DOM Hash Phishing Detection for Faster, More Accurate Screening
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting phishing sites are inefficient due to high false positive rates and require extensive processing time, especially with large volumes of data, and machine learning models are prone to learning to detect easy cases rather than sophisticated phishing attacks.
Innovation Solution
A system and method using Document Object Model (DOM) hashes and a machine learning classifier to analyze webpages, generating hashes from DOM tree elements and training the classifier with balanced datasets to reduce false positives and increase true positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional machine learning models are used to detect phishing sites, then processing speed is improved, but false positive rate increases and detection accuracy for sophisticated attacks deteriorates
Solution Approach 1:
The patent segments the webpage analysis into two distinct phases: DOM structure analysis (parsing HTML into DOM tree and generating structural hashes) and content analysis (processing text and media content). This segmentation allows the system to handle sophisticated phishing attacks more accurately while maintaining processing efficiency, as each phase can be optimized independently for its specific detection goals.
Solution Approach 2:
The patent introduces DOM structure hashes as an intermediary representation between the raw HTML and the machine learning classifier. These hashes capture the structural characteristics of phishing pages without requiring full content processing, enabling faster preliminary detection while maintaining accuracy for sophisticated attacks that rely on structural manipulation.
2Reliability
If extensive data processing is performed to improve detection accuracy, then true positive rate increases, but analysis time increases
Solution Approach 1:
The patent performs preliminary DOM structure analysis and hash generation before full content processing. This preliminary action creates a structural fingerprint that can quickly identify phishing patterns, reducing the need for extensive content processing in many cases and thereby decreasing analysis time while maintaining detection reliability.
Solution Approach 2:
The system applies partial processing by focusing computational resources on the most discriminative features (DOM structure hashes and key content elements) rather than processing all webpage data equally. This partial action approach achieves high detection reliability with reduced analysis time by avoiding unnecessary processing of redundant information.
3Adaptability or versatility
If machine learning models are trained on large datasets, then detection coverage is improved, but training quality deteriorates due to inclusion of blocked pages and errors
Solution Approach 1:
The patent applies local quality by creating specialized processing pipelines for different types of training data: phishing pages are processed to extract structural and content features, while legitimate pages are processed separately to establish baseline characteristics. This local quality approach ensures that each data type is processed with appropriate methods, improving training data quality while maintaining broad detection coverage.
Solution Approach 2:
The system changes parameters by using DOM structure hashes as a stable, transformation-resistant feature for training data representation. This parameter change makes the training process more robust to variations in webpage formatting and content, improving training data quality by focusing on invariant structural characteristics rather than volatile content details.
4Measurement precision
If comprehensive webpage analysis is performed, then detection accuracy is improved, but processing load increases
Solution Approach 1:
The patent extracts and prioritizes the most discriminative features (DOM structure hashes and key content elements) from the complete webpage data. This extraction approach maintains detection accuracy by focusing on the most informative features while reducing processing load by eliminating unnecessary processing of redundant or less informative data.
Data Source
AI summary
Disclosed herein are systems and methods for detecting phishing sites using Document Object Model (DOM) hashes and a machine learning (ML) classifier. In one aspect, an exemplary method comprises: parsing at least one webpage of a website to generate a DOM tree of the webpage; generating at least one string of DOM tree elements according to one of more predetermined patterns; generating a hash of at least one string; checking if the hash is found in a database of hashes of known fishing websites; when the hash is not in the database, analyzing the associated webpage using a ML-based classifier trained to identify phishing websites; and determining if the webpage is a phishing or not based on the output of the classifier.