Browser UI Imitation Detection Using Local Phishing Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing browser security techniques fail to efficiently identify newly generated phishing webpages and are hindered by latency due to external calls to third-party blacklists, while code obfuscation techniques evade detection.
Innovation Solution
Implementing a browser plugin module that downloads and executes locally trained machine learning modules to compare requested webpages with authentic interfaces, reducing latency by local suspiciousness detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If third-party blacklists are consulted for browser security, then security coverage is improved, but latency increases due to external calls
Solution Approach 1:
The system pre-loads machine learning models and authentic webpage templates into the browser before phishing attempts occur. This preliminary preparation eliminates the need for external calls during actual phishing detection, reducing latency while maintaining security coverage through local model execution.
2Measurement precision
If third-party blacklists are used for phishing detection, then detection capability is improved, but detection speed decreases due to external communication requirements
Solution Approach 1:
The browser performs self-service phishing detection by executing locally stored machine learning models that autonomously analyze webpage characteristics. This eliminates dependency on external blacklist services, enabling rapid local detection without communication delays while maintaining sophisticated detection capabilities through trained models.
3Adaptability or versatility
If code obfuscation techniques are used by malicious users, then evasion capability is improved, but detection accuracy deteriorates
Solution Approach 1:
The system changes the detection parameters from traditional code-based analysis to visual/template-based comparison. By transforming webpages into standardized templates and comparing visual characteristics rather than relying on code parsing, the system becomes resilient to code obfuscation techniques while maintaining high detection accuracy through invariant visual feature comparison.
4Productivity
If local machine learning modules are implemented for real-time detection, then detection speed is improved, but device resources are consumed
Solution Approach 1:
The system implements local quality by deploying lightweight machine learning models specifically optimized for browser-based phishing detection rather than using heavy enterprise-grade systems. The models are tailored to analyze specific visual and structural features of webpages, consuming minimal device resources while achieving real-time detection speeds through efficient local computation.
Data Source
AI summary
Techniques are disclosed relating to generating trained machine learning modules to identify whether user interfaces accessed by a computing device match user interfaces associated with a set of Internet domain names. A server computer system receives a set of Internet domain names and generates screenshots for user interfaces associated with the set of Internet domain names. The server computer system then trains machine learning modules that are customized for the set of Internet domain names using the screenshots. The server then transmits the machine learning modules to the computing device, where the machine learning modules are usable by an application executing on the computing device to identify whether a user interface accessed by the device matches a user interface associated with the set of Internet domain names. Such techniques may advantageously allow servers to identify whether user interfaces are suspicious without introducing latency and increased page load times.