IDENTIFYING PHISHING COMMUNICATIONS USING TEMPLATES

摘要

Methods, apparatus, systems, and computer-readable media are provided for determining whether communications are attempts at phishing. In various implementations, a potentially-deceptive communication may be matched to one or more templates of a plurality of templates. Each template may represent content shared among a cluster of communications sent by a trustworthy entity. In various implementations, it may be determined that an address associated with the communication is not affiliated with one or more trustworthy entities associated with the one or more matched templates. In various implementations, the communication may be classified as a phishing attempt based on the determining.

主权项

1. A computer-implemented method, comprising:
comparing, by one or more processors, content of a communication to indexed content of a plurality of templates, each template associated with a trustworthy entity and representing indexed content shared among a cluster of communications sent by the trustworthy entity; identifying, by the one or more processors based on the comparing, one or more matched templates; determining, by the one or more processors, that an address associated with the communication is not affiliated with one or more trustworthy entities associated with the one or more matched templates; and classifying, by the one or more processors based on the determining, the communication as a phishing attempt.