Phishing Webpage Detection Using Brand Mimicry and Domain Mismatch
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional phishing detection systems struggle to identify new, zero-day phishing webpages effectively, requiring constant retraining and significant memory and processing resources without guaranteed improved protection.
Innovation Solution
A reference-based detection method using multiple AI models to analyze textual, HTML, and image data from webpages to identify the brand being mimicked, comparing the domain against a database to determine legitimacy, thereby reducing the need for constant retraining.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional machine learning models are used to classify webpages as phishing or benign, then detection capability is provided, but the system requires constant retraining with new samples to catch up with detection, resulting in extensive use of memory and processing resources
Solution Approach 1:
The patent segments the phishing detection task into multiple specialized machine learning models, each trained to detect specific phishing techniques or patterns. Instead of using a single general-purpose model that requires constant retraining, the system divides the detection workload into specialized components that can operate independently and more efficiently.
Solution Approach 2:
The patent changes the operational parameters of the detection system by using multiple pre-trained models with different specialization parameters rather than one model that must be continuously retrained. This allows the system to maintain high detection reliability without the continuous processing overhead of retraining a single comprehensive model.
2Reliability
If block lists are used to detect phishing webpages, then known phishing sites can be blocked, but new zero-day phishing webpages cannot be detected
Solution Approach 1:
The patent applies preliminary action by pre-training multiple machine learning models on diverse phishing techniques and patterns before deployment. These models are prepared in advance to recognize various phishing methodologies, enabling the system to detect both known and novel phishing attempts without requiring real-time updates for every new threat.
Solution Approach 2:
The system creates multiple copies of detection models, each specialized for different phishing patterns. Rather than relying on a single block list or model, the patent deploys multiple model instances that collectively cover a broader range of phishing techniques, improving both detection accuracy and adaptability to new threats.
3Measurement precision
If multiple machine learning models are used to analyze different data types (text, HTML, images), then brand identification accuracy is improved, but system complexity increases
Solution Approach 1:
The patent segments the analysis of different webpage data types into separate specialized models. Each model focuses on a specific data type (text, HTML, images), which simplifies the training and operation of each individual model while collectively improving brand identification accuracy through their combined results.
Solution Approach 2:
The patent merges the outputs of multiple specialized models into a unified brand identification result. By combining the strengths of different models analyzing different data types, the system achieves high identification accuracy while managing complexity through structured integration of model outputs.
Data Source
AI summary
Disclosed herein are systems and method for reference-based detection of phishing webpages. In one aspect, a method includes inputting, for a webpage with a first domain, (1) textual data into a machine learning model (MLM) that outputs a first vector with probabilities of the textual data being associated with known brands, (2) HTML data into an MLM that outputs a second vector with probabilities of the HTML data being associated with the known brands, (3) at least one image into an MLM that outputs a third vector with probabilities of the at least one image being associated with the known brands. The model may input the first, second, and third vectors into an MLM that outputs a brand of the webpage. The method may block the webpage in response to determining that the first domain of the webpage does not match at least one domain corresponding to the brand.