Website Phishing Detection Using Brand-Filtered Siamese Neural Network
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Phishing attacks have become increasingly sophisticated, mimicking targeted benign websites to evade detection, making it difficult to distinguish between legitimate and malicious sites, especially when the reference website bank is large.
Innovation Solution
A neural twin network, or siamese NN, is used to compare website screenshots against a reduced set of relevant reference images, identified by brand identifiers, to efficiently detect phishing sites by leveraging image similarity analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a large bank of reference benign website pages is used for phishing detection, then detection accuracy is improved, but computational complexity increases making the process prohibitive
Solution Approach 1:
The patent segments the large bank of reference benign website pages into multiple clusters based on visual similarity. Instead of comparing the query page against all reference pages, the system first identifies relevant clusters and then performs detailed comparison only within those clusters. This segmentation reduces computational complexity while maintaining detection accuracy by focusing resources on the most relevant comparisons.
Solution Approach 2:
The patent performs preliminary clustering and organization of reference website pages before the actual phishing detection process. By pre-grouping reference pages into clusters based on their visual characteristics, the system prepares the data structure in advance so that during detection, it can quickly identify and access only the relevant clusters rather than searching through the entire reference bank. This preliminary action significantly reduces the computational burden during real-time detection.
2Reliability
If comprehensive website page comparisons are performed for accurate phishing detection, then detection reliability is improved, but processing time increases
Solution Approach 1:
The patent divides the reference website bank into multiple clusters based on visual similarity metrics. When detecting phishing, the system segments the search space by first identifying which clusters are relevant to the query page, then performing comprehensive comparisons only within those segmented clusters. This approach maintains detection reliability through thorough comparison while reducing processing time by eliminating irrelevant clusters from the search.
Solution Approach 2:
The system performs preliminary clustering of reference websites and pre-computes similarity metrics before actual detection occurs. This preliminary organization allows the system to quickly identify relevant clusters during detection without performing comprehensive comparisons across all reference pages. The reliability is maintained because the clustering is based on meaningful visual features, ensuring that relevant phishing pages are not missed while significantly reducing processing time.
Data Source
AI summary
Website phishing detection is enabled using a siamese neural network. One twin receives a query image associated with a website page. The other twin receives a subset of a set of reference website images together with positive (phishing) examples that were used to train the networks, the subset of reference website images having been determined by applying an identifier associated with a brand of interest. The operation of applying the identifier significantly reduces the relevant search space for the inferencing task. If the inferencing determines a sufficient likelihood that the website page is a phishing page, control signaling is generated to control a system to take a given mitigation action.