Phishing Detection via Code Segment Fuzzy Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cybersecurity systems face challenges in accurately identifying phishing websites, with whitelists and blacklists being inconclusive and computer vision techniques limited by time constraints, leading to increased false negatives and false positives.
Innovation Solution
A phishing detection system that analyzes code segments from suspect URLs, parses links, recovers additional code segments, performs statistical and heuristic analyses, and uses fuzzy hashing to compare with known phishing web pages, generating alerts when correlation thresholds are met.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If computer vision-based techniques are used to analyze display elements of web pages, then phishing detection capability is improved, but time constraints limit the number of displayable elements that can be analyzed per web page, reducing thoroughness
Solution Approach 1:
The patent segments the web page analysis into two distinct phases: (1) code segment retrieval and parsing to extract structural information, and (2) computer vision-based analysis of display elements. This segmentation allows the system to perform thorough analysis by separating the time-consuming code parsing from the visual analysis, enabling comprehensive examination without excessive time constraints on the overall process.
Solution Approach 2:
The system performs preliminary actions by retrieving and parsing code segments before conducting computer vision analysis. By pre-processing the web page code to extract structural information, links, and display elements in advance, the system prepares data that can be efficiently analyzed in the subsequent vision-based detection phase, reducing the time pressure during the actual phishing detection.
2Productivity
If whitelist and blacklist analyses are used to protect users, then some phishing attempts are blocked, but the analyses do not provide a robust overall analysis, leading to increased false negatives and false positives
Solution Approach 1:
The patent merges multiple detection approaches into a unified system that combines whitelist/blacklist URL analysis with computer vision-based display element analysis and code segment parsing. This combination allows the system to leverage the speed of whitelist/blacklist filtering while adding layers of verification through visual and structural analysis, thereby reducing false positives and false negatives and providing robust overall detection.
Solution Approach 2:
The system implements feedback mechanisms where the results from code segment parsing and computer vision analysis feed back into the overall detection decision. The parsed code structures and visual element comparisons provide feedback that validates or refutes initial whitelist/blacklist classifications, enabling the system to correct false positives and false negatives through multi-layered verification.
Data Source
AI summary
A system and method for detecting phishing cyberattacks. The method involves parsing a code segment retrieved using a suspect uniform resource locator (URL) to identify any links included in the code segment. From these links, additional code segments may be recovered in accordance with a code segment recovery scheme. Thereafter, analytics are performed on the retrieved and possibly recovered code segments. The analytics include determining whether any of the code segments is correlated with a code segment associated with a known prior phishing cyberattack. Upon completing the analytics, an alert message including meta-information associated with results from the analytics is generated to identify that the URL is associated with a known prior phishing cyberattack when one or perhaps a combination of code segments associated with the URL are correlated to any code segment associated with a known prior phishing cyberattack.