Phishing Detection via DOM Rendering and Analysis

Solution Overview

Problem

Traditional phishing detection systems are limited in their ability to accurately identify sophisticated phishing attacks, as they primarily rely on static website information and fail to analyze dynamic content and obfuscated phishing techniques.

Innovation Solution

The solution involves rendering and analyzing document object model (DOM) objects associated with a website to identify features indicative of phishing behavior, executing embedded functions to understand the full scope of website functionality, and applying phishing models to determine if a website is engaging in phishing activity.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If traditional static website information analysis is used for phishing detection, then the detection system is simple and fast, but the detection accuracy is limited and cannot identify sophisticated phishing attacks

Engineering Contradiction:

Improvephishing detection accuracyVSAvoiddetection system complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The system performs preliminary rendering of the website DOM object before analysis, executing all embedded functions and scripts to transform static HTML into a dynamic representation of the actual website behavior. This preliminary action ensures that phishing detection occurs on the fully rendered DOM structure, capturing dynamic content and obfuscated phishing techniques that would be invisible in static analysis.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent replaces traditional mechanical/static analysis methods with a dynamic rendering engine that executes JavaScript and other embedded functions. This substitution transforms the detection mechanism from passive static information examination to active dynamic behavior simulation, enabling identification of sophisticated phishing attacks that rely on client-side obfuscation.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Measurement precision

If dynamic content and embedded functions are executed to analyze phishing behavior, then detection accuracy improves, but analysis time and computational resources increase

Engineering Contradiction:

Improvephishing detection accuracyVSAvoidwebsite analysis time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system extracts and analyzes specific phishing-indicative features from the rendered DOM object rather than processing the entire website content. By identifying and focusing on key characteristics such as form field patterns, suspicious DOM manipulations, and phishing-specific behavioral markers, the system achieves high detection accuracy while minimizing analysis time and computational overhead.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent implements a targeted analysis approach that executes only the necessary embedded functions required to reveal phishing behavior, rather than comprehensively executing all possible website functions. This partial action strategy suffices to detect phishing indicators while avoiding unnecessary computational expenditure on benign website functionality.

Inventive Principle:

Principle #16Partial or excessive action

3Reliability

If static website information is used for phishing detection, then resource consumption is low, but the system cannot detect obfuscated phishing techniques and dynamic content

Engineering Contradiction:

Improvephishing detection capabilityVSAvoidcomputational resource consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The system performs preliminary rendering of the website DOM object before analysis, executing all embedded functions and scripts to transform static HTML into a dynamic representation of the actual website behavior. This preliminary action ensures that phishing detection occurs on the fully rendered DOM structure, capturing dynamic content and obfuscated phishing techniques that would be invisible in static analysis.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent replaces traditional mechanical/static analysis methods with a dynamic rendering engine that executes JavaScript and other embedded functions. This substitution transforms the detection mechanism from passive static information examination to active dynamic behavior simulation, enabling identification of sophisticated phishing attacks that rely on client-side obfuscation.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS11165822B2Identifying phishing websites using DOM characteristics

Publication Date: 2021.11.02 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

Embodiments of the present invention are directed to identifying phishing websites by rendering and analyzing document object model (DOM) objects associated with a website for features that indicate phishing behavior. Embodiments analyze the full scope and functionality associated with a website by executing functions embedded in a DOM object before analyzing the website for phishing activity. Accordingly, embodiments render and analyze a fully executed DOM object for phishing behavior. Embodiments may then perform steps to mediate a website that is classified as performing phishing. Thus, embodiments are configured to (1) collect website information from a variety of websites and web servers connected to the internet, (2) analyze the collected data to determine whether the website information is performing phishing, and (3) mediate websites and other actors that are determined to be performing phishing based on the results of the phishing analysis.