OCR Content Signatures for Obfuscated Phishing Messages
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional content signature generation techniques struggle to effectively identify phishing attacks due to malicious entities' use of HTML customization and obfuscation techniques, which complicate the generation of reliable and consistent signatures.
Innovation Solution
Utilize optical character recognition (OCR) and text processing to generate content signatures by removing obfuscation and customization, converting text into tokens, and applying fuzzy hash functions to create a representative signature.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If HTML metadata parsing is used to generate content signatures, then the process is simple and fast, but the signatures become unreliable and inconsistent due to malicious obfuscation techniques
Solution Approach 1:
The patent introduces an intermediary processing layer that includes rendering the HTML message to a visual representation, applying OCR to extract text from the rendered image, and using NLP to clean and normalize the extracted text. This intermediary process bridges the gap between the raw HTML (which may be obfuscated) and the final content signature, ensuring reliability by base signatures on the actual visual content rather than the potentially manipulated HTML source.
Solution Approach 2:
The patent replaces the traditional mechanical approach of parsing HTML metadata with a vision-based system. Instead of using DOM parsers and metadata extraction (mechanical text processing), the system uses optical character recognition on rendered images, substituting the mechanical parsing approach with an optical recognition approach that is immune to HTML obfuscation techniques.
2Difficulty of detecting and measuring
If malicious entities use obfuscation techniques like zero-size fonts and background-color matching text, then the phishing messages become harder to detect, but conventional signature generation fails to produce consistent signatures
Solution Approach 1:
The rendering step acts as a mediator that translates the obfuscated HTML into its visual representation. By converting the HTML message to a rendered image and then applying OCR, the system bypasses the obfuscation layer entirely, extracting text based on what the user actually sees rather than what the HTML source contains. This resolves the inconsistency problem caused by obfuscation techniques.
Solution Approach 2:
The patent creates a visual copy (rendered image) of the HTML message and uses this copy as the basis for signature generation. Instead of working with the original HTML source that may be obfuscated, the system works with a rendered copy that displays the actual visual content, ensuring that the signature reflects the user's perception of the message.
3Difficulty of detecting and measuring
If image-only content and textless URLs are used in phishing attacks, then the obfuscation is enhanced, but HTML parsing cannot extract meaningful text for signature generation
Solution Approach 1:
The patent substitutes the mechanical HTML parsing approach with an optical recognition approach. By rendering the message to an image and applying OCR, the system can extract text from visual elements that HTML parsing would miss, such as images containing text, styled text that renders visibly but is not in the HTML source, and other visual content representations.
Data Source
AI summary
Techniques are described herein that are capable of generating a content signature of a textual communication using OCR and text processing. The textual communication is rendered. Text is extracted from the rendered textual communication using OCR. Customization is removed from the text to provide a templatized version of the rendered textual communication that includes de-customized text. The de-customized text is parsed into tokens. Each token includes a respective subset of a plurality of characters. The tokens are converted into respective numbers. Each number is processed using fuzzy hash functions to provide respective hash values associated with the respective token. Representative hash values are selected for the respective fuzzy hash functions by selecting each representative hash value from the hash values that are processed using the respective fuzzy hash function. A content signature of the textual communication is generated by bitwise concatenating at least portions of the respective representative hash values.