Metadata-based phishing attack detection and prevention

Abstract

The disclosed technology intercepts a web page rendered by a server in response to a user action performed on a client. The technology analyzes one or more images in the web page and determines that a particular hosted service is represented by the image. The technology analyzes one or more fields in the web page and determines that the fields elicit sensitive information. The technology intercepts a request made by the client in response to another user action that provides sensitive information via the fields. The technology analyzes the request and determines that the sensitive information is being elicited to an unauthorized resource. This determination is made by comparing the resource address in the request with one or more authorized resource addresses used by the particular hosted service. The technology determines that the web page is performing a phishing attack and blocks the transmission of the sensitive information to the unauthorized resource.

Description

Priority Application

[0001] This application claims the benefit of and priority to U.S. Provisional Patent Application No. 62 / 966,412, filed January 27, 2020, entitled "Metadata-Based Detection and Prevention of Phishing Attacks" (Attorney Docket No. NSKO1028-1), and U.S. Provisional Patent Application No. 17 / 157,947, filed January 25, 2021, entitled "Metadata-Based Detection and Prevention of Phishing Attacks" (Attorney Docket No. NSKO1028-2). The priority applications are incorporated by reference as if fully set forth herein. INCORPORATE MATERIAL

[0002] The following documents are incorporated by reference as if fully set forth herein:

[0003] U.S. Provisional Patent Application No. 62 / 307,305, filed March 11, 2016, entitled “System and Method for Enforcing Multipart Policies in Data Intrusion Transactions in Cloud Computing Services” (Attorney Docket No. NSKO 1003-1).

[0004] U.S. Patent Application No. 16 / 000,132, filed June 5, 2018, entitled “Metadata-Based Data Loss Prevention (DLP) for Cloud Storage” (Attorney Docket No. NSKO1003-5) (now U.S. Patent No. 10,291,657, issued May 14, 2019).

[0005] U.S. patent application Ser. No. 15 / 368,240, filed Dec. 2, 2016, entitled “System and Method for Applying Multipart Policies to Data Intrusion Transactions in Cloud Computing Services” (Attorney Docket No. NSKO1003-2).

[0006] U.S. patent application Ser. No. 15 / 368,246, filed Dec. 2, 2016, entitled "Middleware Security Layer for Cloud Computing Services" (Attorney Docket No. NSKO 1003-3).

[0007] Chen, Ital, Narayanaswamy, and Malmskog, Cloud Security for Dummies, NetScope Special Edition, John Wiley & Sons, 2015.

[0008] U.S. patent application Ser. No. 14 / 198,499, filed March 5, 2014, entitled "Security for Network Distribution Services" (Attorney Docket No. NSKO 1000-2) (now U.S. Patent No. 9,398,102, issued July 19, 2016).

[0009] U.S. patent application Ser. No. 14 / 835,640, filed Aug. 25, 2015, entitled “SYSTEM AND METHOD FOR MONITORING AND CONTROLING COMPANY INFORMATION STORED IN A CLOUD COMPUTING SERVICE (CCS)” (Attorney Docket No. NSKO 1001-2) (now U.S. Patent No. 9,928,377, issued Mar. 27, 2018).

[0010] U.S. patent application Ser. No. 15 / 911,034, filed March 2, 2018, entitled “Simulation and Visualization of Malware Propagation in a Cloud-Based Collaboration Environment” (Attorney Docket No. NSKO 1012-2).

[0011] U.S. patent application Ser. No. 15 / 986,732, filed May 22, 2018, entitled “Data Loss Prevention Using Category Aware Parsers” (Attorney Docket No. NSKO 1011-1).

[0012] U.S. Provisional Patent Application No. 62 / 488,703, filed April 21, 2017, entitled “NETWORK SECURITY SYSTEM (NSS) FOR REDUCING SECURITY ENFORCEMENT LATENCY AND ERRORS” (Attorney Docket No. NSKO1007-1).

[0013] No. 16 / 118,278, filed August 30, 2018, entitled “Enhancing Document Metadata with Contextual Information” (Attorney Docket No. NSKO 1081-1).

[0014] "Data Loss Prevention and Monitoring in the Cloud" published by Netskope, Inc.

[0015] "Five Steps to Cloud Confidence" published by NetScope, Inc.

[0016] "Netskope Active Cloud DLP" published by Netskope, Inc.

[0017] "Remediating the Cloud Data Breach Collision Course," published by Netskope, Inc.

[0018] "Netskope Cloud Confidence Index(TM)" published by Netskope, Inc. [Technical field]

[0019] The disclosed technology relates to protecting network traffic to and from a hosted service, and in particular to using metadata to detect and prevent phishing attacks that attempt to extract data from the hosted service. [Background technology]

[0020] It should not be assumed that the subject matter discussed in this section is prior art merely by virtue of its mention in this section. Likewise, it should not be assumed that problems related to the subject matter discussed in this section or provided as background art have been previously recognized in the prior art. The subject matter in this section is merely illustrative of various approaches, which may by themselves or spontaneously accommodate the practice of the claimed technology.

[0021] Phishing is an attempt by a phisher to extract sensitive information from a user using a fake website. The phisher wants to gain access to private account information and passwords. A successful phishing attack can have dire consequences for the victim, leading to financial loss and data theft. Usually, the phisher sends a scam email or chat message that tricks the victim into clicking on a link. There are numerous different phishing attacks, such as spear phishing, where the phisher hopes to increase the success rate by sending individual matched content emails to specific companies. Another type of phishing is called clone phishing, where the phisher clones a previously sent message and replaces the legitimate content with malicious information, such as a link or formula.

[0022] The ubiquity of accessing cloud services makes it easy for phishing-based breaches to succeed: 25% of phishing attacks bypass default security measures built into the popular cloud service Office 365, the most spoofed brand in phishing attacks.

[0023] Cloud-based email is ushering in a new era of phishing. The connected nature of cloud-based email allows phishers to access bigger rewards with just one successful phishing attack, as credentials give phisher access to other connected accounts.

[0024] A deceptive phishing attack involves placing a link to a phishing webpage that prompts employees to log in, but the user is actually giving their credentials to the phisher instead of logging in. From there, when an unsuspecting victim clicks on the link and is directed to a fake sign-in page, the victim provides the phisher with their username and password, unaware that they have done anything unusual.

[0025] After stealing the credentials, the phisher typically uses them to remotely log into the user's Office 365 account or other email account and use this as a launch point for other spear phishing attacks. At this point, it becomes even more difficult to detect the phisher at work, as they will send additional phishing emails to other employees or external partners, trying to trick the recipient into clicking on a phishing link.

[0026] Deceptive phishing attacks are difficult to detect for several reasons. Phishing links are usually zero-day, where a unique link is sent to each recipient, so they do not appear on security blacklists. Often, phishing links lead to legitimate websites where attackers have maliciously inserted a sign-in page, and the domain name and IP reputation are legitimate. Link protection technologies such as Safe Links do not protect against these phishing links. Users follow the safe link and enter their username and password, as the phishing link simply contains a sign-in page and does not download any malicious virus.

[0027] Therefore, there is a need for effective protection against phishing.

[0028] In the drawings, like reference characters generally refer to like parts throughout the different views. Also, the drawings are not necessarily to scale, with emphasis instead generally being placed upon illustrating the principles of the disclosed technology. In the following description, various embodiments of the disclosed technology are described with reference to the following drawings, in which: [Brief description of the drawings]

[0029] [Figure 1] 1 illustrates one embodiment of a network security system for detecting and preventing phishing attacks.

[0030] [Diagram 2] 1 illustrates one embodiment of using an endpoint security system to detect and prevent phishing attacks.

[0031] [Diagram 3] 1 illustrates one embodiment of a metadata store and its contents that identifies authorized resource addresses used by a hosted service.

[0032] [Figure 4] An example of a phishing decoy sent to a phishing victim.

[0033] [Diagram 5] Figure 4 shows a phishing decoy that connects to a uniform resource locator (URL) of an authorized cloud computing and storage service when a phishing victim clicks on the phishing decoy.

[0034] [Figure 6] 1 illustrates a phishing web page that is presented to a phishing victim in response to the victim clicking on a URL for an authorized cloud computing and storage service.

[0035] [Figure 7] Figure 6 shows that the phishing webpage has a valid domain and certificate.

[0036] [Figure 8] 1 illustrates one embodiment that prevents exfiltration of sensitive information to unauthorized resources by comparing the resource address in a request with authorized resource addresses used by the hosted service and identified in a metadata store.

[0037] [Figure 9]1 illustrates one embodiment of training an image classifier to map web page images to hosted services.

[0038] [Figure 10] 1 is a message flow diagram illustrating some of the actions involved in a network security system that detects and prevents phishing attacks.

[0039] [Figure 11] 1 is a message flow diagram illustrating some of the actions involved in an endpoint security system that detects and prevents phishing attacks.

[0040] [Figure 12] FIG. 1 is a simplified block diagram of a computer system that can be used to implement the disclosed techniques. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0041] The following description is presented to enable any person skilled in the art to make and use the disclosed technology, and is provided in the context of a particular application and its requirements. Various modifications to the disclosed embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other embodiments and applications without departing from the spirit and scope of the disclosed technology. Thus, the disclosed technology is not intended to be limited to the embodiments shown, but is to be accorded the widest scope consistent with the principles and features disclosed herein.

[0042] The authors describe a system and various embodiments for detecting and preventing phishing attacks. The system and process are described with reference to Figure 1. Because Figure 1 is an architecture diagram, certain details are intentionally omitted for clarity of explanation. The description of Figure 1 is organized as follows: first, the elements of the diagram are described, then their interconnections are described. Then, the use of the elements is described in more detail.

[0043] 1 illustrates one embodiment of the disclosed technology operating in an environment 100. The environment 100 includes an endpoint 102, a network security system 125, and a hosted service 108. The endpoint 102 accesses content (e.g., documents) stored on the hosted service 108 via the network security system 125. The endpoint 102 includes an endpoint routing client 112.

[0044] The network security system 125 includes an image classifier 135 (eg, a convolutional neural network), a web page analyzer 145, a traffic data analyzer 155, a security action performer 165, and a metadata store 175.

[0045] The modules of the endpoint 102 and the network security system 125 may be implemented in hardware or software and need not be divided into exactly the same blocks as shown in FIG. 1. Some of the modules may be implemented on different processors or computers or distributed among many different processors or computers. Furthermore, it will be understood that some of the modules may be combined, operated in parallel, or operated in a different order than that shown in FIG. 1 without affecting the functionality accomplished. Also, as used herein, the term "module" may include "sub-modules" that may themselves be considered to constitute modules. The blocks within the endpoint 102 and the network security system 125 are designated as modules and may also be considered as steps of a flow chart in a method. Also, a module does not necessarily have to have all of its code located contiguously in memory, and some of the code may be isolated from other parts of the code with code from other modules or other functions located in between.

[0046] The interconnection of the elements of the environment 100 will now be described. The public network 115 couples the endpoints 102, the network security system 125, and the hosted services 108, all in communication with each other (depicted by solid double-arrowed lines). The actual communication paths may be point-to-point over public and / or private networks. Some items, such as the endpoint routing client 112, may be delivered indirectly, for example, via an application store (not shown). Communications may occur over various networks, such as private networks, virtual private networks (VPNs), MPLS lines, or the Internet, and may use appropriate application programming interfaces (APIs) and data exchange formats, such as Representational State Transfer (REST), JavaScript Object Notation (JSON), Extensible Markup Language (XML), Simple Object Access Protocol (SOAP), Java Message Service (JMS), and / or the Java Platform Module System. All communications may be encrypted. Communications typically occur over networks such as LANs (Local Area Networks), WANs (Wide Area Networks), telephone networks (Public Switched Telephone Networks), Session Initiation Protocol (SIP), wireless networks, point-to-point networks, star networks, token ring networks, hubbed networks, and the Internet, including mobile Internet via protocols such as EDGE, 3G, 4G LTE, Wi-Fi, WiMAX, etc. Additionally, communications can be secured using a variety of authorization and authentication technologies such as username / password, open authentication (OAuth), Kerberos, SecureID, digital certificates, etc.

[0047] The endpoints 102 may be desktop computers, laptops, tablet computers, mobile phones, or other types of computing devices. Engines or system components of the environment 100, such as the network security system 125, are implemented by software running on various types of computing devices. Examples of devices include workstations, servers, computing clusters, blade servers, server farms, etc.

[0048] Having introduced the elements of FIG. 1 and their interconnections, the elements of the figure will now be described in more detail.

[0049] Although three hosted services, AMAZON WEB SERVICES (AWS)™ 118, BANK OF AMERICA™ 128, and MICROSOFT AZURE™ 138, are shown in FIG. 1, it is understood that the environment 100 can include any number of hosted services. The hosted services 108 can be cloud computing and storage services, financial services, e-commerce services, or any type of application, website, or platform. Often, the hosted services 108 are the most commonly used cloud applications, such as BOX™, DROPBOX™, AMAZON AWS™, GOOGLE DRIVE™, GOOLE CLOUD PLATFORM (GCP)™, MICROSOFT AZURE™, and EVERNOTE™. The hosted services may be referred to as cloud services, cloud applications, cloud storage applications (services), and cloud computing applications (services).

[0050] The hosted service 108 provides users with functionality that may be implemented in the cloud, such as logging in, editing documents, downloading bulk data, reading customer contact information, entering billings, and deleting documents, subject to Data Loss Prevention (DLP) policies. The hosted service 108 may be a network service or application, web-based (e.g., accessed via a URL), or native, such as a sync client. Examples include Software as a Service (SaaS) offerings, Platform as a Service (PaaS) offerings, and Infrastructure as a Service (IaaS) offerings, as well as internal enterprise applications exposed via a URL. Examples of common hosted services today include BOX(TM), GOOGLE DRIVE(TM), SALESFORCE.COM(TM), DROPBOX(TM), AMAZON AWS(TM), MICROSOFT ONEDRIVE 365(TM), APPLE LOUD DRIVE(TM), ORACLE on DEMAND(TM), SUGARSYNC(TM), IDRIVE(TM), and SPIDEROAK ONE(TM).

[0051] Authorized Hosted Services are hosted services that a company provides for employee use and that IT is aware of. IT typically has full administrative control over these hosted services and maintains them on behalf of the company. Even though IT manages Authorized Hosted Services, the department may lack specific knowledge of how users are accessing these hosted services and what activities they are performing, such as uploading, downloading, sharing, or editing corporate data.

[0052] Unauthorized hosted services are hosted services that the company does not know about. Very often, employees go beyond IT and procure their own hosted services when IT does not provide them with the tools they need to accomplish the required business functions. Employees can easily find, pay for, download, and manage these hosted services without IT knowledge or assistance. On the one hand, this is a good thing because it gives employees a way to work efficiently. On the other hand, these unauthorized hosted services create risks for IT. Keeping hosted services and the data within them safe is difficult when IT does not know about them. IT cannot properly enforce security or compliance for unauthorized hosted services. Without important security features such as strong user authentication and audit logging, these hosted services and the data within them are vulnerable to accidental or intentional data exposure. Finally, IT does not know how users are using unauthorized hosted services.

[0053] Hosted services 108 may also be judged / identified / graded based on the NETSKOPE CLOUD CONFIDENCE INDEX™, which evaluates the enterprise readiness of a hosted service based on objective criteria and assigns an overall score. In particular, the NETSKOPE CLOUD CONFIDENCE INDEX™ measures the enterprise readiness of a hosted service by considering various attributes of the hosted service. The following list of hosted service attributes is exemplary and not exhaustive, and includes encryption policies, auditability and business continuity, disaster management policies, number of data centers, compliance certifications (e.g., SOC2) of the data centers, identification and access control, file sharing, data classification, auditing and alerting, data access log storage, password policies, revocation policies, published data recovery plans, and the ability to proxy traffic for inspection and security controls.

[0054] In some embodiments, the NETSKOPE CLOUD CONFIDENCE INDEX™ assigns each hosted service that interfaces to an organization's network a score between 0 and 100. Further, based on the assigned score, the hosted services may be categorized into different cloud confidence levels, such as excellent, high, average, low, or poor.

[0055] In another embodiment, the NETSKOPE CLOUD CONFIDENCE INDEX™ groups hosted services into categories including cloud storage, collaboration, finance and accounting, customer relationship management (CRM), human resources, and software development.

[0056] Hosted services 108 expose their application programming interfaces (APIs) so that third parties can communicate with them and utilize their underlying data. An API refers to a packaged collection of code libraries, routines, protocol methods, and fields that belong to a set of classes that contain that interface type. An API specifies how developers and programmers can use classes for their own software development by simply importing the relevant classes, instantiating the classes, and writing statements that invoke their methods and fields. An API is a source code-based application that is intended to be used as an interface for software components to communicate with each other. An API can incorporate applications over routines, data structures, object classes, and variables. Essentially, an API provides an interface for developers and programmers to access the underlying data, platform functions, and features of the hosted services.Embodiments of the disclosed technology may use various types of APIs, including HTTP or HTTPs based APIs such as SOAP, WSDL, Bulk, XML-RPC, and JSON-RPC, web services APIs such as REST APIs (e.g., FLICKR™, GOGLE STATIC MAPS™, GOGLE GEOLOCATION™), web sockets APIs, class based APIs such as JavaScript and TWAIN (e.g., GOGLE MAPS™ JavaScript API, DROPBOX™ JavaScript Data store API, TWILIO™ API, Oracle Call Interface (OCI)), Java APIs and Android APIs (e.g., GOGLE MAPS™ Android API, MSDN Class Library for .NET Framework, TWILIO™ API for Java and C#), OS features and routines such as file system access and user interface access, object remoting APIs such as CORBA and .NET Remoting, and hardware APIs such as video acceleration, hard disk drives, PCI bus, etc.Other examples of APIs that the disclosed technology may use include AMAZON EC2 API™, BOX CONTENT API™, BOX EVENTS API™, MICROSOFT GRAPH™, DROPBOX API™, DROPBOX API v2™, DROPBOX CORE API™, DROPBOX CORE API v2™, FACEBOOK GRAPH API™, FOURESQUARE API™, GEONAMES API™, FORCE.COM API™, FORCE.COM METADATA API™, APEX API™, VISUALFORCE API™, FORCE.COM ENTERPRISE WSDL™, SALESFORCE.COM STREAMING API™, SALESFORCE.COM TOOLING API™, GOOGLE DRIVE API™, DRIVE REST API™, ACCUWEATHER This includes aggregated and unified APIs, such as the CloudRail API and the CloudRail API.

[0057] Having described the hosted services 108 and their APIs, the network security system 125 will now be described.

[0058] The network security system 125 provides a variety of functions, including analyzing one or more images of a web page using an image classifier 135 to determine that a particular hosted service is represented by the image, analyzing one or more fields of a web page using a web page analyzer 145 to determine that the fields elicit sensitive information, analyzing a request (e.g., an HTTP request) using a traffic data analyzer 155 to determine that sensitive information is being elicited to an unauthorized resource by comparing a resource address in the request to one or more authorized resource addresses used by the particular hosted service, storing / listing / identifying authorized resource addresses using a metadata store 175, and blocking transmission of sensitive information to unauthorized resources using a security action performer 165. These functions collectively prevent phishers from maliciously accessing the hosted service 108 via the endpoint 102. More generally, the network security system 125 provides not only security but also application visibility and control functions.

[0059] The image classifier 135 may implement any image classification algorithm, such as convolutional neural networks, state vector machines, random forests, gradient boosted decision trees, etc. The image classifier 135 may be trained to map web page images to the hosted services 108 using a backpropagation-based stochastic gradient update training technique (e.g., using the ADAM training algorithm).

[0060] The web page analyzer 145 parses and analyzes HTML documents, PDFs, images, JavaScript code, data storage layers (e.g., localStorage, IndexedDB, WebSQL, FileSystem), or any other type of content (e.g., Cascading Style Sheets (CSS)). In one embodiment, the web page analyzer 145 parses HTML documents and converts elements into DOM nodes in a content tree. In another embodiment, it parses and analyzes an already generated content tree. In one embodiment, it parses and analyzes style data in both external CSS files and style elements. In another embodiment, it parses and analyzes the rendering tree, which contains styling information along with visual instructions in the HTML document. In some embodiments, the analysis also includes lexical and syntactic analysis of the text and fields (key-value pairs) of the HTML document.

[0061] The traffic data analyzer 155 parses and analyzes HyperText Transfer Protocol (HTTP) requests, such as GET requests, POST requests, and HEAD requests. HTTP requests include general headers (connection, date), request / response headers, and entity headers (content-length, content-type, last-modified). In one embodiment, the traffic data analyzer 155 parses and analyzes HTTP headers in POST requests. In one embodiment, the traffic data analyzer 155 uses a connector or standardized integration to interpret HTTP transactions using Deep API Inspection (DAPII).

[0062] The security action performer 165 performs security actions including blocking, warning, diverting, quarantining, coaching, initiating a workflow for remediation, recording, pursuing legitimacy, reporting on out-of-compliance events or activities, or encrypting the content. The type of security action can be based on at least one of the type of content policy, the content level activity being performed, and the content type. In other embodiments, a security action can trigger a specific offline inspection, such as changing the ownership of sensitive data.

[0063] For more information regarding the functionality of network security system 125, see, for example, commonly owned U.S. patent applications by Chen, Ital, Narayanaswamy, and Malmskog (Serial Nos. 14 / 198,499, 14 / 198,508, 14 / 835,640, 14 / 835,632, and 62 / 307,305); Cloud Security for Dummies; See Netskope Special Edition, John Wiley & Sons, 2015; “Netskope Introspection” published by Netskope, Inc.; “Data Loss Prevention and Monitoring in the Cloud” published by Netskope, Inc.; “Cloud Data Loss Prevention Reference Architecture” published by Netskope, Inc.; “Five Steps to Cloud Confidence” published by Netskope, Inc.; “Netskope Reactive Platform” published by Netskope, Inc.; “The Netskope Advantage: Three “Must-Have” Requirements for Cloud Access Security Brokers” published by Netskope, Inc.; “15 Critical CASB Use Cases” published by Netskope, Inc.; “Netskope Reactive Cloud DLP” published by Netskope, Inc.; “Remediating the Collision Course for Cloud Data Breaches” published by Netskope, Inc.; and “Netskope Cloud Confidence Index™” published by Netskope, Inc., all of which are incorporated by reference for all purposes as if fully set forth herein.

[0064] Regarding the endpoint routing client 112, it routes network traffic originating from the endpoint 102 to the network security system 125. Depending on the type of device, it can be a Virtual Private Network (VPN) such as VPN-on-demand or per-app VPN using certificate-based authentication. For example, for IOS™ devices, it can be a per-app VPN or a set of domain-based VPN profiles. For ANDROID™ devices, it can be the Cloud Director mobile app. For WINDOWS™ devices, it can be a per-app VPN or a set of domain-based VPN profiles. The endpoint routing client 112 can also be an agent that is downloaded using email or silently installed using mass deployment tools such as ConfigMgr™, Altris™, and Jamf™.

[0065] 2 illustrates one embodiment of detecting and preventing phishing attacks using an endpoint security system 202. In the environment 200, the endpoint 102 is configured with the endpoint security system 202. The endpoint security system 202 includes an image classifier 135, a web page analyzer 145, a traffic data analyzer 155, a security action performer 165, and a metadata store 175.

[0066] The endpoint security system 202 provides a variety of functions including using an image classifier 135 to analyze one or more images of a web page to determine that a particular hosted service is represented by the image, using a web page analyzer 145 to analyze one or more fields of a web page to determine that the fields elicit sensitive information, using a traffic data analyzer 155 to analyze a request (e.g., an HTTP request) to determine that sensitive information is being elicited to an unauthorized resource by comparing the resource address in the request to one or more authorized resource addresses used by the particular hosted service, using a metadata store 175 to store / list / identify authorized resource addresses, and using a security action performer 165 to block transmission of sensitive information to unauthorized resources. These functions collectively prevent phishers from maliciously accessing a hosted service 108 via the endpoint 102. More generally, the endpoint security system 202 provides not only security but also application visibility and control functions.

[0067] FIG. 3 illustrates one embodiment of a metadata store 175 and its contents that identify authorized resource addresses used by a hosted service. In one embodiment, the metadata store 175 identifies / lists the resource addresses of the authorized hosted services. Examples of resource addresses include Uniform Resource Locators (URLs), such as login.microsoftonline.com and login.salesforce.com, domain names, subdomain names, Uniform Resource Identifiers (URIs), Internet Protocol (IP) addresses, Server Name Indication (SNI), and Subject Alternative Names (SANs). These contents of the metadata store 175 may be referred to as "metadata."

[0068] Figure 4 shows an example of a phishing decoy 402 sent to a phishing victim. The phishing decoy 402 is a PDF hosted on the hosted service GOOGLE DRIVE™ and masquerades as a law firm in Denver, Colorado. The phishing decoy 402 links to a MICROSOFT OFFICE 365™ phishing webpage hosted on AZURE™ blob storage. Because the phishing decoy 402 is hosted on MICROSOFT AZURE™ blob storage, it has a Microsoft-issued domain name and a Secure Sockets Layer (SSL) certificate. The Microsoft-issued domain name and certificate, combined with Microsoft content (webpage), make this decoy particularly convincing and difficult to recognize as phishing.

[0069] Phishing decoys 402 traditionally arrive as email attachments to phishing victims. They are crafted to contain legitimate content and come from legitimate sources. Often, the attachments are stored in cloud storage services such as GOOGLE DRIVE™. Sharing these documents with other users can trigger secondary propagation vectors such as the crowd phishing fan-out effect described in U.S. Patent Application No. 15 / 911,034, incorporated herein.

[0070] Figure 5 shows the phishing decoy 402 from Figure 4 connecting to a uniform resource locator (URL) 504 for Azure Blob Storage, an authorized cloud computing and storage service, when a phishing victim clicks on the phishing decoy 402.

[0071] The phishing decoy 402 contains a hyperlink to download the actual PDF, as shown in Figure 4. Upon clicking the “Download PDF” hyperlink, the victim is presented with message 502 stating that the document is attempting to connect to an Azure Blob Storage URL 504.

[0072] 6 illustrates a phishing web page 602 that is presented to a victim after clicking on a hyperlink. The phishing web page 602 includes one or more images having image features 604 and 606 and fields 614 and 624.

[0073] The phishing webpage 602 is hosted on Azure blob storage. As a result, it has a valid Microsoft-issued SSL certificate 702 and is hosted on a Microsoft-owned domain, as shown in Figure 7. Seeing a Microsoft domain name and a Microsoft-issued SSL certificate 702 on a site asking for MICROSOFT OFFICE 365™ credentials is very strong evidence that the site is legitimate and may be enough to convince the user to enter their credentials. Clicking continue uploads the victim's credentials to https: / / searchurl.bid / livelogins2017 / finish40.php 824, as shown in Figure 8.

[0074] Initially, image classifier 135 accesses the image of phishing webpage 602 and determines, based on processing of image features 604 and 606, that the image is used by the MICROSOFT EXCEL™ application of the hosted service MICROSOFT OFFICE 365™. Thus, image classifier 135 predicts that the image of phishing webpage 602 represents the hosted service MICROSOFT OFFICE 365™.

[0075] The web page analyzer 145 then analyzes the phishing web page 602 and analyzes fields 614 and 624. Based on the analysis of fields 614 and 624, the web page analyzer 145 infers that fields 614 and 624 elicit sensitive information, i.e., email address and email password. In other embodiments, various types of sensitive information may be elicited and detected. Some examples include Controlled Unclassified Information (CUI), Personally Identifiable Information (PII), Protected Health Information (PHI), Payment Card Industry (PCI) information, Social Security numbers, driver's license information, and biometric records.

[0076] The traffic data analyzer 155 then analyzes the HTTP header 844 and determines that the sensitive information 832 and 834 have been uploaded to the URL 824 in the POST field. The traffic data analyzer 155 then accesses the metadata store 175 to determine which authorized resource addresses 804 (URLs, domain names, subdomain names, URIs, IP addresses, SNIs, SANs) are associated with the hosted service MICROSOFT OFFICE 365™. The traffic data analyzer 155 then compares (802) substrings of the URL 824 to substrings of the authorized resource addresses 804. Based on the comparison 802, the traffic data analyzer 155 determines that the URL 824 is not an authorized resource address for the hosted service MICROSOFT OFFICE 365™. Thus, the traffic data analyzer 155 determines (806) that the sensitive information 832 and 834 have been retrieved to an unauthorized resource or location.

[0077] The security action performer 165 prevents the exfiltration 806 by blocking 818 the sensitive information 832 and 834 from being provided to the unauthorized URL 824 .

[0078] FIG. 9 illustrates one embodiment of training an image classifier 135 to map web page images to hosted services. Training images 902 are used as training data to train the image classifier 135 and include images crawled and extracted from web pages and websites of the most commonly used authorized hosted services. Each image is labeled with ground truth 914 that identifies the corresponding hosted service. In one embodiment, the image classifier 135 is a convolutional neural network (CNN) with a softmax classification layer that generates confidence score probabilities 904 for multiple hosted services (e.g., AWS, BoA, Azure, GCP, Box, Dropbox). Training uses backward propagation 934 to apply gradients calculated from prediction errors 924 to the parameters and weights of the convolutional neural network.

[0079] In other embodiments of the disclosed technology, in addition to or in lieu of machine learning based classification techniques, the disclosed technology can use image fingerprinting algorithms such as perceptual hashing for image disambiguation and classification. Further details regarding perceptual hashing can be found in Perceptual hashing, https: / / en.wikipedia.org / w / index.php?title=perceptual_hashing&oldid=999157579 (last accessed January 25, 2021), which is incorporated by reference as if fully set forth herein.

[0080] FIG. 10 is a message flow diagram illustrating some of the actions involved in a network security system that detects and prevents phishing attacks. The message flow diagram may be implemented, for example, at least in part, using a database system, with one or more processors configured to receive or retrieve information, process the information, store the results, and transmit the results. Other embodiments may perform the actions in a different order than shown in FIG. 10 and / or with different, fewer, or additional actions. In some embodiments, multiple actions may be combined. For convenience, this message flow diagram is described with reference to a system that performs the method. A system is not necessarily part of the method.

[0081] Communications between the endpoints 102 and the server 1008 are monitored and mediated by the intervening network security system 125 between them.

[0082] First, a user issues a user action 1014 via a client 1012 (e.g., a browser) running on the endpoint 102. In one embodiment, the user action 1014 is the selection of a hyperlink that serves as phishing bait.

[0083] In response to the user action 1014 , the server 1008 sends a phishing web page 1026 to the client 1012 .

[0084] The image classifier 135 of the network security system 125 then performs an image analysis 1032 of the image of the phishing webpage 1026 to identify the particular hosted service represented by the image.

[0085] The web page analyzer 145 of the network security system 125 then performs a field analysis 1042 of the fields of the phishing web page 1026 and determines that the fields elicit sensitive information.

[0086] Next, user action 1054 attempts to submit sensitive information via request 1052. Request 1052 is intercepted by network security system 125 and is not completed.

[0087] The traffic data analyzer 155 of the network security system 125 then performs a request analysis 1062 of the request 1052 to determine that sensitive information is being retrieved to an unauthorized resource or location by comparing 1076 the resource address (e.g., the POST URL) in the request 1052 to one or more authorized resource addresses used by a particular hosted service identified / listed in the metadata store 175 of the network security system 125.

[0088] The network security system 125 then determines that the phishing web page is conducting a phishing attack and blocks (1086) the transmission of sensitive information to unauthorized resources.

[0089] In other embodiments, if the comparison 1076 determines that sensitive information is being transmitted to an authorized resource or location, the request is not blocked but instead is fulfilled.

[0090] FIG. 11 is a message flow diagram illustrating some of the actions involved in an endpoint security system that detects and prevents phishing attacks. The message flow diagram may be implemented, for example, at least in part, using a database system, with one or more processors configured to receive or retrieve information, process the information, store the results, and transmit the results. Other embodiments may perform the actions in a different order than shown in FIG. 11 and / or with different, fewer, or additional actions. In some embodiments, multiple actions may be combined. For convenience, this message flow diagram is described with reference to a system that performs the method. A system is not necessarily part of the method.

[0091] First, a user issues a user action 1114 via a client 1112 (e.g., a browser) running on the endpoint 102. In one embodiment, the user action 1114 is the selection of a hyperlink that serves as phishing bait.

[0092] In response to the user action 1114 , the server 1108 sends a phishing web page 1126 to the client 1112 .

[0093] The image classifier 135 of the endpoint security system 202 then performs an image analysis 1132 of the image of the phishing webpage 1126 to identify the particular hosted service represented by the image.

[0094] The web page analyzer 145 of the endpoint security system 202 then performs a field analysis 1142 of the fields of the phishing web page 1126 and determines that the fields elicit sensitive information.

[0095] Next, a user action 1154 attempts to submit sensitive information via request 1152. Request 1152 is intercepted by endpoint security system 202 and is not completed.

[0096] The traffic data analyzer 155 of the endpoint security system 202 then performs a request analysis 1162 of the request 1152 and determines that sensitive information is being retrieved to an unauthorized resource or location by comparing 1176 the resource address (e.g., the POST URL) in the request 1152 to one or more authorized resource addresses used by a particular hosted service identified / listed in the metadata store 175 of the endpoint security system 202.

[0097] The endpoint security system 202 then determines that the phishing web page is conducting a phishing attack and blocks (1186) the transmission of sensitive information to unauthorized resources.

[0098] In other embodiments, if the comparison 1176 determines that sensitive information is being transmitted to an authorized resource or location, the request is not blocked but instead is fulfilled.

[0099] 12 is a simplified block diagram of a computer system 1200 that can be used to implement the disclosed techniques. The computer system 1200 includes at least one central processing unit (CPU) 1272 that communicates with several peripheral devices via a bus subsystem 1255. These peripheral devices can include, for example, a storage subsystem 1210 including memory devices and a file storage subsystem 1236, user interface input devices 1238, user interface output devices 1276, and a network interface subsystem 1274. The input and output devices enable user interaction with the computer system 1200. The network interface subsystem 1274 provides an interface to external networks, including interfaces to corresponding interface devices in other computer systems.

[0100] In one embodiment, the network security system 125 and / or the endpoint security system 202 are communicatively linked to the storage subsystem 1210 and the user interface input device 1238 .

[0101] User interface input devices 1238 can include pointing devices such as a keyboard, a mouse, a trackball, a touch pad, or a graphics tablet, a scanner, a touch screen integrated into a display, audio input devices such as a voice recognition system and a microphone, as well as other types of input devices. In general, use of the term "input device" is intended to include all possible types of devices and methods for inputting information into computer system 1200.

[0102] The user interface output devices 1276 may include a display subsystem, a printer, a fax machine, or a non-visual display, such as an audio output device. The display subsystem may include a flat panel device, such as an LED display, a cathode ray tube (CRT), a liquid crystal display (LCD), a projection device, or any other mechanism for generating a visible image. The display subsystem may also provide a non-visual display, such as an audio output device. In general, use of the term "output device" is intended to include all possible types of devices and methods for outputting information from the computer system 1200 to a user or to another machine or computer system.

[0103] The storage subsystem 1210 stores programming and data structures that provide the functionality of some or all of the modules and methods described herein. The subsystem 1278 can be a graphics processing unit (GPU), a programmable gate array (FPGA), or a coarse-grained reconfigurable architecture.

[0104] The memory subsystem 1222 used in the storage subsystem 1210 may include several memories including a main random access memory (RAM) 1232 for storing instructions and data during program execution, and a read only memory (ROM) 1234 in which fixed instructions are stored. The file storage subsystem 1236 may provide persistent storage for program and data files and may include a hard disk drive, a floppy disk drive with associated removable media, a CD-ROM drive, an optical drive, or a removable media cartridge. Modules implementing the functionality of a particular embodiment may be stored by the file storage subsystem 1236 in the storage subsystem 1210 or in another machine accessible by the processor.

[0105] Bus subsystem 1255 provides a mechanism for allowing the various components and subsystems of computer system 1200 to communicate with each other as intended. Although bus subsystem 1255 is shown generally as a single bus, alternative implementations of the bus subsystem may use multiple buses.

[0106] Computer system 1200 can be of various types, including a personal computer, a portable computer, a work station, a computer terminal, a network computer, a television, a server, a mainframe, a widely distributed set of loosely coupled computers, or any other data processing system or user device. Due to the ever-changing nature of computers and networks, the description of computer system 1200 shown in FIG. 12 is intended only as a specific example for purposes of illustrating a preferred embodiment of the present invention. Many other configurations of computer system 1200 are possible having more or fewer components than the computer system shown in FIG. [Specific implementation]

[0107] In one embodiment, a computer-implemented method for detecting and preventing phishing attacks is disclosed.

[0108] The network security system intercepts a web page rendered by the server in response to a user action performed on a client. The network security system analyzes one or more images in the web page and determines that a particular hosted service is represented by the images. The web page masquerades as one or more official web pages of the particular hosted service, accompanied by a valid domain name and certificate issued by the particular hosted service.

[0109] The network security system analyzes one or more fields of a web page and determines that the fields elicit sensitive information. The network security system intercepts a request generated by a client in response to another user action that provides the sensitive information via the fields.

[0110] The network security system analyzes the request and determines that sensitive information is being exfiltrated to an unauthorized resource by comparing the resource address in the request to one or more authorized resource addresses used by a particular hosted service.

[0111] A network security system determines that a web page is conducting a phishing attack and blocks the transmission of sensitive information to unauthorized resources.

[0112] The methods described in this and other sections of the disclosed technology may include one or more of the following features and / or features described in connection with the additional methods disclosed. For the sake of brevity, the combinations of features disclosed in this application are not individually listed and are not repeated with each basic set of features. The reader will understand how the features identified in these embodiments can be easily combined with the sets of basic features identified in other embodiments.

[0113] The particular hosted service may be a cloud computing and storage service, and the web page may be hosted on the cloud computing and storage service. The web page may have a uniform resource locator (URL) of the cloud computing and storage service, which may be different from one or more official URLs of the particular hosted service.

[0114] A particular hosted service may be a website. The network security system may be configured with an image classifier trained to map web page images to the hosted service. In one embodiment, the image classifier is a convolutional neural network (CNN).

[0115] Authorized resource addresses used by a particular hosted service may be identified in a metadata store maintained in the network security system. The authorized resource addresses may be identified by at least one of a domain name, a subdomain name, a uniform resource identifier (URI), and a URL. The authorized resource addresses may be identified by at least one of an Internet Protocol (IP) address, a Server Name Indication (SNI), and a Subject Alternative Name (SAN).

[0116] The request can include a HyperText Transfer Protocol (HTTP) header, and the resource address can be identified in a POST field of the HTTP header. The request can include an HTTP header, and the resource address can be identified in a Referer field of the HTTP header.

[0117] The fields that elicit sensitive information may be username and password authentication fields, PHI fields, and / or PCI fields.

[0118] Other implementations of the methods described in this section may include a non-transitory computer-readable storage medium storing instructions executable by a processor to perform any of the methods described above. Yet another implementation of the methods described in this section may include a system including a memory and one or more processors operable to execute instructions stored in the memory to perform any of the methods described above.

[0119] In another embodiment, a computer-implemented method for detecting and preventing phishing attacks is disclosed.

[0120] An endpoint security system intercepts a web page rendered by the server in response to a user action performed on a client. The endpoint security system analyzes one or more images in the web page and determines that a particular hosted service is represented by the images. The web page masquerades as one or more official web pages of the particular hosted service, accompanied by a valid domain name and certificate issued by the particular hosted service.

[0121] The endpoint security system analyzes one or more fields on a web page and determines that the fields elicit sensitive information. The endpoint security system intercepts a request generated by a client in response to another user action that provides the sensitive information via the fields.

[0122] The endpoint security system analyzes the request and determines that sensitive information is being exfiltrated to an unauthorized resource by comparing the resource address in the request to one or more authorized resource addresses used by the particular hosted service.

[0123] The endpoint security system determines that the web page is conducting a phishing attack and blocks the transmission of sensitive information to unauthorized resources.

[0124] The methods described in this and other sections of the disclosed technology may include one or more of the following features and / or features described in connection with the additional methods disclosed. For the sake of brevity, the combinations of features disclosed in this application are not individually recited and are not repeated with each basic set of features. The reader will understand how the features identified in these embodiments can be readily combined with the sets of basic features identified in other embodiments.

[0125] The particular hosted service may be a cloud computing and storage service, and the web page may be hosted on the cloud computing and storage service. The web page may have a uniform resource locator (URL) of the cloud computing and storage service, which may be different from one or more official URLs of the particular hosted service.

[0126] The particular hosted service may be a website. The endpoint security system may be configured with an image classifier trained to map web page images to the hosted service. In one embodiment, the image classifier is a convolutional neural network (CNN).

[0127] Authorized resource addresses used by a particular hosted service may be identified in a metadata store maintained in the endpoint security system. The authorized resource addresses may be identified by at least one of a domain name, a subdomain name, a uniform resource identifier (URI), and a URL. The authorized resource addresses may be identified by at least one of an Internet Protocol (IP) address, a Server Name Indication (SNI), and a Subject Alternative Name (SAN).

[0128] The request can include a HyperText Transfer Protocol (HTTP) header, and the resource address can be identified in a POST field of the HTTP header. The request can include an HTTP header, and the resource address can be identified in a Referer field of the HTTP header.

[0129] The fields that elicit sensitive information may be username and password authentication fields, PHI fields, and / or PCI fields.

[0130] Other implementations of the methods described in this section may include a non-transitory computer-readable storage medium storing instructions executable by a processor to perform any of the methods described above. Yet another implementation of the methods described in this section may include a system including a memory and one or more processors operable to execute instructions stored in the memory to perform any of the methods described above. [Terms]

[0131] The following provisions are disclosed: 1. A computer-implemented method for machine learning-based data loss prevention (DLP), comprising: providing input characterizing the content to a machine learning model trained to determine whether the content is sensitive; processing the input through the machine learning model and converting an analysis by the machine learning model into an alternative representation of the input; and processing the alternative representations through an output layer to classify the content as sensitive or non-sensitive; 23. A computer-implemented method comprising: 2. The computer-implemented method of clause 1, wherein the content is image data and the machine learning model is a convolutional neural network (CNN). 3. The computer-implemented method of clause 1, wherein the content is text data and the machine learning model is a recurrent neural network (RNN). 4. The computer-implemented method of claim 1, wherein the content is text data and the machine learning model is an attention-based neural network (e.g., Transformer, Bert). 5. The computer implemented method of clause 1, wherein the machine learning model is trained on training examples that are signatures of sensitive content and annotated with sensitive ground truth labels for training. 6. The computer-implemented method of clause 1, wherein the machine learning model is trained on training examples that are signatures of non-sensitive content and annotated with non-sensitive ground truth labels for training. 7. A computer-implemented method of machine learning based threat detection, comprising: providing input characterizing a potential threat signature to a machine learning model trained to determine whether the potential threat signature is malicious; processing the input through the machine learning model and converting an analysis by the machine learning model into an alternative representation of the input; and processing the alternative representations through an output layer to classify the potential threat signatures as malicious or non-malicious; 23. A computer-implemented method comprising: 8. The computer-implemented method of clause 7, wherein the potential threat signatures are image data and the machine learning model is a convolutional neural network (CNN). 9. The computer-implemented method of clause 7, wherein the potential threat signatures are text data and the machine learning model is a recurrent neural network (RNN). 10. The computer-implemented method of clause 7, wherein the potential threat signatures are text data and the machine learning model is an attention-based neural network (e.g., Transformer, Bert). 11. The computer implemented method of clause 7, wherein the machine learning model is trained with training examples that are signatures of real threats and annotated with malicious ground truth labels for training. 12. The computer-implemented method of clause 7, wherein the machine learning model is trained with training examples that are false threat signatures and annotated with non-malicious ground truth labels for training. 13. A computer-implemented method of machine learning based threat detection, comprising: providing input characterizing a potential threat signature to a machine learning model trained to determine whether the potential threat signature is a first threat type or a second threat type; processing the input through the machine learning model and converting an analysis by the machine learning model into an alternative representation of the input; and processing the alternative representations through an output layer to classify the potential threat signatures as the first threat type or the second threat type; 23. A computer-implemented method comprising: 14. The computer-implemented method of clause 13, wherein the potential threat signatures are image data and the machine learning model is a convolutional neural network (CNN). 15. The computer-implemented method of clause 13, wherein the potential threat signatures are text data and the machine learning model is a recurrent neural network (RNN). 16. The computer-implemented method of claim 13, wherein the potential threat signatures are text data and the machine learning model is an attention-based neural network (e.g., Transformer, Bert). 17. The computer-implemented method of clause 13, wherein the machine learning model is trained with training examples that are signatures of the first threat type and annotated with ground truth labels of the first threat type for training. 18. The computer-implemented method of clause 13, wherein the machine learning model is trained with training examples that are signatures of the second threat type and annotated with ground truth labels of the second threat type for training. 19. providing input characterizing a potential threat signature to a machine learning model trained to determine whether the potential threat signature is a first threat type, a second threat type, or a third threat type; processing the input through the machine learning model and converting an analysis by the machine learning model into an alternative representation of the input; and processing the alternative representations through an output layer to classify the potential threat signatures as the first threat type or the second threat type or the third threat type; 14. The computer implemented method of claim 13 further comprising: 20. The computer-implemented method of clause 19, wherein the machine learning model is trained with training examples that are signatures of the third threat type and annotated with ground truth labels of the third threat type for training. 21. A computer-implemented machine learning based method for cloud application (hosted service) classification, comprising: providing input characterizing the content to a machine learning model trained to determine which cloud application the content identifies among a plurality of cloud applications (e.g., Box, Google Drive, Gmail, Office 365, Outlook, Word, Excel, Dropbox, etc.); processing the input through the machine learning model and converting an analysis by the machine learning model into an alternative representation of the input; and processing the alternative representations through an output layer and classifying the content as identifying a particular cloud application among a plurality of cloud applications; 23. A computer-implemented method comprising:

[0132] The methods described in this and other sections of the disclosed technology may include one or more of the following features and / or features described in connection with the additional methods disclosed. For the sake of brevity, the combinations of features disclosed in this application are not individually listed and are not repeated with each basic set of features. The reader will understand how the features identified in these embodiments can be easily combined with the sets of basic features identified in other embodiments.

[0133] Other implementations of the methods described in this section may include a non-transitory computer-readable storage medium storing instructions executable by a processor to perform any of the methods described above. Yet another implementation of the methods described in this section may include a system including a memory and one or more processors operable to execute instructions stored in the memory to perform any of the methods described above.

[0134] The disclosed technology is disclosed by referring to the preferred embodiments and examples detailed above, but it should be understood that these examples are intended in an illustrative, not limiting sense. Those skilled in the art can easily imagine modifications and combinations of the disclosed technology, and these modifications and combinations are considered to be within the spirit of the present invention and the scope of the following claims.

Claims

1. 1. A computer-implemented method for detecting and preventing phishing attacks, comprising: A network security system intercepts web pages transmitted by a server for a hosted service, the hosted service being a cloud computing and storage service, in response to a user action performed on a client; said network security system analyzing one or more images of said web page to determine that a particular hosted service is represented by said images; the network security system detecting that the web page is accompanied by a valid domain name and certificate presented by the particular hosted service, where the web page masquerades as one or more official web pages of the particular hosted service; said network security system analyzing one or more fields of said web page to determine that said fields elicit sensitive information; said network security system intercepting requests generated by said client in response to another user action providing said sensitive information via said field; the network security system determining that the sensitive information is being retrieved to an unauthorized resource by analyzing the request and comparing a resource address in the request to one or more authorized resource addresses used by the particular hosted service; and the network security system determining that the web page is conducting a phishing attack and blocking transmission of the sensitive information to the unauthorized resource; 23. A computer-implemented method comprising:

2. 2. The computer-implemented method of claim 1, wherein the web page has a uniform resource locator (URL) for the cloud computing and storage service that is different from one or more official URLs for the particular hosted service.

3. 2. The computer-implemented method of claim 1, wherein the particular hosted service is a website.

4. 10. The computer-implemented method of claim 1, wherein the network security system is configured with an image classifier trained to map web page images to hosted services.

5. 5. The computer-implemented method of claim 4, wherein the image classifier is a convolutional neural network (CNN).

6. 10. The computer-implemented method of claim 1, wherein the authorized resource addresses used by the particular hosted service are identified in a metadata store maintained in the network security system.

7. 7. The computer-implemented method of claim 6, wherein the authorized resource addresses are identified by at least one of a domain name, a subdomain name, a uniform resource identifier (URI), and a URL.

8. 7. The computer-implemented method of claim 6, wherein the authorized resource addresses are identified by at least one of an Internet Protocol (IP) address, a Server Name Indication (SNI), and a Subject Alternative Name (SAN).

9. 2. The computer-implemented method of claim 1, wherein the request includes a HyperText Transfer Protocol (HTTP) header, and the resource address is identified in a POST field of the HTTP header.

10. 2. The computer-implemented method of claim 1, wherein the request includes an HTTP header, and the resource address is identified in a referrer field of the HTTP header.

11. 2. The computer-implemented method of claim 1, wherein the field that elicits sensitive information is a username and password authentication field.

12. 1. A computer-implemented method for detecting and preventing phishing attacks, comprising: The endpoint security system intercepts web pages transmitted by a server for a hosted service, which is a cloud computing and storage service, in response to a user action performed on a client; the endpoint security system analyzing one or more images of the web page to determine that a particular hosted service is represented by the image; the endpoint security system detecting that the web page is accompanied by a valid domain name and certificate presented by the particular hosted service, where the web page masquerades as one or more official web pages of the particular hosted service; the endpoint security system analyzing one or more fields of the web page and determining that the fields elicit sensitive information; the endpoint security system intercepting a request generated by the client in response to another user action providing sensitive information via the field; the endpoint security system determining that the sensitive information is being retrieved to an unauthorized resource by analyzing the request and comparing a resource address in the request to one or more authorized resource addresses used by the particular hosted service; and the endpoint security system determining that the web page is conducting a phishing attack and blocking transmission of the sensitive information to the unauthorized resource; 23. A computer-implemented method comprising:

13. 13. The computer-implemented method of claim 12, wherein the endpoint security system is configured with an image classifier trained to map images to hosted services.

14. The authorized resource addresses used by the particular hosted service are identified in a metadata store maintained in the endpoint security system.

14. The computer-implemented method of claim 13.

15. A non-transitory computer-readable storage medium having stored thereon computer program instructions for detecting and preventing phishing attacks, comprising: A non-transitory computer-readable storage medium having instructions which, when executed on a processor, perform the method of claim 1.

16. A non-transitory computer-readable storage medium having stored thereon computer program instructions for detecting and preventing phishing attacks, comprising: A non-transitory computer-readable storage medium having instructions which, when executed on a processor, perform the method of claim 12.

17. 1. A system including one or more processors coupled to a memory, computer program instructions loaded into said memory for detecting and preventing phishing attacks; A system in which the instructions, when executed on the processor, perform the method of claim 1.

18. 1. A system including one or more processors coupled to a memory, computer program instructions loaded into said memory for detecting and preventing phishing attacks; A system in which the instructions, when executed on the processor, perform the method of claim 12.

Images