1. In a computing system that includes a processor, data storage, and inputoutput devices including a network interface device, a method for automatically developing detection rules, the method comprising:
(a) obtaining, by the computing system, incoming data directed to a destination;
(b) detecting, by the computing system, any indicia of phishing present in the incoming data, the detecting being performed by application of a plurality of phishing detection rules;
(c) computationally determining, by the computing system, a quantitative score for each of a plurality of predefined parameters, each of the parameters relating to at least one of the phishing indicia, and each quantitative score representing a likelihood of a presence of phishing content in the incoming data for the at least one of the phishing indicia;
(d) assessing, by the computing system, a requirement for evolving a phishing detection rule, including applying a predefined set of rule evolution criteria to a combination of the determined quantitative scores of a plurality of parameters;
(e) in response to an assessment of the requirement for evolving a phishing rule, generating, by the computing system, a new phishing detection rule based on selected parameter scores meeting the rule evolution criteria and on corresponding content of the phishing indicia relating to those selected parameter scores;
by the computing system, recursively performing (b)-(e) based on any new phishing detection rules having been evolved in (e);
identifying, by the computing system, any phishing-related objects based on selected parameter scores exceeding a phishing detection threshold and on corresponding content of the phishing indicia relating to those selected parameter scores;
modifying, by the computing system, content relating to the phishing-related objects in the incoming data to remove or reduce maliciousness of the phishing-related objects.
2. The method of claim 1, wherein in obtaining the incoming data, the destination to which the incoming data is directed is a remote client computer system.
3. The method of claim 1, wherein obtaining the incoming data includes intercepting incoming data prior to arrival of the incoming data at the destination.
4. The method of claim 1, wherein detecting any indicia of phishing present in the incoming data includes emulating, in an isolated computing environment, any code that is present in the incoming data.
5. The method of claim 1, further comprising:
categorizing, by the computing system, items of content of the intercepted data into a plurality of predefined categories representing different types of content, wherein each category is associated with a corresponding set of the parameters.
6. The method of claim 5, wherein generating a new phishing detection rule includes re-categorizing certain items of content of the intercepted data into other categories, and applying phishing detection rules for those other categories to those certain items of content.
7. The method of claim 1, wherein in computationally determining the quantitative score for each of the parameters, at least one quantitative score represents a result of application of a combination of different phishing detection rules to detect a related combination of phishing indicia.
8. The method of claim 1, wherein the rule evolution criteria includes a first rule evolution threshold against which the combination of the determined quantitative scores are applied.
9. The method of claim 8, wherein the first rule evolution threshold is different from the phishing detection threshold.
10. The method of claim 8, wherein the first rule evolution threshold is the same as the phishing detection threshold.
11. The method of claim 8, wherein the rule evolution criteria includes a second rule evolution threshold against which the combination of the determined quantitative scores are applied, the second rule evolution threshold being lower than the first rule evolution threshold, wherein the rule evolution criteria is met when any individual quantitative score of the combination exceeds the first rule evolution threshold, and wherein the rule evolution criteria is independently met when a specified plurality of quantitative scores of the combination exceeds the second rule evolution threshold.
12. The method of claim 1, wherein the rule evolution criteria includes a rule evolution threshold against which the an aggregation of the determined quantitative scores of the combination are applied.
13. The method of claim 1, wherein in recursively performing (b)-(e), multiple successive iterations of (b)-(e) are performed, and wherein each new phishing detection rule is applied to the same incoming data from a previous iteration.
14. A system for automatically developing detection rules for detecting phishing content, the system comprising:
a computing platform having a processor, data storage, and a network interface device the computing platform containing instructions that, when executed by the computing platform, cause the computing platform to implement:
a data capture engine configured to obtain incoming data directed to a destination;
a phishing content detection engine operatively coupled to the data capture engine and configured to detect any indicia of phishing present in the incoming data, the detection being based on application of a plurality of phishing detection rules, and to determine a quantitative score for each of a plurality of predefined parameters, each of the parameters relating to at least one of the phishing indicia, and each quantitative score representing a likelihood of a presence of phishing content in the incoming data for the at least one of the phishing indicia;
a rule development engine operatively coupled to the phishing content detection engine and configured to:
assess a requirement for evolving a phishing detection rule, based on application of a predefined set of rule evolution criteria to a combination of the determined quantitative scores of a plurality of parameters by the phishing content detection engine;
generate a new phishing detection rule based on selected parameter scores meeting the rule evolution criteria and on corresponding content of the phishing indicia relating to those selected parameter scores in response to an assessment of the requirement for evolving a phishing rule;
pass the new phishing detection rule to the phishing content detection engine to cause the phishing content detection engine to apply the new phishing detection rule to the incoming data;
recursively assess the requirement for evolving a phishing detection rule, and generate a new phishing rule in response to application of a new phishing detection rule to the incoming data;
a phishing content identifier engine operatively coupled to the phishing content detection engine and the rule development engine, and configured to identify any phishing-related objects based on selected parameter scores exceeding a phishing detection threshold and on corresponding content of the phishing indicia relating to those selected parameter scores; and
a modification engine configured to modify content relating to the phishing-related objects in the incoming data to remove or reduce maliciousness of the phishing-related objects.
15. The system of claim 14, wherein the destination to which the incoming data is directed is the computing platform.
16. The system of claim 14, wherein the data capture engine is part of a proxy.
17. The system of claim 14, wherein the data capture engine is implemented as part of a driver executing on the computing platform.
18. The system of claim 14, wherein the data capture engine includes an interceptor engine configured to intercept incoming data prior to arrival of the incoming data at the destination.
19. The system of claim 14, wherein the data capture engine includes an emulator engine configured to execute, in an isolated computing environment, any code that is present in the incoming data.
20. The system of claim 14, wherein the data capture engine includes a categorization engine configured to categorize items of content of the intercepted data into a plurality of predefined categories representing different types of content, wherein each category is associated with a corresponding set of the parameters.
21. The system of claim 20, wherein the rule development engine is configured to generate the new phishing detection rule in response to a re-categorization of certain items of content of the intercepted data into other categories, and application of phishing detection rules for those other categories to those certain items of content.
22. The system of claim 14, wherein at least one quantitative score represents a result of application of a combination of different phishing detection rules to detect a related combination of phishing indicia.
23. The system of claim 14, wherein the rule evolution criteria includes a first rule evolution threshold against which the combination of the determined quantitative scores are applied.
24. The system of claim 23, wherein the first rule evolution threshold is different from the phishing detection threshold.
25. The system of claim 23, wherein the first rule evolution threshold is the same as the phishing detection threshold.
26. The system of claim 23, wherein the rule evolution criteria includes a second rule evolution threshold against which the combination of the determined quantitative scores are applied, the second rule evolution threshold being lower than the first rule evolution threshold, wherein the rule evolution criteria is met when any individual quantitative score of the combination exceeds the first rule evolution threshold, and wherein the rule evolution criteria is independently met when a specified plurality of quantitative scores of the combination exceeds the second rule evolution threshold.
27. The system of claim 14, wherein the rule evolution criteria includes a rule evolution threshold against which the an aggregation of the determined quantitative scores of the combination are applied.
28. A computing system for automatically developing detection rules, the system comprising:
means for obtaining incoming data directed to a destination;
means for detecting any indicia of phishing present in the incoming data, the detecting being performed by application of a plurality of phishing detection rules;
means for determining a quantitative score for each of a plurality of predefined parameters, each of the parameters relating to at least one of the phishing indicia, and each quantitative score representing a likelihood of a presence of phishing content in the incoming data for the at least one of the phishing indicia;
means for assessing a requirement for evolving a phishing detection rule, including applying a predefined set of rule evolution criteria to a combination of the determined quantitative scores of a plurality of parameters;
means for evolving a phishing rule, including means for generating a new phishing detection rule based on selected parameter scores meeting the rule evolution criteria and on corresponding content of the phishing indicia relating to those selected parameter scores;
means for recursively performing detecting indicia of phishing, determining quantitative score s, assessing a requirement for evolving rules, and evolving a phishing rule based on any new phishing detection rules having been previously evolved;
means for identifying any phishing-related objects based on selected parameter scores exceeding a phishing detection threshold and on corresponding content of the phishing indicia relating to those selected parameter scores; and
means for modifying content relating to the phishing-related objects in the incoming data to remove or reduce maliciousness of the phishing-related objects.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
We claim:
1. An animal registration system comprising:
a tag for a neck or a limb;
said tag having an email address affixed thereon;
wherein said email address is identifiable with a specific animal; and
wherein a finder of the animal can contact a pre-assigned individual about said animal by sending an email message to said email address on the tag and receiving said pre-assigned individual’s contact information by return email from a database.
2. The system of claim 1, wherein the database further comprises at least the following fields:
a) owner name
b) owner address
c) owner phone number(s)home, office, etc.
d) owner email address
e) emergency contact number(s)
f) veterinary or doctor contact number(s)
g) pet name, description
h) anonymity of owner wanted or not wanted
i) email address registered
j) reward information if applicable
k) other fields expandable as required.
3. The system of claim 2, wherein the tag further comprises a contact phone number.
4. The system of claim 3, wherein the database further comprises a logic module to provide web or phone access thereto, a user programmable algorithm for confirming the animal identity and for contacting the owner and emergency contacts in a desired manner.
5. The system of claim 4, wherein the algorithm further comprises sending reward and special notice data back to the finder of the animal.
6. An email registration system for an article comprising:
a tag which is attachable to said article;
said tag having an email address affixed thereon; and
wherein said email address is identifiable with a specific article, thereby allowing a finder to contact a pre-assigned individual about said article automatically by sending an email message to said email address on the tag and receiving said individual’s contact information by return email from a database.
7. A method to identify a seeker of a loststolen animal, human, or article via a registered tag having a specific email address affixed thereon and assigned to said loststolen animal, human or article, said method comprising the steps of:
sending an email message to said specific email address on the registered tag; and
obtaining information about said seeker of said loststolen animal, human, or article via an email message from a central database.
8. A method of registering an animal, an individual or an article via a registration system, said method comprising the steps of:
affixing an email ID address on a tag;
providing said tag to a purchaser who places said tag on the animal, individual or article to be registered; and
registering said email ID address located on the tag by inputting data at a central service provider website into a universal database, thereby allowing a finder of the animal to send an email message to the email ID address on the tag, to automatically query said universal database for seeker andor emergency contact information, to receive seeker andor emergency contact information, and to contact the seeker andor emergency contact to enable the seeker’s andor emergency contact’s retrieval of said animal, individual or article.
9. The process as recited in claim 8, wherein the registration step further comprises inputting physical andor name description of said animal, individual or article, said email address ID, owner contact information, emergency contact information, or reward information, if applicable into the universal database.
10. The process as recited in 8, wherein the registration step further comprises inputting information into a universal database having at least the following fields:
l) owner name
m) owner address
n) owner phone number(s)home, office, etc.
o) owner email address
p) emergency contact number(s)
q) veterinary or doctor contact number(s)
r) pet name, description
s) anonymity of owner wanted or not wanted
t) email address registered
u) reward information if applicable
v) other fields expandable as required.
11. The process as recited in claim 10, wherein the step of affixing an email ID address on a tag further comprises affixing a contact phone number on said tag.
12. The process as recited in claim 11, wherein the registration step further comprises inputting data into a universal database having a logic module to provide web or phone access thereto, a user programmable algorithm for confirming the animal identity and for contacting the owner and emergency contacts in a desired manner.
13. The process as recited in claim 12, wherein the registration step further comprises programming the user programmable algorithm to send reward and special notice data back to the finder of the animal.