Mobile Security Module Detecting Malicious Websites via Favicon Image Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile devices are vulnerable to malicious websites due to processing-intensive detection tools that require remote server access, leading to high bandwidth consumption, latency, and potential tampering, making it difficult to implement effective classifiers for real-time security analysis.
Innovation Solution
A security module installed on mobile devices detects malicious websites by retrieving a representative image (favicon) of unknown websites and comparing it to a quilt of images from known legitimate websites, allowing for on-device analysis and immediate security actions without offloading processing to a server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If processing-intensive detection tools are used to detect malicious websites, then detection accuracy is improved, but bandwidth consumption increases and latency increases
Solution Approach 1:
The patent extracts only the essential visual features (favicon images) from website URLs for analysis, rather than processing entire website contents or large datasets. This extraction approach maintains detection accuracy while significantly reducing the data volume that needs to be transmitted to remote servers, thereby lowering bandwidth consumption.
Solution Approach 2:
The detection process is segmented into multiple stages: local preprocessing of favicon images on the mobile device, selective transmission of extracted features to remote servers, and final classification. This segmentation allows computationally intensive operations to be performed locally with minimal network transmission, reducing overall bandwidth usage while maintaining detection effectiveness.
2Reliability
If processing-intensive detection tools are used to detect malicious websites, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The system performs preliminary processing of website favicon images locally on the mobile device before transmission to remote servers. By pre-processing and extracting key visual features in advance, the system reduces the time required for remote analysis and accelerates the overall detection process while maintaining high detection accuracy.
Solution Approach 2:
The patent replaces traditional mechanical processing methods (processing entire website contents) with optical-based image recognition techniques. By substituting heavy text and content analysis with efficient image processing of favicons, the system achieves faster processing speeds while maintaining or improving detection accuracy through visual pattern recognition.
3Reliability
If classifiers are located on remote servers, then detection capability is improved, but device complexity increases and security risk increases
Solution Approach 1:
The patent introduces a lightweight intermediary component on mobile devices that performs initial favicon extraction and preprocessing before data is sent to remote servers. This intermediary layer simplifies the overall system architecture by handling data preparation locally, reducing the complexity burden on both the mobile device and remote server while maintaining enhanced detection capability.
4Reliability
If classifiers are located on remote servers, then detection capability is improved, but security risk increases
Solution Approach 1:
The system performs preliminary security validation by analyzing favicon images locally on the mobile device before transmitting data to remote servers. This preliminary anti-action approach allows the system to detect and block obviously malicious sites early in the process, reducing the risk of exposing sensitive device data to potentially compromised remote servers while maintaining strong detection capability.
Data Source
AI summary
A system and a method are disclosed for detecting a malicious website. In an embodiment, a mobile device detects a URL referencing an unknown website. Responsive to detecting the URL, the mobile device retrieves a representative image of the unknown website. The mobile device determines whether the representative image matches an image of a known legitimate website. Responsive to determining that the representative image matches the image of the known legitimate website, the mobile device determines if the unknown website is malicious. The mobile device performs a security action responsive to determining that the website is malicious.