Phishsense
•Download as PPTX, PDF•
0 likes•15 views
Integrator and orchestrator against phishing threats.
Recommended
Recommended
More Related Content
Similar to Phishsense
Similar to Phishsense (20)
Recently uploaded
Recently uploaded (20)
Phishsense
- 1. 3 1
- 2. 3
- 3. 3
- 4. 3 By human side PhishSense is a service By IT side Phishsense is an orchestrator
- 5. 3 Phishsense collects Engine opinion about requested URL Engines Provide to Phishsense their Opinion about checked URL 2 ways to manage opinions PS Engine Results PS Engine Suggestions They give probability They give human opinion Wite list / Black list
- 6. 3 URL EngineResults //eachenginebypromises eng cfg Get resutl by URL get valid result Novalidresult Valid result analyse URL URL JSON JSON JSON get last result result JSON save Customer side Engine side save JSON
- 7. 3 URL EngineResults //eachenginebypromises eng cfg Get resutl by URL get valid result Novalidresult Valid result analyse URL URL JSON JSON JSON get last result result JSON save Customer side Engine side save JSON
- 8. 3 URL EngineResults //eachenginebypromises eng cfg Get resutl by URL get valid result Novalidresult Valid result analyse URL URL JSON JSON JSON get last result result JSON save Customer side Engine side save JSON
- 9. 3 URL EngineResults //eachenginebypromises eng cfg Get resutl by URL get valid result Novalidresult Valid result analyse URL URL JSON JSON JSON get last result result JSON save Customer side Engine side save JSON
- 10. 3 URL EngineResults //eachenginebypromises eng cfg Get resutl by URL get valid result Novalidresult Valid result analyse URL URL JSON JSON JSON get last result result JSON save save Customer side Engine side JSON
- 11. 3 URL EngineSuggestions eng cfg Get suggestion by URL get valid suggestion suggestion analyse URL JSON JSON Customer side Engine side suggestion statusSuggestion save suggestion statusSuggestion getIdentity //eachengine bypromises save JSON
- 12. 3 URL EngineSuggestions eng cfg Get suggestion by URL get valid suggestion suggestion analyse URL JSON JSON Customer side Engine side suggestion statusSuggestion save suggestion statusSuggestion getIdentity //eachengine bypromises save JSON
- 13. 3 URL EngineSuggestions //eachengine bypromises eng cfg Get suggestion by URL get valid suggestion suggestion analyse URL JSON JSON Customer side Engine side JSON save suggestion statusSuggestion suggestion statusSuggestion getIdentity save JSON
- 14. 3 URL EngineSuggestions eng cfg Get suggestion by URL get valid suggestion suggestion analyse URL JSON JSON Customer side Engine side suggestion statusSuggestion save suggestion statusSuggestion getIdentity //eachengine bypromises save JSON
- 15. 3 URL EngineResults //eachenginebypromises eng cfg Get resutl by URL get valid result Novalidresult Valid result analyse URL URL JSON JSON JSON get last result result JSON save Customer side Engine side save JSON
- 16. 3 URL EngineResults //eachenginebypromises eng cfg Get resutl by URL get valid result Valid result analyse URL JSON JSON JSON Customer side Engine side save JSON
- 17. 3 URL EngineSuggestions //eachengine bypromises eng cfg Get suggestion by URL get valid suggestion suggestion analyse URL JSON JSON Customer side Engine side JSON save suggestion statusSuggestion suggestion statusSuggestion getIdentity save JSON
- 18. 3 URL EngineSuggestions eng cfg Get suggestion by URL get valid suggestion suggestion analyse URL JSON JSON Customer side Engine side //eachengine bypromises save JSON
- 19. 3 The engine result/suggestion saved by controller { "_id": "5a38f8f4a9b6702b287c39c4", "__v": 0, "engine_name": "PhishTank", "engine_category": "TraditionalPhishing", "engine_result": { "url": "https://www.google.com", "domains": [], "url_status": "Available", "score": 0, "label": "safe", "bwlist": null, "timestamp": "2017-12-19T11:33:08.671Z", "expire": "2017-12-20T11:33:09.223Z", }, "engine_specific_details": { ... }, "timestamp": "2017-12-19T11:33:08.655Z", "request_id": "5a38f8f4a9b6702b287c39c1", }
- 20. 3 The engine result/suggestion saved by controller url_status if the engine has an opinion. score probablity by 0 to 100 that, for the engine, this url is phishing or not label phishing, safe, suspicious, an discrete value for the engine. If engine does not give the label, the configuration file has score range opinion. bwlist It says if the URL has been weighed by an expert that fix that the analysed URL is to consider, in spite of everything, pointing to a safe page or not.
- 21. 3 The aggregate output { "_id": "5a38f9d69db4d22718430507", "__v": 1, "url": "https://www.google.com", "domain_ipv6": "2a00:1450:4002:800::2004", "domain_ipv4": "172.217.23.68", "domain_name": "www.google.com", "score": 0, "label": "safe", "bwlist": null, "timestamp": "2017-12-19T11:36:54.455Z", "expire": "2017-12-20T11:36:54.455Z", "engine_results": [ {...}, {...} ... ], "request_id": "5a38f9d69db4d22718430506", "http_status": 202, "request_engine_results": false, "forcenew": false }
- 23. 3 Adding new engine 1 2 3
- 24. 3 Controller • Change code about calling engine • Change code about read engine specific response and translate in Phishsense data (url_status, score, label, bwlist)
- 25. 3
- 26. 3 PS Engine Suggestion URL ? PhishsenseEngineResults PT Controller DP Controller PC Controller URL ? Engineside PhishsensesideCustomerside url_status score label bwlist Each engine could have its own protocol, interface and answer. Its controller manages the request and the answer Synchronousinteraction GSB Controller
Editor's Notes
- Abbiamo chiamato questo lab … Putting ideas on the road Il nostro output preferito