Malicious UI Detection via Whitelist Image Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems fail to effectively identify malicious user interfaces, which are designed to trick users into performing harmful actions by appearing innocuous, evading automated anti-malware detection.
Innovation Solution
A method and system that detect the launch of a user interface, gather its characteristics, compare them to a whitelist of permissible images and other attributes, and perform security actions when mismatches are found, such as preventing data entry and displaying warnings.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If automated anti-malware techniques are used to detect malicious software, then detection speed is improved, but malicious user interfaces designed to appear innocuous can evade detection
Solution Approach 1:
The system performs preliminary actions by capturing screenshots of user interfaces before they can execute malicious actions, and by pre-establishing a whitelist of legitimate UI images. This allows the system to proactively identify and block malicious interfaces before they can trick users into performing harmful actions, resolving the contradiction between fast automated detection and reliable identification of sophisticated malware.
Solution Approach 2:
The system creates visual copies (screenshots) of user interfaces to analyze and compare against a whitelist of legitimate interfaces. By working with these visual copies rather than directly intercepting or blocking processes, the system achieves both rapid automated detection and high reliability in identifying malicious interfaces that attempt to appear innocuous.
2Measurement precision
If comprehensive UI characteristics are gathered and compared to identify malicious interfaces, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The system extracts only the essential visual characteristics of user interfaces (screenshots) and compares them against a whitelist, rather than analyzing all possible UI attributes. This extraction approach maintains high detection accuracy by focusing on the most discriminating feature (visual appearance) while avoiding the complexity of comprehensive multi-dimensional analysis.
Solution Approach 2:
The system introduces a whitelist of legitimate UI images as an intermediary reference standard. Instead of directly analyzing complex UI characteristics to determine maliciousness, the system compares captured screenshots against this pre-established whitelist, simplifying the detection process while maintaining high accuracy in identifying deviations from legitimate interfaces.
Data Source
AI summary
The disclosed computer-implemented method for identifying a malicious user interface may include (1) detecting, at a computing device, a launch of a user interface (UI), (2) gathering characteristics of the UI including a UI image, (3) identifying the UI is not permissible by comparing the UI image to a whitelist including permissible UI images, and (4) performing, when the UI image is not permissible, a security action. Various other methods, systems, and computer-readable media are also disclosed.