DOM Hash Classifier for Faster, Lower-False-Positive Phishing Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting phishing sites are inefficient due to high false positive rates and require extensive processing time, especially with large volumes of data, and machine learning models are prone to learning to detect easy cases rather than sophisticated phishing attacks.
Innovation Solution
A method and system using Document Object Model (DOM) hashes to create a classifier for phishing detection, involving parsing web pages into DOM trees, generating hashes from these trees, and training a machine learning model on diverse datasets to reduce false positives and increase true positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If machine learning models are used to detect phishing sites, then processing speed improves, but false positive rate increases
Solution Approach 1:
The patent segments the phishing detection task into multiple stages: initial filtering using DOM hash comparison, followed by machine learning classification only for suspicious cases. This segmentation allows fast processing of obvious cases while reducing false positives by avoiding ML classification on clearly safe pages.
Solution Approach 2:
The patent changes the parameter representation from raw HTML content to DOM tree hash values. By converting web pages into structured DOM representations and comparing their hashes, the system achieves faster processing while maintaining detection accuracy, thereby reducing false positives.
2Measurement precision
If extensive data processing is performed to improve detection accuracy, then true positive rate improves, but analysis time increases
Solution Approach 1:
The patent performs preliminary action by generating and storing DOM hash values for all web pages in advance. During detection, the system first compares the DOM hash of the queried page against the pre-computed database, enabling rapid filtering before more time-consuming analysis is performed.
Solution Approach 2:
The patent extracts the essential structural features of web pages by generating DOM tree hashes, separating the critical structural information from the full page content. This extraction allows for efficient comparison and detection without processing the entire page data.
3Adaptability or versatility
If machine learning models are trained on all available data, then detection coverage improves, but model quality deteriorates due to learning easy cases
Solution Approach 1:
The patent applies local quality by treating different types of pages differently: simple phishing pages are detected through DOM hash comparison, while sophisticated phishing attempts require ML classification. This localized approach ensures that the ML model focuses computational resources on complex cases rather than wasting capacity on easily detectable patterns.
Data Source
AI summary
Disclosed herein are systems and methods for creating a classifier for detecting phishing sites using Document Object Model (DOM) hashes. In one aspect, an exemplary method comprises: parsing each page of the website, wherein the parsing includes at least generating a DOM tree of the page, for each page, generating at least one string of DOM tree elements according to predetermined patterns, creating a first hash based on the string, creating a second hash for the page, generating a first dataset comprising hashes of safe pages and a second dataset comprising hashes of phishing pages, analyzing the first and second datasets to determine whether there is diversity of data in each dataset, generating a training sample from the datasets when there is diversity of data, and training a classifier of a machine learning model based on the training sample generated from the first and second datasets.