User Interface Imitation Detection with Local Screenshot Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing browser security techniques fail to efficiently identify newly generated phishing webpages and are hindered by latency due to external calls to third-party blacklists, while code obfuscation techniques evade detection.
Innovation Solution
A browser plugin module installs machine learning modules trained on user-specific webpages to locally identify suspicious interfaces by comparing screenshots with authentic pages, reducing latency and reliance on external blacklists.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If third-party blacklists are consulted to identify phishing webpages, then browser security is improved, but latency increases due to external calls
Solution Approach 1:
The patent segments the security verification process by dividing it into local screenshot capture and comparison operations performed directly in the browser plugin, separate from external blacklist consultation. This allows the browser to independently verify webpage authenticity without waiting for external services, thereby reducing latency while maintaining security reliability
Solution Approach 2:
The patent introduces screenshot comparison as an intermediary verification mechanism between the browser and external blacklists. Instead of directly relying on external blacklist calls, the system uses local screenshot capture and comparison with cached authentic webpage screenshots as an intermediate step to quickly identify phishing attempts, reducing dependence on external calls and associated latency
2Reliability
If third-party blacklists are used to detect phishing webpages, then security coverage is improved, but the system fails to identify newly generated phishing pages
Solution Approach 1:
The patent performs preliminary action by capturing and caching screenshots of authentic webpages before phishing attempts occur. These cached screenshots serve as reference templates that enable the browser to immediately detect newly generated phishing pages by comparing their screenshots against the cached authentic versions, without needing to wait for blacklist updates
Solution Approach 2:
The patent enables the browser to perform self-service security verification by locally capturing screenshots of visited webpages and comparing them against cached authentic webpage screenshots. This self-contained verification mechanism allows the browser to independently identify newly generated phishing pages without relying on external blacklist services, improving both security coverage and adaptability to new threats
3Object-generated harmful factors
If code obfuscation techniques are used to create phishing pages, then malicious functionality is hidden, but detection systems cannot identify the malicious nature
Solution Approach 1:
The patent uses copying by capturing screenshots of webpages, which creates a visual replica of the webpage's appearance. This screenshot copy reveals the actual visual content and layout, making it impossible for code obfuscation techniques to hide the phishing nature, as the comparison is based on visual appearance rather than source code analysis
4Productivity
If local screenshot comparison is performed to identify phishing pages, then detection speed is improved, but memory usage increases
Solution Approach 1:
The patent applies local quality by caching screenshots only for specific authentic webpages that are likely to be phished, rather than caching all webpages. This selective caching approach stores reference images locally in a targeted manner, enabling fast local comparison for high-risk sites while minimizing overall memory consumption
Data Source
AI summary
A server computer system receives a set of Internet domain names and generates screenshots for user interfaces associated with the set of Internet domain names. The server computer system then trains machine learning modules that are customized for the set of Internet domain names using the screenshots. The server then transmits the machine learning modules to the computing device, where the machine learning modules are usable by an application executing on the computing device to identify whether a user interface accessed by the device matches a user interface associated with the set of Internet domain names. Such techniques may advantageously allow servers to identify whether user interfaces are suspicious without introducing latency and increased page load times.