METHOD FOR DETECTING PHISHING DOMAIN NAMES Russian patent published in 2022 - IPC G06F21/55 G06F21/64 

FIELD: information security.

SUBSTANCE: invention relates to the field of information security. The expected result is achieved due to the fact that the detection method contains stages at which: a set of legitimate domain names are set up; a set of pseudo-phishing domain names is created by making changes to legitimate names; for each pseudo-phishing domain name, the estimated distance to a set of legitimate names is determined and a one-dimensional numerical array from the calculated distances is formed; on the basis of which the threshold calculated distance is determined; the received domain name is analyzed: the calculated distance to the set of legitimate names is determined; if the calculated distance is zero, then this name is considered legitimate; if the calculated distance is not zero, then: the calculated distance is compared with the threshold calculated distance; if the calculated distance is greater than the threshold, then this domain name not considered phishing; if the calculated distance is less than or equal to the threshold, then this name is considered phishing and the following actions are performed: a legitimate domain name is determined for this domain name, to which the normalized distance is minimal; a report on the detected phishing domain name is generated; processing of this domain name is completed.

EFFECT: increase in the probability of detecting phishing domain names.

3 cl, 7 tbl, 2 dwg