US20200396252A1

US20200396252A1 - Systems and methods for identifying phishing websites

Info

Publication number: US20200396252A1
Application number: US16/921,581
Authority: US
Inventors: Ulrich Buergi; Florian Angehrn
Original assignee: Swisscom AG
Current assignee: Swisscom AG
Priority date: 2015-07-27
Filing date: 2020-07-06
Publication date: 2020-12-17
Also published as: US20170034211A1; EP3125147B1; EP3125147A1; US10708302B2

Abstract

Systems and methods are provided for automatically detecting phishing attacks. A sequence of network traffic events may be detecting within network traffic, the sequence including an initial communication from a network address to a first other network address, a first subsequent communication from the first other network address at a first time, and a second subsequent communication from the network address to a second other network address at a second time subsequent to the first time. The first other network address may be classified as a potential phishing website based on determining that the second other network address is not related to the first other network address, and that a time difference between the second time and the first time meets predefined criteria. Protective measures may be taken in response to the classifying, with the protective measures including at least blocking the first other network address.

Description

CLAIM OF PRIORITY

This patent application is a continuation of U.S. patent application Ser. No. 15/220,029, filed Jul. 26, 2016 (now issued U.S. Pat. No. 10,708,302), which pursuant to 35 U.S.C. § 119 claims the filing date benefit of, and right of priority to Swiss (CH) Patent Application No. 01087/15, filed Jul. 27, 2015. Each of the above applications is hereby incorporated herein by reference in its entirety.

TECHNICAL FIELD

The present disclosure relates to networking. In particular, various embodiments in accordance with the present disclosure relate to systems and methods for automatic detection of phishing websites.

BACKGROUND

Conventional methods and systems for detecting phishing websites, if any existed, can be costly, cumbersome and inefficient. In this regard, the term “phishing” generally refers to the concept of tricking a user (e.g., a computer user) into submitting personal information to a bogus website. Phishing may also refer to the techniques used to trick users. The personal information, such as generally private identifying information, login information for online banking, financial information (e.g., credit card numbers), and other valuable information, is then often used to commit fraud, including identity theft.
Further limitations and disadvantages of conventional and traditional approaches will become apparent to one of skill in the art, through comparison of such systems with some aspects of the present invention as set forth in the remainder of the present application with reference to the drawings.

BRIEF SUMMARY

Systems and/or methods are provided for identifying a phishing website, substantially as shown in and/or described in connection with at least one of the figures, as set forth more completely in the claims.
These and other advantages, aspects and novel features of the present invention, as well as details of an illustrated embodiment thereof, will be more fully understood from the following description and drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

Various features and advantages of the disclosure will become apparent from the following description of non-limiting exemplary embodiments, with reference to the appended drawings, in which:

FIG. 1 is a block diagram illustrating components of an example phishing detection system, in accordance with the present disclosure.

FIG. 2 illustrates example network traffic pattern, in accordance with the present disclosure.

DETAILED DESCRIPTION

As utilized herein the terms “circuits” and “circuitry” refer to physical electronic components (e.g., hardware) and any software and/or firmware (“code”) which may configure the hardware, be executed by the hardware, and or otherwise be associated with the hardware. As used herein, for example, a particular processor and memory may comprise a first “circuit” when executing a first one or more lines of code and may comprise a second “circuit” when executing a second one or more lines of code. As utilized herein, “and/or” means any one or more of the items in the list joined by “and/or”. As an example, “x and/or y” means any element of the three-element set {(x), (y), (x, y)}. In other words, “x and/or y” means “one or both of x and y.” As another example, “x, y, and/or z” means any element of the seven-element set {(x), (y), (z), (x, y), (x, z), (y, z), (x, y, z)}. In other words, “x, y and/or z” means “one or more of x, y, and z.” As utilized herein, the term “exemplary” means serving as a non-limiting example, instance, or illustration. As utilized herein, the terms “for example” and “e.g.” set off lists of one or more non-limiting examples, instances, or illustrations. As utilized herein, circuitry is “operable” to perform a function whenever the circuitry comprises the necessary hardware and code (if any is necessary) to perform the function, regardless of whether performance of the function is disabled or not enabled (e.g., by a user-configurable setting, factory trim, etc.).
Certain example implementations in accordance with the present disclosure may be found in systems and methods for identifying phishing websites, as described in the following in more detail with reference to the attached figures. In this regard, the term “phishing” generally refers to the concept of tricking a user (e.g., computer user) into submitting personal information to a bogus website. Phishing may also refer to the techniques used to trick users. The personal information, such as generally private identifying information, login information for online banking, financial information (e.g., credit card numbers), and other valuable information, is then often used to commit fraud, including identity theft.
Various phishing tactics are used. One example common phishing tactic is to send an email message or instant message to a large number of users. The identity of the message sender and the message content may be arranged to look like it originated from legitimate business or person. The message may indicate that the user needs to re-submit some personal data so that the business can continue to serve the user. The email message may contain a link to a bogus website that may look virtually identical to the pages offered by the legitimate site. Because links may be difficult to read and can use foreign characters that look like normal characters to the user, users can be fooled into visiting the bogus Website and providing valuable personal data.
Protection from phishing may be provided through user awareness and education to help recipients of phishing communications to distinguish between genuine and fraudulent messages. However, this approach is resource intensive and often may be unsuccessful. In this regard, as phishing attacks become more and more sophisticated, even experienced users may struggle to distinguish between phishing and legitimate communications.
Thus, more advanced and automated solutions have been pursued. In this regard, network companies, ISPs (Internet Service Providers), browser providers and the like are active in developing automated tools and methods to detect phishing attempts prior to the users' exposure to a fraudulent communications, in order to prevent the phishing attack or at least to warn users that the received message could be a phishing attempt.
For example, some of the more common automated protection approaches against phishing are based on an analysis and comparison of the Universal Resource Locator (URL) as requested by a link within the phishing email or message. In this regard, the URL may be compared against entries in pre-defined database (e.g., databases storing identified phishing websites, such as the one provide by Phishtank at https://www.phishtank.com/ of known phishing sites (“black list”), or databases storing address information for known legitimate target sites). The analysis and comparison may be limited to the URL as such or to an analysis of the phishing website—e.g., by comparison of elements of the phishing website with legitimate target websites. Some of the automated protection approaches against phishing may use textual features (e.g., company name, domain name) to identify phishing webpages that match a certain protectable webpage. Relatively few, if any, of the available automated protection approaches use visual features. In this regard, with such approaches complete screenshots of websites (e.g., the ones in the suspected phishing messages vs. the known legitimate ones) may be compared. Other approaches may use sub parts of the webpage (i.e. text block, images, logos) for identification. The extracted features are used in the known methods as a critical part of the classification process.
Given the large number and the varied and constantly evolving nature of phishing attacks, however, providing entirely machine based systems and methods capable of detecting attacks with a satisfactory degree of accuracy may be complex task, even for already available common automated approaches. Further, it is often not sufficient to solve the problem of automating the task of identifying phishing websites through a single method. Rather, for maximal protection it may be desirable to combine several detection methods.
FIG. 1 is a block diagram illustrating components of an example phishing detection system, in accordance with the present disclosure. Shown in FIG. 1 is an exemplary phishing detection system 10.
The phishing detection system 10 may comprise suitable circuitry for implementing various aspects of the present disclosure. In this regard, each of the components of the phishing detection system 10, as depicted in FIG. 1 and/or described hereafter, may comprise suitable circuitry (including, e.g., general or dedicated processing circuitry, storage circuitry, communication-related circuitry, etc.) that is operable to implement various aspects of the present disclosure.
For example, the phishing detection system 10 may operate in a first mode using the components and steps 11 linked by solid arrows, or in a second mode further including the components and steps 12 linked by dashed arrows. In the first mode no knowledge of the target websites of the phishing attack is assumed whereas the second mode makes use of features extracted from known target websites.
With respect to the components and steps 11 of the first mode, the phishing detection system 10 may comprise a URL collector 111, a potential phishing URLs storage 112, a website fetcher and classifier 113, a phishing website storage 114, a feature extractor 115, and an identified target storage 116. Each of these components may comprise suitable circuitry (including, e.g., general or dedicated processing circuitry, storage circuitry, communication-related circuitry, etc.) for performing functions or operations associated therewith, as described below.
To facilitate and/or support website filtering, input may be provided, such as from a HTTP (Hypertext Transfer Protocol) flow correlator 118 and/or from a URL pattern matching device 119, both of which in turn can receive input from a network flow monitor 117. Each of the network flow monitor 117, the HTTP flow correlator 118, and the URL pattern matching device 119 may comprise suitable circuitry (including, e.g., general or dedicated processing circuitry, storage circuitry, communication-related circuitry, etc.).
Further, with respect to the components and steps 12 of the second mode, the phishing detection system 10 may comprise a phishing target analyzer 121 and a feature provider 122, each of which may comprise suitable circuitry (including, e.g., general or dedicated processing circuitry, storage circuitry, communication-related circuitry, etc.) for performing functions or operations associated therewith, as describe below. The phishing target analyzer 121 and the feature provider 122 may provide input to any of above URL pattern matching device 119, the HTTP flow correlator 118 and the feature extractor 115.
In example operation of the above phishing detection system 10, the URL collector 111 may be used to collect URLs from sources such as emails, messages or manual inputs. The collected URLs may be transmitted to the potential phishing URLs storage 112, which stores potential phishing URLs. The websites requested by those URLs which have been identified as potential phishing URLs may be classified using the website fetcher and classifier 113. The website fetcher and classifier may employ various methods for accessing suspicious websites and assets—e.g., download elements or features thereof. The downloaded contents may be analyzed and compared to a known and trained pattern indicating a phishing website. Once a phishing website is identified, it is stored in the website storage 114, and the feature extractor 115 may be used to extract and analyze salient features of the downloaded website. These features may be, for example, compared with features as provided by the feature provider 122 to identify with the targeted website and to store the identified targeted websites in the target storage 116.
In some instances, the phishing detection system 10 as shown in FIG. 1 may implement and/or apply alternative or additional methods and means for detecting potential phishing sites. For example, the alternative or additional methods may make use of the network flow monitor 117 to monitor network traffic. The network flow monitor 117 may generate a log of the network requests, which may comprise the IP addresses of the requesting sites and of the requested sites and time stamps indicative of the time of the requests. Where the network flow is not encrypted (e.g., an http: traffic), plaintext URLs may be included in the log. Where the network flow is monitored for a single network device, the IP address of such a device may be assumed to be known and/or unchanged, and hence does not have to be monitored by the network flow monitor 117.
The logs generated by the network flow monitor 117 may be used as input to the network flow correlator 118 and/or to the URL pattern matching engine 119. In this regard, the URL pattern matching engine 119 may identify potential phishing URLs through analysis of the plaintext URLs, and allow adding identified URLs to the list of potential phishing URLs as stored in the potential phishing URLs storage 112. The network flow correlator 118 may perform a correlation analysis to identify correlated requests and responses within the network flow indicative of a phishing attack. Examples of such correlations or patterns in the network flow are described in greater detail making reference to FIG. 2.
Some phishing websites are known to not host copies of the target website's resources themselves; rather, they may directly link to the original assets of the targeted website. These assets may comprise resources like the, images, Favicon (favorite icon), and/or CSS (Cascading Style Sheet) files. Opening a phishing site of such nature in a web browser may result in a very specific behavior, which can be monitored at network level, as shown in FIG. 2.
FIG. 2 illustrates example network traffic pattern, in accordance with the present disclosure. Shown in FIG. 2, is flow chart 200 representing example network traffic. In this regard, traffic from and to a specific user, client, or site (“Client A”), as identified by its IP address, is emphasized in the flow chart 200 using black arrow within the multitude of other requests and responses in the network traffic.
The example of network traffic as represented in FIG. 2 is in form of a network flow log of time stamped network traffic events is illustrated by Table 1, below, which illustrates example network flow, for particular duration (e.g., 0.032616 seconds), at network level, e.g., as passing through a network or gateway server of an ISP (Internet Service Provider).

TABLE 1

Example network traffic

Time	Source	Destination	HTTP Header

0	192.168.3.3	10.22.22.22
0.000085	10.22.22.22	192.168.3.3
0.000545	192.168.3.3	10.22.22.22
0.000956	192.168.3.3	10.22.22.22
0.001053	10.22.22.22	192.168.3.3
0.001056	172.16.55.5	10.88.88.88
0.00108	10.88.88.88	172.16.55.5
0.001097	172.16.55.5	10.88.88.88
0.001178	172.16.55.5	10.88.88.88	GET phishing.test/login.html
0.001188	10.88.88.88	172.16.55.5
0.001798	10.22.22.22	192.168.3.3
0.002409	10.22.22.22	192.168.3.3	200 OK
0.003057	192.168.3.3	10.22.22.22
0.003908	10.88.88.88	172.16.55.5
0.003923	172.16.55.5	10.88.88.88
0.00394	192.168.3.3	10.22.22.22
0.00394	10.88.88.88	172.16.55.5
0.003943	172.16.55.5	10.88.88.88
0.003958	10.88.88.88	172.16.55.5
0.00396	172.16.55.5	10.88.88.88
0.003967	10.88.88.88	172.16.55.5
0.003969	172.16.55.5	10.88.88.88
0.003973	10.22.22.22	192.168.3.3
0.003978	10.88.88.88	172.16.55.5
0.00398	172.16.55.5	10.88.88.88
0.003991	10.88.88.88	172.16.55.5
0.003992	172.16.55.5	10.88.88.88
0.003998	10.88.88.88	172.16.55.5
0.004	172.16.55.5	10.88.88.88
0.004023	10.88.88.88	172.16.55.5	200 OK
0.004287	172.16.55.5	10.88.88.88
0.004294	10.88.88.88	172.16.55.5
0.017247	172.16.55.5	10.22.22.22
0.017254	10.22.22.22	172.16.55.5
0.017261	172.16.55.5	10.22.22.22
0.018097	172.16.55.5	10.22.22.22	GET target.test/css/main.css
0.018119	10.22.22.22	172.16.55.5
0.018336	10.22.22.22	172.16.55.5
0.01834	172.16.55.5	10.22.22.22
0.018352	10.22.22.22	172.16.55.5
0.018354	172.16.55.5	10.22.22.22
0.018368	10.22.22.22	172.16.55.5
0.01837	172.16.55.5	10.22.22.22
0.018377	10.22.22.22	172.16.55.5
0.018379	172.16.55.5	10.22.22.22
0.018387	10.22.22.22	172.16.55.5
0.018389	172.16.55.5	10.22.22.22
0.018399	10.22.22.22	172.16.55.5
0.0184	172.16.55.5	10.22.22.22
0.018406	10.22.22.22	172.16.55.5	200 OK
0.018407	172.16.55.5	10.22.22.22
0.018646	172.16.55.5	10.22.22.22
0.018652	10.22.22.22	172.16.55.5
0.018754	172.16.55.5	10.22.22.22
0.018759	10.22.22.22	172.16.55.5
0.018763	172.16.55.5	10.22.22.22
0.018837	172.16.55.5	10.22.22.22	GET target.test/img/logo.png
0.01885	10.22.22.22	172.16.55.5
0.018982	10.22.22.22	172.16.55.5
0.018986	172.16.55.5	10.22.22.22
0.018995	10.22.22.22	172.16.55.5
0.018998	172.16.55.5	10.22.22.22
0.01901	10.22.22.22	172.16.55.5
0.019011	172.16.55.5	10.22.22.22
0.019017	10.22.22.22	172.16.55.5
0.019018	172.16.55.5	10.22.22.22
0.019026	10.22.22.22	172.16.55.5
0.019027	172.16.55.5	10.22.22.22
0.019036	10.22.22.22	172.16.55.5
0.019038	172.16.55.5	10.22.22.22
0.019043	10.22.22.22	172.16.55.5	200 OK
0.019044	172.16.55.5	10.22.22.22
0.019203	172.16.55.5	10.22.22.22
0.019209	10.22.22.22	172.16.55.5
0.027165	192.168.3.3	10.22.22.22	GET target.test
0.027211	10.22.22.22	192.168.3.3
0.027593	192.168.3.3	10.22.22.22
0.027963	192.168.3.3	10.22.22.22
0.027984	10.22.22.22	192.168.3.3
0.028197	192.168.3.3	10.22.22.22	GET target.test/css/main.css
0.028256	10.22.22.22	192.168.3.3
0.028636	192.168.3.3	10.22.22.22
0.029084	10.22.22.22	192.168.3.3
0.029218	192.168.3.3	10.22.22.22	GET target.test/img/logo.png
0.02923	10.22.22.22	192.168.3.3
0.030568	10.22.22.22	192.168.3.3	200 OK
0.030994	10.22.22.22	192.168.3.3
0.031166	10.22.22.22	192.168.3.3	200 OK
0.031449	192.168.3.3	10.22.22.22
0.03147	192.168.3.3	10.22.22.22
0.032097	192.168.3.3	10.22.22.22
0.0322	10.22.22.22	192.168.3.3
0.032368	192.168.3.3	10.22.22.22
0.032616	10.22.22.22	192.168.3.3

In Table 1 the participants in the monitored network traffic are Client A with, for example, IP address 172.16.55.5, which represents a user targeted by a phishing attack, and a network peer (“Client B”) with, for example, IP address 192.168.3.3, representing another user not targeted by a phishing attack. Address 10.22.22.22 is the IP address of the target “target.test”, which may be a web shop or banking site, and 10.88.88.88 is the IP address of the phishing website “phishing.test”, which attempts to target the users and the web site of the target target.test.
Looking at the traffic to and from Client A, first the main phishing site phishing.test is requested from the phishing site's web server. The phishing sites server responds with a web site code as shown in simplified form in FIG. 2 and Table 1. After the initial response by the phishing sites server, all related elements or assets of the web site are requested, some of which are hosted by the same server and some of which are hosted by the target website's server target.test. The network flow to and from Client B, who genuinely addresses the target site, shows no such pattern
Looking at the requests and responses in the log of Table 1 in detail the following network traffic events may be observed:

- 1) At 0.001178s a user with the IP address 172.16.55.5 (Client A) requests the web site with the IP address 10.88.88.88 (phishing.test).
- 2) At 0.018097s the user with IP address 172.16.55.5 requests an asset (here: /css/main.css) of the website with the IP address 10.22.22.22 (target.test).
- 3) At 0.018837s the user 172.16.55.5 addresses 10.22.22.22 to requests an asset (here: /img/logo.png).
- 4) At 0.027165s another client with IP address 192.168.3.3 (Client B) accesses the web site with the IP address 10.88.88.88.
- 5) At 0.028197s the user with IP address 192.168.3.3 requests an asset (here: /css/main.css) of the website with the IP address 10.22.22.22.
- 6) At 0.029218s the user with IP address 192.168.3.3 requests an asset (here: /img/logo.png) of the website with the IP address 10.22.22.22.

While backtracking the network flow of Client A from a call to a targeted website 10.22.22.22, it may be observed that Client A accessed a different web site 10.88.88.88 (phishing.test/login.html) only 0.017s before calling up assets from the targeted site. When backtracking the network flow from and to Client B, who also accessed the targeted site, no such call of a different site is observed within the logged time window. The sudden change of accessed sites makes the initial IP address suspicious and hence this IP address and/or URL may be added to the list of potential phishing site for further analysis.
Thus, from a network traffic's point of view, all URLs of requests from one unique client that occur simultaneously with requests to a different web server not related to the phishing site's server but to a different server (which in a phishing attack of the kind described above is a server related to the target web server target.test) are potential phishing candidates. As shown in the log of Table 1 the relevant requests and responses are typically within a time window of less than 1s or even less than 0.1s.
The above example illustrates that using the steps of registering network traffic, for example in the form of destination and targets in a time resolved manner of the web or IP calls from and to a single user destination, and detecting within the registered destination and targets a short uncorrelated call pattern, where the uncorrelated call pattern includes one or more user calls to a website or websites not linked to the requested site following the response to a user call to a requested site, may be used to automate the detection of phishing attacks.
A user or a website is identified in the network flow typically by its network address or terminal ID but other traffic address identification means such as HTTP Header Enrichment or X-USER-ID may also be used, if available.
The short call pattern may be characterized as being short in time, e.g., as within a predefined time window of preferably between 0.1 and 10 seconds or being short in the registered network traffic, e.g., with very few or no intermediate calls, preferably less than 5 or 3, between the calls forming part of the call pattern or both. To avoid being dependent on the latency of the network, time may be measured as the time between receiving a response from a server, (which may be a phishing site) by a user and subsequent requests from that user. This time is not network dependent but only of the speed of the user side network or of the user's device if the monitoring is restricted to a single device.
The detection system for the automated detection of phishing attacks may comprise components for analyzing network traffic flow, such as the network flow monitor 117 and the HTTP flow correlator 118, which may be operable to monitor network traffic, for example in the form of destination and targets in a time resolved manner of the web or IP calls from and to a single user destination, and detect within the registered destination and targets a short uncorrelated call pattern where the uncorrelated call pattern includes one or more user calls to a website or websites not linked to the requested site following the response to a user call to a requested site.
This above approach may allow finding phishing URLs that would seem to be legitimate and would not raise any suspicion when using other detection methods. It is even possible in accordance with the present disclosure to detect a potential phishing server (identified by its IP address) when the traffic is SSL (Secure Sockets Layer) encrypted. If the server name identification extension is used during the SSL handshake, or if the corresponding DNS (Domain Name System) traffic is available, even the phishing website's domain name may be identified.
The network traffic flow monitoring 117 and the HTTP flow correlator 118 may be performed wherever client network traffic may be monitored. This may be at a client's computer (e.g., as a web browser extension or as part of a software firewall), within a client's network (e.g., hardware firewall, router, or modem), or within an ISP's network.
Thus, in accordance with the present disclosure, methods and systems as described above may be capable of issuing warnings or blocking suspicious websites in real-time or quasi real-time, e.g., before the user may enter the information being phished. Therefore, such a warning or blocking step may be part of the above described methods.
Further, in accordance with the present disclosure, methods and systems as described may operate with a known set of target web sites, which may then be specifically protected when observing the network flow. On the other hand it is also possible to monitor the network flow for the above described correlations or pattern without a specific knowledge of the target.
While the above described methods and systems are capable of detecting certain phishing attacks in a robust, fast and easy to implement manner, further aspects of the disclosure include the combination of the above methods and systems with conventional known methods and systems of detecting phishing attacks, using for example a comparison against known phishing web sites or the analysis of other known hallmarks of phishing websites.
Other embodiments of the disclosure may provide a non-transitory computer readable medium and/or storage medium, and/or a non-transitory machine readable medium and/or storage medium, having stored thereon, a machine code and/or a computer program having at least one code section executable by a machine and/or a computer, thereby causing the machine and/or computer to perform the steps as described herein.
Accordingly, the present disclosure may be realized in hardware, software, or a combination of hardware and software. The present disclosure may be realized in a centralized fashion in at least one computer system, or in a distributed fashion where different units are spread across several interconnected computer systems. Any kind of computer system or other apparatus adapted for carrying out the methods described herein is suited. A typical combination of hardware and software may be a general-purpose computer system with a computer program that, when being loaded and executed, controls the computer system such that it carries out the methods described herein.
The present disclosure may also be embedded in a computer program product, which comprises all the features enabling the implementation of the methods described herein, and which when loaded in a computer system is able to carry out these methods. Computer program in the present context means any expression, in any language, code or notation, of a set of instructions intended to cause a system having an information processing capability to perform a particular function either directly or after either or both of the following: a) conversion to another language, code or notation; b) reproduction in a different material form.
While the present disclosure makes reference to certain embodiments, it will be understood by those skilled in the art that various changes may be made and equivalents may be substituted without departing from the scope of the present invention.
In addition, many modifications may be made to adapt a particular situation or material to the teachings of the present invention without departing from its scope. Therefore, it is intended that the present disclosure not be limited to the particular embodiment disclosed, but that the present disclosure will include all embodiments falling within the scope of the appended claims.

Claims

1-20. (canceled)

21. A method for automatic detection of phishing websites, comprising:

detecting within network traffic a sequence of network traffic events that comprises at least:

an initial communication from a network address to a first other network address;

a first subsequent communication to the initial communication from the first other network address at a first time; and

a second subsequent communication from the network address to a second other network address at a second time subsequent to the first time;

classifying the first other network address as a potential phishing website; wherein the classifying comprises:

determining that the second other network address is not related to the first other network address; and

determining that a time difference between the second time and the first time meets predefined criteria; and

taking one or more protective measures in response to the classifying, wherein the one or more protective measures comprise blocking the first other network address.

22. The method of claim 21, comprising monitoring the network traffic using a log of network traffic events, and wherein the log has a machine readable log format, and comprises network addresses of requested and/or responding sites.

23. The method of claim 21, wherein the second subsequent communication is within a limited number of network events relative to the first time; and comprising:

classifying the first other network address as a potential phishing website based on a determination that the limited number of network events is smaller than a defined limit value.

24. The method of claim 24, wherein the defined limit value is 5 or 3.

25. The method of claim 21, wherein the pre-defined criteria comprise the time difference between the second time and the first time being smaller than a defined time value.

26. The method of claim 26, wherein the defined time value is smaller than 1 second, and preferably smaller than 0.1 seconds.

27. A method for protecting websites from phishing attacks, comprising:

detecting within network traffic a communication from a network address to a target website;

evaluating network events involving the network address prior to the detected communication to detect a communication with the network address to a website not related to the target website, wherein the evaluating comprises obtaining time measurements that are independent of network latency;

classifying the prior website as potential phishing website; and

taking one or more protective measures in response to the classifying, wherein the one or more protective measures comprise blocking the prior website.

28. The method of claim 27, comprising monitoring the network traffic using a log of network traffic events generated based on the network traffic.

29. The method of claim 28, wherein the log is configured based on a machine readable log format, and comprises network addresses of requested and/or responding sites.

30. The method of claim 27, wherein the evaluation is limited to network traffic events involving the network address within a limited number of network traffic events in a sequence of network traffic events.

31. The method of claim 10, wherein the limited number of network traffic events is 5 or 3.

32. The method of claim 10, wherein the time window is smaller than 1 second, and preferably smaller than 0.1 seconds.

33. A system for the automated detection of phishing attacks, comprising:

a network flow correlator configured to detect within network traffic a sequence of network traffic events, wherein such sequence comprises:

a second subsequent communication from the network address to a second other network address at a second time subsequent to the first time; and

a website classifier configured to classify the first other network address as a potential phishing website; wherein the classifying comprises:

a determination that the second other network address is not related to the first other network address, and

a determination that a time difference between the second time and the first time meets predefined criteria; and

wherein the system is configured to take one or more protective measures in response to the classifying, wherein the one or more protective measures comprise blocking the first other network address.

34. The system of claim 13, further comprising a network traffic monitor configured to monitor network traffic; and

wherein the network traffic monitor is configured to generate a log of network traffic events for use during monitoring the network traffic.

35. The system of claim 14, wherein the log has a machine readable log format, and comprises network addresses of requested and/or responding sites.

36. The system of claim 13, further comprising an address collector configured to collect addresses corresponding to requested and/or responding sites from one or more different sources.

37. The system of claim 13, further comprising a pattern matching engine configured to identify potential phishing addresses based on analysis of addresses in plaintext logs.

38. The system of claim 13, further comprising a feature extractor configured to extract and analyze features of particular websites.

39. The system of claim 18, wherein the feature extractor is configured to compare extracted features for a particular website with pre-stored website features to identify the particular website.

40. The system of claim 13, wherein the second subsequent communication is within a limited number of network events relative to the first time; and

wherein the website classifier is configured to classify the first other network address as a potential phishing website based on a determination that the limited number of network events is smaller than a defined limit value.