Phishing Attack Detection Through Visual Page Element Similarity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Phishing attacks are challenging to detect with high accuracy, particularly when adversaries create imitation webpages that closely resemble legitimate sites, leading to financial and mental damages, and existing countermeasures like user training and out-of-band authentication are insufficient.
Innovation Solution
An agent analyzes target pages by comparing them to stored representations of legitimate pages, using visual similarity measurements and domain name checks to identify phishing attempts, and performs responsive actions to prevent user interaction with fraudulent sites.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If visual similarity measurement is used to detect phishing attacks, then detection accuracy is improved, but false positives increase when pages have slight visual differences or translations
Solution Approach 1:
The patent segments the webpage into multiple visual elements (layout, colors, images, text blocks) and compares each element separately. This allows the system to identify that while individual elements may differ slightly (causing false positives), the overall structure and arrangement remain consistent with legitimate pages, thereby maintaining detection accuracy while reducing false positives.
Solution Approach 2:
The patent transforms the visual elements of the webpage into standardized parameters (color codes, dimensional measurements, positional coordinates) that can be objectively compared. By establishing tolerance ranges for these parameters, the system can accommodate slight visual differences and translations without triggering false positives, while still detecting genuine phishing attacks that exceed these tolerances.
2Reliability
If comprehensive visual analysis is performed on all webpages, then phishing detection capability is improved, but processing time and computational resources increase
Solution Approach 1:
The patent performs preliminary analysis by first comparing high-level structural features of the webpage (overall layout, main sections, navigation elements) before conducting detailed element-by-element comparison. This preliminary structural assessment allows the system to quickly identify obvious phishing attempts or rule out safe pages, thereby reducing the need for comprehensive analysis in many cases and decreasing processing time.
Solution Approach 2:
The patent implements a tiered analysis approach where only necessary visual elements are analyzed in detail based on the preliminary assessment. If the structural comparison already indicates a phishing attack, full analysis is not performed. Conversely, if the page structure matches legitimate pages, only critical elements are analyzed in detail, rather than performing exhaustive analysis on all elements, thus optimizing processing time while maintaining detection capability.
Data Source
AI summary
An apparatus, system, product and method comprising: obtaining a selection of page elements of a source page that are estimated to represent a visual appearance of the source page; generating respective representations of the page elements, wherein the representation is configured to be used for acquiring a page element in different pages; obtaining a target page, wherein a user is enabled to interact with the target page; determining a visual similarity measurement between the source page and the target page, wherein the visual similarity measurement is based on a successful acquisition in the target page, of the page elements, using the respective representations; classifying the target page as a phishing attack based on the visual similarity measurement, whereby detecting the phishing attack; and performing a responsive action in response to said detecting the phishing attack.