alternatively or in addition to such comparison, the message body or message content may be compared (via text comparison) to one or more simulated phishing attack templates, such templates described in related U.S. patent application Ser. No. 13/763,515, filed Feb. 8, 2013, (i.e., Performance Benchmarking for Simulated Phishing Attacks). Alternatively or in addition to such comparison, a determination of whether a flagged message is a simulated phishing attack may be based on a checksum of the message content. As described earlier, the analysis to determine whether a flagged message is a simulated phishing attack may also be performed at a computing device (e.g., at the client side) instead of at a network device (e.g., at the server side).

[0034] In step 54, if the message is identified as a simulated phishing attack, the network device may record in a database (e.g., database 26) that each of the one or more individuals has correctly identified the message as a possible phishing attack. If the message is not identified as a simulated phishing attack, it is possible that an ordinary message (i.e., message without malware) has been incorrectly identified as a possible phishing attack (i.e., false alarm), or the message has been correctly identified as a real phishing attack. To distinguish between these possibilities, the network device determines a trustworthiness level for each of the one or more individuals.

[0035] In one embodiment, the trustworthiness level of an individual is based on one or more of a percentage of simulated phishing attacks that the individual correctly identified as a possible phishing attack, a percentage of simulated phishing attacks that the individual ignored, and a percentage of simulated phishing attacks that the individual fell victim to. Alternatively or in addition, the trustworthiness level of an individual may be based on one or more of a number of simulated phishing attacks that the individual correctly identified as a possible phishing attack, a number of simulated phishing attacks that the individual ignored, and a number of simulated phishing attacks that the individual fell victim to. Alternatively or in addition, the trustworthiness level of an individual may be based on one or more of a number of real phishing attacks that the individual correctly identified as a possible phishing attack, a number of real phishing attacks that the individual ignored, and a number of real phishing attacks that the individual fell victim to.

[0036] Alternatively or in addition, the trustworthiness level of an individual may be based on one or more of a field of employment of the individual, an educational degree of the individual, a job position of the individual, and an employment history of the individual. For instance, an individual with a Ph.D. in Computer Science specializing in computer security may be one factor that is taken into account when determining a trustworthiness score thereof, and according to predetermined rules, such factor may increase such individual's trustworthiness score by, e.g., 20%. As another example, an individual with 10 years of work experience in computer security may be one factor that is taken into account when determining a trustworthiness score thereof, and according to predetermined rules, such factor may increase such individual's trustworthiness score by, e.g., 15%. Such information (e.g., field of employment of the first individual, an educational degree of the first individual, a job position of the first individual, and employment history of the first individual, etc.) may be stored in a profile associated with each individual, such information being manually queried from the individual or automatically retrieved from a database hosted, e.g., by LINKEDIN®.

[0037] Alternatively or in addition, the trustworthiness level of an individual may be based on a rating assigned to the individual by people within a social network of the individual. For instance, the social network could be one hosted by LINKEDIN®, and the people within the social network of the individual might include the individual's co-workers, friends from college, etc. People within the social network of the individual might be asked to rate the individual's knowledge about phishing attacks from a scale from 1 to 10, with 1 being not knowledgeable and 10 being very knowledgeable. Likewise, people within the social network of the individual might be asked to rate the individual's ability to recognize a phishing attack from 1 to 10. If there is more than one person within the social network of the individual, an overall rating may be based on the average of respective ratings assigned by peers of the individual.

[0038] A trustworthiness level associated with an individual may be a dynamically determined value (e.g., determined when needed) or may be a pre-calculated value that is retrieved from a database (such as database 28) when needed.

[0039] In step 58, the network device processes the message based on the trustworthiness level of each of the one or more individuals. In one embodiment, the network device processes the message by classifying or not classifying the message as a real phishing attack based on the trustworthiness level of each of the one or more individuals. In other embodiments, a confidence score, a likelihood and/or a probability may be provided to inform a person receiving the classification with a more detailed understanding as to how likely a classification is correct (e.g., message is a real phishing attack with a confidence score of 8 out of 10, message is not a real phishing attack with a confidence score of 5 out of 10, etc.). In some embodiments, a binary classification (e.g., Yes/No) of a message as a real phishing attack may be omitted. Instead, a numerical value from a range of values may be provided to inform a person how likely a message is a real phishing attack. Below, a more detailed discussion regarding the classification of a message based on trustworthiness level(s) is provided.

[0040] In the case where only one individual has flagged a message as a possible phishing attack, that individual's trustworthiness level may be compared with a threshold in order to classify or not classify the message as a real phishing attack. That individual's trustworthiness level may be provided as a confidence score of the classification. Alternatively, a binary classification may be omitted and the individual's trustworthiness level may be provided as a measure of the likelihood that a message is a real phishing attack.

[0041] In the case where more than one individual has flagged a message as a possible phishing attack, an average of the respective trustworthiness levels of those individuals who have flagged the message may be computed, and such average may be compared with a threshold in order to classify or not classify the message as a real phishing attack. Various other statistical measures of the trustworthiness levels may be computed (such as the maximum trustworthiness level, minimum trustworthiness level, mode of trustworthiness levels, etc.) and such statistical measures may be compared with a threshold in order to classify or not classify the message as a real phishing attack.

[0042] In one variation, a statistical measure may be computed from only a subset of the respective trustworthiness levels of the individuals. For instance, trustworthiness levels may range from −5 to +5, with −5 being not trustworthy and +5 being trustworthy. In some cases, it may be desirable to simply ignore any trustworthy levels below 0, and take the average of trustworthy levels above 0. Such average may then be compared with a threshold in order to classify or not classify the message as a real phishing attack.

[0043] In one embodiment, individuals may rank the likelihood that a message is a real phishing attack. The rank may be a numeric value, e.g., between 1 and 10, with 1 indicating the message is not likely to be a phishing attack and 10 indicating the message is very likely to be a phishing attack. Therefore, the earlier described instance where an individual flags a message as a possible phishing attack may be interpreted as a specific instance of this more general framework (i.e., binary values being a very limited range of values). In this more general framework, the aggregate likelihood that a message is a real phishing attack may be computed as a weighted average, in which the respective trustworthiness levels of individuals are used to weight the respective ranks. In mathematical notation, suppose r_iequals the rank assigned by the i^thindividual and suppose t_iequals the trustworthiness level associated with the i^thindividual. A weighted average of the ranks may be computed as follows: t₁r₁+t₂r₂+ . . . t_nr_n, where there are n individuals providing rankings.

[0044] In one embodiment (not depicted), immediately before or after step 52 (i.e., determine whether the message is a simulated phishing attack), network device may also determine whether the message is a known phishing attack. Such determination may rely upon a database that stores known phishing attacks. If so (i.e., message is a known phishing attack), the network device may record that the one or more individuals has correctly identified the message as a possible phishing attack. Otherwise (i.e., message is not a known phishing attack), the process may proceed to step 52 (in the event that such added step occurs immediately prior to step 52), or the process may proceed to step 56 (in the event that such added step occurs immediately after step 52).

[0045] Readers should recognize that various embodiments of the present invention may be implemented with the aid of computer-implemented processes or methods (a.k.a. software, programs or routines) that may be rendered in any computer language including, without limitation, C#, C/C++, Fortran, COBOL, PASCAL, assembly language, markup languages (e.g., HTML, SGML, XML, VoXML), and the like, as well as object-oriented environments such as the Common Object Request Broker Architecture (CORBA), JAVA™ and the like. In general, terms such as software, programs, routines, scripts and the like, as used herein, are meant to encompass any series of logical steps performed in a sequence to accomplish a given purpose.

[0046] In view of the above, it should be appreciated that some portions of the detailed description that follows are presented in terms of algorithms and symbolic representations of operations on data within a computer memory. These algorithmic descriptions and representations are the means used by those skilled in the computer science arts to most effectively convey the substance of their work to others skilled in the art. An algorithm is here, and generally, conceived to be a self-consistent sequence of steps leading to a desired result. The steps are those requiring physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, transferred, combined, compared and otherwise manipulated. It has proven convenient at times, principally for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers or the like. It should be borne in mind, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. Unless specifically stated otherwise, it will be appreciated that throughout the description of the present invention, use of terms such as “processing”, “computing”, “calculating”, “determining”, “displaying” or the like, refer to the action and processes of a computer system, or similar electronic computing device, that manipulates and transforms data represented as physical (electronic) quantities within the computer system's registers and memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage, transmission or display devices.

[0047] The present invention can be implemented with an apparatus (referred to above as a network device, computing device, etc.) to perform the operations described herein. This apparatus may be specially constructed for the required purposes, or it may comprise a general-purpose computer, selectively activated or reconfigured by a computer program stored in the computer. Such a computer program may be stored in a computer readable storage medium, such as, but not limited to, any type of disk including floppy disks, optical disks, CD-ROMs, and magnetic-optical disks, read-only memories (ROMs), random access memories (RAMs), EPROMs, EEPROMs, magnetic or optical cards, or any type of non-transitory media suitable for storing electronic instructions, and each coupled to a computer system bus, which in turn may be coupled to a processor.

[0048] The algorithms and processes presented herein are not inherently related to any particular computer or other apparatus. Various general-purpose systems may be used with programs in accordance with the teachings herein, or it may prove convenient to construct more specialized apparatus to perform the required method. For example, any of the methods according to the present invention can be implemented in hard-wired circuitry, by programming a general-purpose processor, or by any combination of hardware and software. One of ordinary skill in the art will immediately appreciate that the invention can be practiced with any computer system configuration, including personal computers, workstations, hand-held devices, multiprocessor systems, microprocessor-based, digital signal processor-based or other programmable consumer electronics, network computers that employ thin client architectures, minicomputers, mainframe computers, and the like. The invention can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network.

[0049] Thus, methods, network devices and machine-readable media for detecting a phishing attack based on the responses of individuals, weighted by their associated trustworthiness levels, have been described. It is to be understood that the above description is intended to be illustrative, and not restrictive. Many other embodiments will be apparent to those of skill in the art upon reviewing the above description. The scope of the invention should, therefore, be determined with reference to the appended claims, along with the full scope of equivalents to which such claims are entitled.

Claims

What is claimed is:

1. A method, comprising:

generating, by a network device, a simulated phishing message, the message comprising a predetermined identifier in the message or in metadata of the message;

electronically storing, by the network device, the predetermined identifier in a computerized data store;

receiving, by the network device from a computing device associated with an individual, a notification triggered by a user action by the individual that a message delivered in an account associated with the individual has been identified by the individual as a possible phishing attack;

determining, by the network device, whether the identified message is a known simulated phishing attack by comparing the predetermined identifier to an identifier from the body of the message or to the metadata of the message;

if the message is identified by the individual as a simulated phishing attack, recording in a database that the individual has correctly identified the message as a possible phishing attack;

if the message is determined not to be a known simulated phishing attack based on the comparison of the identifier, determining, at the network device, whether the identified message may be a threat based on at least whether the individual has correctly identified a previous message as a possible phishing attack;

processing, by the network device, the message based on the determination of whether the identified message may be a threat.

2. The method of claim 1, wherein processing the message based on a trustworthiness level of the individual further comprises forwarding the message to a computer security technician for analysis to determine if the message is a real phishing attack or not.

3. The method of claim 1, wherein a trustworthiness level of the individual is based on a rating assigned to the individual within a social network of the individual.

4. The method of claim 1, wherein if the message is determined not to be a known simulated phishing attack based on the comparison of the identifier, classifying or not classifying the message as a real phishing attack based on a trustworthiness level the individual.

5. The method of claim 4, wherein if the trustworthiness level of the individual exceeds a threshold, classifying the message as a real phishing attack, otherwise, not classifying the message as a real phishing attack.

6. The method of claim 1, further comprising calculating a numerical value indicative of a likelihood the message is a real phishing attack based on a trustworthiness level of the individual.

7. The method of claim 1, further comprising:

calculating an average of trustworthiness level of multiple individuals who have triggered a notification of the message; and

comparing the average with a threshold to classify or not classify the message as a real phishing attack.

8. The method of claim 1, wherein a trustworthiness level of the individual is based on one or more of a percentage of simulated phishing attacks that the individual correctly identified as a possible phishing attack, a percentage of simulated phishing attacks that the individual ignored, and a percentage of simulated phishing attacks that the individual fell victim to.

9. The method of claim 1, wherein a trustworthiness level of the individual is based on a sophistication level of a simulated phishing attack received by the individual.

10. The method of claim 9, wherein the individual correctly identifying a more sophisticated simulated phishing attack results in a higher trustworthiness level for the individual, as compared to the individual correctly identifying a less sophisticated simulated phishing attack.

11. A system comprising:

a processor;

a storage device connected to the processor;

a network server device; and

a set of instructions on the storage device that, when executed by the processor, cause the processor perform the steps of:

generating, by the processor, a simulated phishing message, the message comprising a predetermined identifier in the message or in metadata of the message;

electronically storing, on the storage device, the predetermined identifier in a computerized data store;

receiving, by the processor from a computing device associated with an individual, a notification triggered by a user action by the individual that a message delivered in an account associated with the individual has been identified by the individual as a possible phishing attack;

determining, by the processor, whether the identified message is a known simulated phishing attack by comparing the predetermined identifier to an identifier from the body of the message or to the metadata of the message;

if the message is identified by the individual as a simulated phishing attack, recording in a database that the individual has correctly identified the message as a possible phishing attack;

if the message is determined not to be a known simulated phishing attack based on the comparison of the identifier, determining, at the processor, whether the identified message may be a threat based on at least whether the individual has correctly identified a previous message as a possible phishing attack; and

processing, by the processor, the message based on the determination of whether the identified message may be a threat.

12. The system of claim 11, wherein if the message is determined not to be a known simulated phishing attack based on the comparison of the identifier, classifying or not classifying the message as a real phishing attack based on a trustworthiness level the individual.

13. The system of claim 11, wherein if the trustworthiness level of the individual exceeds a threshold, classifying the message as a real phishing attack, otherwise, not classifying the message as a real phishing attack.

14. The system of claim 11, further comprising calculating a numerical value indicative of a likelihood the message is a real phishing attack based on the trustworthiness level of the individual.

15. A non-transitory computer-readable recording medium storing a simulated phishing message administration computer program, the simulated phishing message administration computer program causing a processor to perform steps comprising:

generating, by a network device, a simulated phishing message, the message comprising a predetermined identifier in the message or in metadata of the message;

electronically storing, by the network device, the predetermined identifier in a computerized data store;

if the message is identified by the individual as a simulated phishing attack, recording in a database that the individual has correctly identified the message as a possible phishing attack;

processing, by the network device, the message based on the determination of whether the identified message may be a threat.

16. The non-transitory computer-readable recording medium of claim 15, wherein if the message is determined not to be a known simulated phishing attack based on the comparison of the identifier, classifying or not classifying the message as a real phishing attack based on a trustworthiness level the individual.

17. The non-transitory computer-readable recording medium of claim 15, wherein if a trustworthiness level of the individual exceeds a threshold, classifying the message as a real phishing attack, otherwise, not classifying the message as a real phishing attack.

18. The non-transitory computer-readable recording medium of claim 15, further comprising calculating a numerical value indicative of a likelihood the message is a real phishing attack based on a trustworthiness level of the individual.

19. The non-transitory computer-readable recording medium of claim 15, further comprising:

calculating an average of trustworthiness level of multiple individuals who have triggered a notification of the message; and

comparing the average with a threshold to classify or not classify the message as a real phishing attack.

20. The non-transitory computer-readable recording medium of claim 15, wherein a trustworthiness level of the individual is based on one or more of a percentage of simulated phishing attacks that the individual correctly identified as a possible phishing attack, a percentage of simulated phishing attacks that the individual ignored, and a percentage of simulated phishing attacks that the individual fell victim to.

Patent Citations (114)

Patent	Date	Inventor	Cited By
US5892903(A)	1999-04-01	Klaus	Applicant
US6954858(B1)	2005-10-01	Welborn et al.	Applicant
US7281031(B1)	2007-10-01	Wang et al.	Applicant
US7325252(B2)	2008-01-01	Bunker et al.	Applicant
US7373385(B2)	2008-05-01	Prakash	Applicant
US7457823(B2)	2008-11-01	Shraim et al.	Applicant
US7490356(B2)	2009-02-01	Lieblich et al.	Applicant
US7509675(B2)	2009-03-01	Aaron	Applicant
US7603709(B2)	2009-10-01	Lewis et al.	Applicant
US7617532(B1)	2009-11-01	Alexander et al.	Applicant
US7634810(B2)	2009-12-01	Goodman et al.	Applicant
US7668921(B2)	2010-02-01	Proux et al.	Applicant
US7681234(B2)	2010-03-01	Florencio et al.	Applicant
US7685631(B1)	2010-03-01	Paya et al.	Applicant
US7788723(B2)	2010-08-01	Huddleston	Applicant
US7841003(B1)	2010-11-01	Emdee	Applicant
US7865958(B2)	2011-01-01	Lieblich et al.	Applicant
US7904518(B2)	2011-03-01	Marino et al.	Applicant
US7925883(B2)	2011-04-01	Florencio et al.	Applicant
US7971246(B1)	2011-06-01	Emigh et al.	Applicant
US7987495(B2)	2011-07-01	Maler et al.	Applicant
US8181232(B2)	2012-05-01	Grandcolas et al.	Applicant
US8191148(B2)	2012-05-01	Oliver et al.	Applicant
US8209381(B2)	2012-06-01	Sinn et al.	Applicant
US8220047(B1)	2012-07-01	Soghoian et al.	Applicant
US8271007(B2)	2012-09-01	Cai et al.	Applicant
US8286249(B2)	2012-10-01	Adelstein et al.	Applicant
US8291065(B2)	2012-10-01	Goodman et al.	Applicant
US8296376(B2)	2012-10-01	Goldberg et al.	Applicant
US8321934(B1)	2012-11-01	Cooley et al.	Applicant
US8332918(B2)	2012-12-01	Vedula et al.	Applicant
US8365246(B2)	2013-01-01	Readshaw	Applicant
US8381293(B2)	2013-02-01	Emigh et al.	Applicant
US8407798(B1)	2013-03-01	Lotem et al.	Applicant
US8423483(B2)	2013-04-01	Sadeh-Koniecpol et al.	Applicant
US8438642(B2)	2013-05-01	Feng et al.	Applicant
US8464346(B2)	2013-06-01	Barai et al.	Applicant
US8464352(B2)	2013-06-01	Toomey	Applicant
US8468244(B2)	2013-06-01	Redlich et al.	Applicant
US8484741(B1)	2013-07-01	Chapman	Examiner
US8615807(B1)	2013-12-01	Higbee et al.	Applicant
US8635703(B1)	2014-01-01	Belani et al.	Applicant
US8719940(B1)	2014-05-01	Higbee et al.	Applicant
US8910287(B1)	2014-12-01	Belani et al.	Applicant
US8966637(B2)	2015-02-01	Belani et al.	Applicant
US2002/0091940(A1)	2002-07-01	Welborn et al.	Applicant
US2005/0132225(A1)	2005-06-01	Gearhart	Applicant
US2005/0183143(A1)	2005-08-01	Anderholm et al.	Applicant
US2006/0075504(A1)	2006-04-01	Liu	Applicant
US2006/0123464(A1)	2006-06-01	Goodman et al.	Applicant
US2006/0168066(A1)	2006-07-01	Helsper	Examiner
US2006/0174119(A1)	2006-08-01	Xu	Applicant
US2006/0271631(A1)	2006-11-01	Qureshi et al.	Applicant
US2007/0107053(A1)	2007-05-01	Shraim et al.	Applicant
US2007/0136806(A1)	2007-06-01	Berman	Applicant
US2007/0192855(A1)	2007-08-01	Hulten et al.	Applicant
US2007/0245422(A1)	2007-10-01	Hwang et al.	Applicant
US2007/0250618(A1)	2007-10-01	Hammond	Applicant
US2007/0294352(A1)	2007-12-01	Shraim et al.	Applicant
US2008/0037791(A1)	2008-02-01	Jakobsson	Applicant
US2008/0047017(A1)	2008-02-01	Renaud	Applicant
US2008/0052359(A1)	2008-02-01	Golan et al.	Applicant
US2008/0141342(A1)	2008-06-01	Curnyn	Applicant
US2008/0271124(A1)	2008-10-01	Nisbet et al.	Applicant
US2008/0288303(A1)	2008-11-01	Gray et al.	Examiner
US2008/0288330(A1)	2008-11-01	Hildebrand et al.	Applicant
US2009/0013041(A1)	2009-01-01	Farmer et al.	Examiner
US2009/0089859(A1)	2009-04-01	Cook et al.	Applicant
US2009/0144308(A1)	2009-06-01	Huie et al.	Applicant
US2009/0172772(A1)	2009-07-01	Souille	Applicant
US2009/0241168(A1)	2009-09-01	Readshaw	Examiner
US2009/0241173(A1)	2009-09-01	Troyansky	Applicant
US2009/0259725(A1)	2009-10-01	Rabinovich	Applicant
US2009/0265430(A1)	2009-10-01	Bechtel et al.	Applicant
US2009/0282112(A1)	2009-11-01	Prakash	Examiner
US2009/0319647(A1)	2009-12-01	White et al.	Applicant
US2009/0320137(A1)	2009-12-01	White et al.	Applicant
US2009/0328208(A1)	2009-12-01	Peters	Applicant
US2010/0017616(A1)	2010-01-01	Nichols et al.	Applicant
US2010/0043071(A1)	2010-02-01	Wang	Applicant
US2010/0125911(A1)	2010-05-01	Bhaskaran	Applicant
US2010/0138925(A1)	2010-06-01	Barai et al.	Examiner
US2010/0154055(A1)	2010-06-01	Hansen	Applicant
US2010/0211641(A1)	2010-08-01	Yih	Examiner
US2010/0235918(A1)	2010-09-01	Mizrahi et al.	Applicant
US2010/0281536(A1)	2010-11-01	Richards et al.	Applicant
US2010/0299292(A1)	2010-11-01	Collazo	Applicant
US2010/0306845(A1)	2010-12-01	Vaithilingam	Examiner
US2010/0313266(A1)	2010-12-01	Feng et al.	Applicant
US2011/0030059(A1)	2011-02-01	Greenwald	Applicant
US2011/0055922(A1)	2011-03-01	Cohen et al.	Applicant
US2011/0061089(A1)	2011-03-01	O'Sullivan et al.	Applicant
US2011/0072262(A1)	2011-03-01	Amir et al.	Applicant
US2011/0078795(A1)	2011-03-01	Liu	Examiner
US2011/0093546(A1)	2011-04-01	Rubingh	Examiner
US2011/0184877(A1)	2011-07-01	McHugh et al.	Applicant
US2011/0225652(A1)	2011-09-01	Emigh et al.	Examiner
US2011/0238855(A1)	2011-09-01	Korsunsky et al.	Applicant
US2012/0096553(A1)	2012-04-01	Srivastava et al.	Applicant
US2012/0124671(A1)	2012-05-01	Fritzson et al.	Examiner
US2012/0174235(A1)	2012-07-01	Hamilton et al.	Examiner
US2012/0258437(A1)	2012-10-01	Sadeh-Koniecpol	Examiner
US2012/0311669(A1)	2012-12-01	Akase	Applicant
US2012/0311703(A1)	2012-12-01	Yanovsky et al.	Applicant
US2012/0324576(A1)	2012-12-01	Clark et al.	Examiner
US2013/0018972(A1)	2013-01-01	Sargent et al.	Examiner
US2013/0031627(A1)	2013-01-01	Wang et al.	Applicant
US2013/0198846(A1)	2013-08-01	Chapman	Applicant
US2013/0203023(A1)	2013-08-01	Sadeh-Koniecpol et al.	Applicant
US2013/0268470(A1)	2013-10-01	Yablokov et al.	Applicant
JP2006-285844(A)	2006-10-01		Applicant
JP2007-323640(A)	2007-12-01		Applicant
WO2011/017196(A2)	2011-02-01		Applicant
WO2012/068255(A2)	2012-05-01		Applicant

Non-Patent Literature (128)

“School of Phish:A Real-World Evaluation of Anti-Phishing Training”, Ponnurangam Kumaraguru, Symposium on Usable Privacy and Security (SOUPS) Jul. 15-17, 2009.Examiner
Soni, Pravin, et al., “A Phishing Analysis of Web Based Systems,” /CCCS'11 Feb. 12-14, 2011, Rourke/a, Odisha, India, 2011, pp. 527-530, ACM, USA.Applicant
Jakobsson, Markus, “Modeling and Preventing Phishing Attacks,” Lecture Notes in Computer Science, Indiana University at Bloomington, 2005, pp. 1-19, Bloomington, IN.Applicant
Kumaraguru et al., “Lessons From a Real World Evaluation of Anti- Phishing Training”, 14 pages.Applicant
Robertson, “Amid the VIPERS Establishing Malware's Position Within the Information Ecosystem”, 54 pages.Applicant
Sheng et al., “Anti-Phishing Phil: The Design and Evaluation of a Game That Teaches People Not to Fall for Phish”, 14 pages.Applicant
Spinapolice, “Mitigating the Risk of Social Engineering Attacks”, 67 pages.Applicant
stratumsecurity.com, “Announcing ThreatSim— Stratum's Spear Phishing and Data Exfiltration SaaS Offering”, 1 pg.Applicant
Tsow et al., “Deceit and Deception: A Large User Study of Phishing”, 46 pages.Applicant
Wombat Security Technologies, “Wombat Security Technologies Offers Tips, Training, and Free Simulated Phishing Attacks to Help Companies and their Employees Avoid Holiday Phishing Scams”, 3 pages.Applicant
“Phishme: The Easy Way to Enhance Employee Phishing Awareness” , http://www.brighthub.com/computing/enterprise-security/reviews/5298.aspx; accessed Jul. 23, 2013; 5 pages.Applicant
Markus Jakobsson et al., “Designing Ethical Phishing Experiments: A study of (ROT13) rOnl query features”, Indiana University, Bloomington, IN 47406, USA, WWW 2006, May 23-26, 2006, Edinburgh, Scotland, ACM 1595933239/06/0005., 10 pages.Applicant
“To defeat phishing, Energy learns to phish” , gcn.com/Articles/2011/06/13/DOE-Phishing-Test.aspx?p=1, accessed Sep. 9, 2013, 3 pages.Applicant
“Humans are the Front Line' against Phishing for Intrepidus Group”, blog.executivebiz.com/2010/03/humans-are-the-front-line-against-phishing-for-intrepidus-group/, accessed Sep. 9, 2013; 3 pages.Applicant
“InfoSec: 23 percent of users fall for spear phishing”, www.scmagazine.com/infosec-23-percent-of-users-fall-for-spear-phishing/article/128480/#, accessed Sep. 9, 2013, 3 pages.Applicant
“Intrepidus Group and BrandProtect Partner to Offer Holistic Anti-Phishing Solution”, www.redorbit.com/news/technology/1670312/intrepidus—group—and—brandprotect—partner—to—offer—holistic—antiphishing—solution/, accessed Sep. 9, 2013; 3 pages.Applicant
Ponnurangam Kumaraguru et al, “Lessons From a Real World Evaluation of Anti-Phishing Training”, Carnegie Mellon University, 14 pages.Applicant
Thomas Claburn, “Phish Your Colleagues With PhishMe”, www.informationweek.com/security/client/phish-your-colleagues-with-phishme/209400255, accessed Sep. 9, 2013, 2 pages.Applicant
Jim Hansen, “Phishing for phishing awareness”, 2011-2013, 18 pages.Applicant
16. “PhishMe.com Overview” (2010) (Filename: “PhishMe Information for DHS.pdf”).Applicant
Tom Olzak, “Phishme: The Easy Way to Enhance Employee Phishing Awareness”, CISSP, updated: Jul. 4, 2011, www.brighthub.com/computing/enterprise-security/reviews/5298.aspx, accessed Sep. 9, 2013, 3 pages.Applicant
“Social Phishing” Tom N. Jagatic, Nathaniel A. Johnson, Markus Jakobsson, Filippo Menczer Communications of the ACM, vol. 50 No. 10, pp. 94-100.Applicant
“Reduce the risk from targeted phishing and malware attacks. On demand.”, Stratum Security, Jun. 2011, 2 pages.Applicant
“ThreatSim: Executive Summary”, Stratum Security, 2011, 6 pages.Applicant
Steve Sheng et al., “Who Falls for Phish? A Demographic Analysis of Phishing Susceptibility and Effectiveness of Interventions”, Carnegie Mellon University, Indraprastha Institute of Information Technology, ACM, Apr. 10-15, 2010, Atlanta, Georgia, USA,10 pages.Applicant
Zhang et al., “CANTINA: A Content-Based Approach to Detecting Phishing Web Sites”, WWW 2007 International World Wide Web Conference Committee (IW3C2), pp. 639-648 (May 2007).Applicant
Alnajim et al., “An Evaluation of Users' Anti-Phishing Knowledge Retention”, 2009 International Conference on Information Management and Engineering, pp. 210-214 (2009).Applicant
Alnajim et al., “An Approach to the Implementation of the Anti-Phishing Tool for Phishing Websites Detection”, 2009 International Conference on Intelligent Networking and Collaborative Systems, pp. 105-112 (2009).Applicant
PhishMe, http://www.Phishme.com/how—phishme—works.php, Dec. 4, 2011, 3 pgs.Applicant
PhishMe, http://www.phisme.com/what—is—phishme.php, Nov. 4, 2011, 3 pgs.Applicant
PhishMe, Phishme.com Internal Communication ha.ckers.org web application security lab, Mar. 6, 2008, 5 pgs.Applicant
U.S. Appl. No. 13/785,252, filed Mar. 5, 2013; Non Final Office Action mailed Jul. 1, 2013; 15 pages.Applicant
U.S. Appl. No. 13/785,252, filed Mar. 5, 2013; Response to Non Final Office Action dated Aug. 16, 2013; 15 pages.Applicant
Alnajim, Abdullah, et al., “An Anti-Phishing Approach that Uses Training Intervention for Phishing Websites Detection,” 2009 Sixth International Conference on Information Technology: New Generations, 2009, DD. 405-410, IEEE, USA.Applicant
Toolan, Fergus, et al., “Feature Selection for Spam and Phishing Detection,” 2010 eCrime Researchers Summit, 2010, pp. 1-12, IEEE, USA.Applicant
Fette, Ian, et al., “Learning to Detect Phishing Emails,” Carnegie Mellon Cyber Laboratory Technical Report CMU-CYLAB-06-012, Jun. 2006, pp. 1-12, Carnegie Mellon University, PA, USA.Applicant
Soni, Pravin, et al., “A Phishing Analysis of Web Based Systems,” ICCCS'11 Feb. 12-14, 2011, Rourke/a, Odisha, India, 2011, pp. 527-530, ACM, USA.Applicant
Alnajim, A., et al., “An Approach to the Implementation of the Anti-Phishing Tool for Phishing Websites Detection,” International Conference on Intelligent Networking and Collaborative Systems, 2009, p. 105-112, IEEE, USA.Applicant
He, Mingxing, et al., “An efficient phishing webpage detector,” Expert Systems with Applications, 2011, pp. 12018-12027, vol. 38, Elsevier Ltd., UK.Applicant
Zhang, Yue, et al., “CANTINA: A Content-Based Approach to Detecting Phishing Web Sites,” Proceedings of the 16th International Conference on World Wide Web, May 8-12, 2007, Banff, Alberta, Canada, May 2007, pp. 639-648, ACM, USA.Applicant
Wenyin, Liu, et al., “Detection of Phishing Webpages based on Visual Similarity,” 14th International Conference on World Wide Web, May 10-14, 2005, Chiba, Japan, DD. 1060-1061, ACM, USA.Applicant
Parno, Bryan, et al., “Phoolproof Phishing Prevention,” CyLab Carnegie Mellon University, Dec. 3, 2005, 16 pages, Carnegie Mellon University, PA, USA.Applicant
Dhamija, Rachna, et al., “The Battle Against Phishing: Dynamic Security Skins,” Symposium on Usable Privacy and Security (SOUPS) 2005, Jul. 6-8, 2005, Pittsburgh, PA, USA, 12 pages.Applicant
Huang, Chun-Ying, et al., “Using one-time passwords to prevent password phishing attacks,” Journal of Network and Computer Applications, 2011, DD. 1-10, Elsevier B.V., NL.Applicant
Jackson, Collin, et al., “An Evaluation of Extended Validation and Picture-in-Picture Phishing Attacks,” Financial Cryptography and Data Security, 2007, 13 pages, Springer-Verlag, DE.Applicant
Kang, Le, et al., “CAPTCHA Phishing: A Practical Attack on Human Interaction Proofing,” Inscrypt 2009, LNCS 6151, 2010, pp. 411-425, Springer-Verlag, DE.Applicant
Dazeley, Richard, et al, “Consensus Clustering and Supervised Classification for Profiling Phishing Emails in Internet Commerce Security,” PKAW 2010, LNAI 6232, 2010, pp. 235-246, Springer-Verlag, DE.Applicant
Jakobsson, Markus, “Modeling and Preventing Phishing Attacks,” FC'05 Proceedings of the 9th international conference on Financial Cryptography and Data Security, 2005, pp. 1-19.Applicant
Dhamija, Rachna, et al., “Why Phishing Works,” Proceeding ofCHI-2006: Conference on Human Factors in Computing Systems, Apr. 2006, 10 pages.Applicant
Wu, Min, et al., “Do Security Toolbars Actually Prevent Phishing Attacks?,” CHI 2006, Apr. 22-27, 2006, Montreal, Quebec, Canada, 2006, 10 pages, ACM, USA.Applicant
Zhang, Yue, et al., “Phinding Phish: Evaluating Anti-Phishing Tools,” Proceedings of the 14th Annual Network and Distributed System Security Symposium (NOSS 2007), 2007, 16 pages.Applicant
Egelman, Serge, et al., “You've Been Warned: An Empirical Study of the Effectiveness of Web Browser Phishing Warnings,” CHI 2008, Apr. 5-10, 2008, Florence, Italy, 2008, 10 pages, ACM, USA.Applicant
Downs, Julie, et al., “Decision Strategies and Susceptibility to Phishing,” Symposium on Usable Privacy and Security (SOUPS), Jul. 12-14, 2006, Pittsburgh, PA, USA, 2006, 12 pages.Applicant
Wright, Ryan, et al., “The Influence of Experiential and Dispositional Factors in Phishing: An Empirical Investigation of the Deceived,” Journal of Management Information Systems, Summer 2010, IPP. 273-303, vol. 27, No. 1, M.E. Sharpe, Inc., USA.Applicant
Sheng, Steve, et al., “Who Falls for Phish? A Demographic Analysis of Phishing Susceptibility and Effectiveness of Interventions,” CHI 2010, Apr. 10-15, 2010, Atlanta, Georgia, USA, 2010, 10 pages, ACM, USA.Applicant
Vishwanath, Arun, et al., “Why do people get phished? Testing individual difference in phishing vulnerability within an integrated, information processing model,” Decision Support Systems, 2011, IDD. 576-586, vol. 51, Elsevier B.V., NL.Applicant
Alnajim, Abdullah, et al., “An Evaluation of Users' Anti-Phishing Knowledge Retention,” 2009 International Conference on Information Management and Engineering, 2009, pp. 210-214, IEEE, USA.Applicant
Sheng, Steve, et al., “Anti-Phishing Phil: The Design and Evaluation of a Game That Teaches People Not to Fall for Phish,” Symposium on Usable Privacy and Security (SOUPS) 2007, Jul. 18-20, 2007, Pittsburgh, PA, USA, 2007, 12 pages.Applicant
Kumaraguru, Ponnurangam, et al., “Protecting People from Phishing: The Design and Evaluation of an Embedded Training Email System,” Proceeding of the SIGCHI Conference on Human Factors in Computing Systems, Apr. 2007, pp. 1-10, ACM, USA.Applicant
Blom, Elma, et al., “Dummy auxiliaries in child and adult second language acquisition of Dutch,” Lingua, 2011, pp. 906-919, vol. 121, Elsevier B.V., NL.Applicant
Radford, Andrew, et al., “On the Acquisition of Universal and Parameterised Goal Accessibility Constraints by Japanese Learners of English,” Essex Research Reports in Linguistics, Mar. 2011, 46 pages (cover and second page, and DD. 1-44), vol. 60, No. 5, University of Essex, UK.Applicant
Dominiguez, Laura, et al., “Testing the Predictions of the Feature Assembly Hypothesis Evidence from the L2 Acquisition of Spanish Aspect Morphology,” Proceedings of the Boston University Conference on Language Development, 2011, 14 pages, vol. 35, Cascadilla Press, MA, USA.Applicant
Bliton, Daniel, et al., “Unannounced Phishing Exercises and Targeted Training: Results and Lessons Learned,” Interservice/Industry Training, Simulation, and Education Conference (11/TSEC), 2011, pp. 1-11, Paper No. 11342, I/ITSEC, USA.Applicant
Adams, Elizabeth, et al., “Brief Overview: Mandatory Training—A Systematic Review of Research NPL and Trends in Learning Organizations,” Veterans Health Administration Office of Patient Care Services Technology Assessment Program, TAP Brief Overview, Mar. 2010, 23 pages (cover page, pp. i-iii, and pp. 1-19), VA Technology Assessment Program, Boston, MA, USA.Applicant
Ferguson, Aaron J., “Fostering E-Mail Security Awareness: The West Point Carronade,” Educause Quarterly, 2005, pp. 54-57, vol. 28, No. 1, Educause Online Publication, http://www.educause.edu/eq.Applicant
Hidi, Suzanne, et al., “Strategies for increasing text-based interest and students' recall of expository texts,” Reading Research Quarterly, Fall 1988, pp. 465-483, XX.111/4, International Reading Association, Delaware, USA.Applicant
Klevinsky, T. J., et al., Chapter 3—Penetration for Hire, HACK I. T.—Security Through Penetration Testing, 2002, DD. 25-27, Addison-Wesley Professional, Pearson Education Ltd, USA.Applicant
Sadoski, Mark, “Resolving the Effects of Concreteness on Interest, Comprehension, and Learning Important Ideas From Text,” Educational Psychology Review, 2001, pp. 263-281, vol. 13, No. 3, Plenum Publishing Corporation, NY, USA.Applicant
Simulating malicious emails to educate end users on-demand, Jansson, Kenny; Von Solms, Rossouw, IEEE Symposium on Web Society, p. 74-80, 2011, ISSN: 21586985, E-ISSN: 21586993; ISBN-13: 9781457702112; 2011 3rd Symposium on Web Society, SWS2011, Oct. 26, 2011-Oct. 28, 2011, Institute for ICT Advancement, Nelson Mandela Metropolitan University, Port Elizabeth, South Africa.Applicant
School of phish: a real-world evaluation of anti-phishing training, Ponnurangam Kumaraguru; Justin Cranshaw; Alessandro Acquisti; Lorrie Cranor; Jason Hong; Mary Ann Blair; Theodore Pham, Carnegie Mellon University, SOUPS '09 Proceedings of the 5th Symposium on Usable Privacy and Security, Article No. 3, ISBN: 978-1-60558-736-3; doi:10.1145/1572532.1572536, 12 pages.Applicant
Design a mobile game for home computer users to prevent from “phishing attacks”, Arachchilage, Nalin Asanka Garnagedara; Cole, Melissa, International Conference on Information Society, i-Society 2011, p. 485-489, 2011, ISBN-13: 9780956426383; Article No. 5978543, International Conference on Information Society, i-Society 2011, Jun. 27, 2011-Jun. 29, 2011, School of Information Systems, Computing and Mathematics, Brunel University, Uxbridge, Middlesex, United Kingdom.Applicant
Kumaraguru et al., “Lessons From a Real World Evaluation of Anti-Phishing Training”, 14 pages.Applicant
Robertson, “Amid the VIPERS Establishing Malware's Position Within the Information Ecosystem”, 54 pages, 2011.Applicant
Sheng et al., “Anti-Phishing Phil: The Design and Evaluation of a Game That Teaches People Not to Fall for Phish”, 14 pgs, 2007.Applicant
Spinapolice, “Mitigating the Risk of Social Engineering Attacks”, 67 pgs. 2011.Applicant
Trevor, “Stratum Security, Announcing ThreatSim—Stratum's Spear Phishing and Data Exfiltration SaaS Offering”, 1 pg, 2013.Applicant
Alex Tsow and Markus Jakobsson, “Deceit and Deception: A Large User Study of Phishing”, 46 pages, 2007.Applicant
Wombat Security Technologies, “Wombat Security Technologies Offers Tips, Training, and Free Simulated Phishing Attacks to Help Companies and their Employees Avoid Holiday Phishing Scams”, 3 pages, 2011.Applicant
Steve Sheng, Mandy Holbrook, Ponnurangam Kumaraguru, Lorrie Cranor, Julie Downs, “Who Falls for Phish? A Demographic Analysis of Phishing Susceptibility and Effectiveness of Interventions” CHI 2010, Apr. 10-15, 2010, Atlanta, GA, USA, 10 pages.Applicant
“Phishme: The Easy Way to Enhance Employee Phishing Awareness” , http://www.brighthub.com/computing/enterprise-security/reviews/5298.aspx; accessed Jul. 23, 2013; Jul. 4, 2011, 3 pages.Applicant
“What is PhishMe?”, http://phishme.com/whatisphishme.html; accessed Jul. 23, 2013; 2 pages.Applicant
Aaron Higbee, “Phishme.Com—Techincal Paper”, 2009, 10 pages.Applicant
Art Fritzson et al, U.S. Appl. No. 61/414,142, filed Nov. 16, 2010, “Phishing Awareness Training (PAT) Distinction Components” 39 pages.Applicant
K.Jansson and R. von Solms, “Social Engineering: Towards a Holistic Solution,” presented at the South African Information Security Multi-Conference, Port Elizabeth, South Africa, 2010.Applicant
“WhiteGold goes fishing for phishing”, www.arnnet.com.au/article/299134/whitegold—goes—fishing—phishing/, accessed Jul. 23, 2013, Apr. 14, 2009, 3 pages.Applicant
“United States Military Academies to Use PhishMe to Combat Spear Phishing”, msmvps.com/blogs/donna/archive/2009/07/24/united-states-military-academies-to-use-phishme-to-combat-spear-phishing.aspx, accessed Jul. 24, 2009, 1 pg.Applicant
“What is PhishMe?”, accessed at http://web.archive.org/web/20111104184530/http://www.phishme.com/what—is—phishme.php on May 9, 2015, 2 pgs., (Nov. 4, 2011).Applicant
Jansson,Kenny, “A Model for Cultivating Resistance to Social Engineering Attacks”, Dissertation, Sep. 2011, with attachments.Applicant
“Anti-phishing training adds attachments to mix”, www.networkworld.com/news/2009/090209-anti-phishing-training-adds-attachments-to.html, accessed Sep. 9, 2013, 2009, 3 pages.Applicant
Victor Garza, “Product review: Core Impact penetration tester goes phishing”, www.infoworld.com/print/31390, accessed Sep. 9, 2013, 2008, 3 pages.Applicant
Markus Jakobsson et al., “Designing Ethical Phishing Experiments: A study of (ROT13) rOnl query features”, Indiana University, Bloomington, IN 47406, USA, WWW 2006, May 23-26, 2006, Edinburgh, Scotland, ACM 1595933239106/0005., 10 pages.Applicant
“To defeat phishing, Energy learns to phish”, gcn.com/Articles/2011/06/13/DOE-Phishing-Test.aspx?p=1, accessed Sep. 9, 2013, 2011, 3 pages.Applicant
“Humans are the Front Line' against Phishing for Intrepidus Group”, blog.executivebiz.com/2010/03/humans-are-the-front-line-against-phishing-for-intrepidus-group/, accessed Sep. 9, 2013, 2010, 3 pages.Applicant
“InfoSec: 23 percent of users fall for spear phishing”, www.scmagazine.com/infosec-23-percent-of-users-fall-for-spear-phishing/article/128480/#, accessed Sep. 9, 2013, 2009, 3 pages.Applicant
“Intrepidus Group and BrandProtect Partner to Offer Holistic Anti-Phishing Solution”, www.redorbit.com/news/technology/1670312/intrepidus—group—and—brandprotect—partner—to—offer—holistic—antiphishing—solution/, accessed Sep. 9, 2013, 2009, 3 pages.Applicant
Ponnurangam Kumaraguru, “PhishGuru: A System for Educating Users about Semantic Attacks”, 2009 dissertation, School of Computer Science, Institute for Software Research, Carnegie Mellon University, Pittsburgh, PA 15213, 198 pages.Applicant
“Phishing for user security awareness” Dodge, Ronald C.; Carver, Curtis; Ferguson, Aaron J. Computers & Security , vol. 26 (1), Elsevier, Feb. 1, 2007, 8 pages.Applicant
“One-Quarter of Worldwide Population at Risk of Spear Phishing Attacks”, www.certmag.com/read.php?in=5245, accessed Sep. 9, 2013, 2 pages.Applicant
Thomas Claburn, “Phish Your Colleagues With PhishMe”, www.informationweek.com/security/client/phish-your-colleagues-with-phishme/209400255, accessed Sep. 9, 2013, Jul. 22, 2008, 2 pages.Applicant
K. Jansson and R. von Solms, “Phishing for phishing awareness”, 2011-2013, 18 pages.Applicant
“PhishMe.com Overview”, 2010.Applicant
“Phishme.com Internal Communication” , ha.ckers.org/blog/20080306/phishmecom-internal-communication/, accessed Sep. 9, 2013, 5 pages.Applicant
Phishme,com, “Introduction to PhishMe.com”, Nov. 2010, 15 pages.Applicant
K. Jansson and R. von Solms, “Phishing for phishing awareness,” Behaviour & Information Technology, pp. 1-10, 2011.Applicant
Lori Faith Cranor, “Can Phishing Be Foiled?”, Scientific American, Dec. 2008, 7 pages.Applicant
“Social Phishing” Tom N. Jagatic, Nathaniel A. Johnson, Markus Jakobsson, Filippo Menczer Communications of the ACM, vol. 50 No. 10, pp. 94-100, Oct. 2007.Applicant
“Reduce the risk from targeted phishing and malware attacks. On demand.”, Stratum Security, 2011, 2 pages.Applicant
“ThreatSim: Executive Summary”, Stratum Security, 2011, 6 pagesApplicant
K. Jansson and R. von Solms, “Towards a Social Engineering Resistant User Model,” presented at 13th Annual Conference on WWW Applications, Johannesburg, South Africa (2011).Applicant
“An Empirical Evaluation of PhishGuruTM Embedded Training” Wombat Security Technologies, Apr. 2009, 12 pages.Applicant
“What is PhishMe?”, Interpidus Group, 2009, 1 page.Applicant
Rohyt Belani, “Spear Phishing Train Your Workforce to Dodge the Hook” 2009, 26 pages.Applicant
“Phishme.com Internal Communication”, ha.ckers.org web application security lab, Mar. 6, 2008, 5 pgs.Applicant
“How PhishMe Works”, accessed at http://web.archive.org/web/20111204012721/http://phishme.com/how—phishme—works.php on May 9, 2015, 2 pgs. (Dec. 4, 2011).Applicant
How to Create a Self-Signed Digital Certificate in Microsoft Office 2010, Nov. 20, 2010.Applicant
Building an encrypted and searchable audit log, 11th Annual Network and Distributed Security Symposium (NDSS '04), Feb. 5-6, 2004.Applicant
Automatically Encrypting all Incoming Email; Jan. 13, 2011.Applicant
Ponnurangam Kumaraguru, et al., “Protecting People from Phishing: The Design and Evaluation of an Embedded Training Email System”, Institute for Software Research, Human Computer Interaction Institute, Heinz School of Public Policy, Engineering and Public Policy, Carnegie Mellon University, 2007, 10 pages.Applicant
“WhiteGold goes fishing for phishing”, www.arnnet.com.au/article/299134/whitegold—goes—fishing—phishing/, accessed Jul. 23, 2013, 3 pages.Applicant
“United States Military Academies to Use PhishMe to Combat Spear Phishing”, msmvps.com/blogs/donna/archive/2009/07/24/united-states-military-academies-to-use-phishme-to-combat-spear-phishing.aspx, accessed Jul. 24, 2013, 1 pg.Applicant
Brian M. Bowen et al., “Measuring the Human Factor of Cyber Security”, Department of Computer Science Columbia University, 2011, 6 pages.Applicant
Aaron J. Ferguson, “Fostering E-Mail Security Awareness: The West Point Carronade”, Educause Quarterly, No. 1, 2005, 4 pages.Applicant
Images from PhishMe Shockwave Animation (2008), 4 pages.Applicant
Jansson,Kenny, “A Model for Cultivating Resistance to Social Engineering Attacks”, Dissertation, Sep. 2011, with attachments: a. Jansson, K., & von Solms, R., “Social Engineering: Towards a Holistic Solution,” presented at the South African Information Security Multi-Conference, Port Elizabeth, South Africa (2010), b. Jansson, K., & von Solms, R., “Towards a Social Engineering Resistant User Model,” presented at 13th Annual Conference on WWW Applications, Johannesburg, South Africa, (2011), c. Jansson, K., & von Solms, R., “Simulating Malicious Emails to Educate End Users on-Demand”, Kenny Jansson and Rossouw von Solms, Institute for ICT Advancemnet Nelson Mandela Metropolitan University, Port Elizabeth South Africa 2011 IEEE.Applicant
“Anti-phishing training adds attachments to mix”, www.networkworld.com/news/2009/090209-anti-phishing-taining-adds-attachments-to.html, accessed Sep. 9, 2013, 3 pages.Applicant
“Core Impact penetration tester goes phishing”, InfoWorld, Jan. 7, 2008, 2 pages.Applicant
“Core Impact 7.5”, www.infoworld.com/print/31390, SC Magazine, Aug. 2008, 1 page.Applicant
Victor Garza, “Product review: Core Impact penetration tester goes phishing”, www.infoworld.com/print/31390, accessed Sep. 9, 2013, 3 pages.Applicant

Abstract

Description

Related Applications

Field of the Invention

Background

Summary of the Invention

[0008] These and other embodiments of the invention are further described in the description that follows.

Brief Description of the Drawings

[0009] The present invention is illustrated by way of example, and not limitation, in the figures of the accompanying drawings in which:

[0010] FIG. 1 depicts a system diagram with a collection of interconnected network devices, computing devices and databases, according to one embodiment;

[0011] FIG. 2 depicts an example log of simulated phishing attacks, according to one embodiment;

[0012] FIG. 3 depicts example responses of individuals to simulated phishing attacks, according to one embodiment;

[0013] FIG. 4 depicts example trustworthiness levels, according to one embodiment;

[0015] FIG. 6 depicts a flow diagram of a process performed in response to a message being identified by one or more individuals as a possible phishing attack, according to one embodiment.

Detailed Description of the Invention

- [0026] 1. Each time an individual reports a simulated phishing attack, that individual receives 1 point.
- [0027] 2. Each time an individual ignores a simulated phishing attack, that individual receives 0 points.
- [0028] 3. Each time an individual falls victim to a simulated phishing attack, that victim is penalized 1 point (i.e., receives −1 point).
  Therefore, Ann's trustworthiness level is calculated as follows: 1+−1+0+1=1. Bob's trustworthiness level is calculated as follows: 1+1+1+1=4. Chip's trustworthiness level is calculated as follows: −1+−1+1+−1=−2. Of course, such computation and point values are exemplary, and other computations and point values to arrive at a trustworthiness level are possible.