Accessibility Service Phishing Detection Overlay
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for preventing phishing attacks on computing devices are inadequate as they often allow users to select malicious content before thorough analysis, leading to potential phishing attacks, especially due to timing issues and large attack surfaces across various platforms.
Innovation Solution
The system employs an accessibility service on the computing device to detect malicious content by analyzing screen content, displaying an overlay window to inform the user, and preventing selection, while also utilizing a VPN to block network connections to malicious content, and optionally contacting cloud services for verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional phishing prevention methods are used, then users can access content freely, but users may select malicious content before thorough analysis is completed
Solution Approach 1:
The system performs preliminary analysis of content links and attachments before the user interacts with them. The accessibility service monitors screen content and pre-evaluates potential malicious elements, so that when a user hovers over or attempts to click a link, the detection is already complete and prevention can be immediately enacted.
Solution Approach 2:
The system takes preliminary anti-action by blocking malicious content access before the user can be compromised. The accessibility service detects malicious patterns in advance and prevents the harmful action (clicking malicious links or downloading infected attachments) before it can occur, rather than reacting after detection.
2Reliability
If VPN-based detection and prevention is used, then malicious content can be blocked, but VPN timeouts may occur before detection is complete
Solution Approach 1:
The accessibility service acts as an intermediary layer between the user interface and the VPN/network connection. It monitors screen content and user interactions locally, performing initial detection and prevention without requiring constant VPN round-trip communication, thereby eliminating VPN timeout delays while maintaining blocking capability.
Solution Approach 2:
The system performs self-service detection by using the accessibility service to monitor and analyze screen content locally on the device. This local monitoring capability allows the system to independently detect malicious content without waiting for external VPN server responses, eliminating timeout delays.
3Measurement precision
If thorough analysis of all content is performed, then phishing detection accuracy improves, but analysis time increases
Solution Approach 1:
The system applies partial analysis by focusing detection efforts on specific high-risk elements such as links and attachments, rather than analyzing all content uniformly. The accessibility service identifies and prioritizes potentially malicious elements for thorough analysis, while other content receives minimal or no analysis, achieving high detection accuracy for critical threats without excessive overall analysis time.
Data Source
AI summary
Systems and methods disclosed that receive, from an accessibility service executing on a computing device, screen content that is displayed on a screen of the computing device to a user. The accessibility service is configured to interact with a graphical user interface executing on the computing device to determine the screen content and determine that the screen content includes malicious content. The systems and methods perform an operation, by the computing device, that impedes the user from selecting the malicious content.