Overlay Phishing Detection via Schematic Page Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer systems face challenges in effectively detecting and blocking overlay phishing attempts, where malicious applications impersonate legitimate ones by displaying identical pages, leading to potential information theft.
Innovation Solution
A method that uses heuristic approaches to create schematic representations of application pages, compares these representations, and checks authorship to detect overlay phishing attempts, allowing for timely intervention and security actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If heuristic approaches with schematic representations are used to detect overlay phishing, then detection accuracy is improved, but device complexity increases
Solution Approach 1:
The patent creates schematic representations (copies) of application pages that capture structural elements without replicating the entire page content. These simplified copies are then compared to detect phishing attempts, reducing the complexity of direct page comparison while maintaining detection accuracy
Solution Approach 2:
The schematic representation acts as an intermediary between the actual application pages and the comparison process. Instead of directly comparing complex page structures, the system compares simplified schematic versions that retain essential structural characteristics for phishing detection
2Speed
If real-time comparison of application pages is performed, then phishing detection speed is improved, but use of energy increases
Solution Approach 1:
The system extracts only the essential structural elements from application pages to create schematic representations. By taking out only the necessary structural information (layout, element positions, relationships) rather than processing entire pages, the system achieves real-time detection with reduced energy consumption
Solution Approach 2:
The patent transforms the representation parameters of application pages from complete visual content to simplified structural metadata. This parameter change from pixel-level or full-content comparison to structural element comparison reduces computational energy while maintaining detection speed
3Reliability
If author comparison is added to the detection method, then reliability of phishing detection is improved, but device complexity increases
Solution Approach 1:
The patent merges multiple detection mechanisms into a unified system: schematic representation comparison, author information comparison, and timing analysis are combined into a single integrated phishing detection process. This merging improves reliability by using multiple indicators while managing complexity through unified architecture
4Reliability
If multiple detection parameters (schematic match, author match, time threshold) are evaluated, then phishing detection accuracy is improved, but loss of time in processing increases
Solution Approach 1:
The system performs preliminary actions by pre-processing application pages into schematic representations and pre-extracting author information before the actual phishing detection occurs. This preliminary preparation enables faster real-time comparison when phishing attempts are detected, reducing processing time during critical detection moments
Data Source
AI summary
A method to block overlay phishing attempt is described. In one embodiment, the method includes detecting a first application displaying a page of the first application on a display of a computing device, detecting a second application displaying a page of the second application on the display of the computing device, upon detecting the second application displaying the page of the second application, comparing a schematic representation of the page of the first application to a schematic representation of the page of the second application, and determining whether an overlay phishing attempt occurs based at least in part on the comparing.