Phishing Detection via Visual Brand Logo Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Phishing attacks, particularly those initiated by deceptive emails and URLs, pose a significant threat as they are the source of over 90% of cyber-security breaches, and existing technologies struggle to effectively detect and prevent such threats across various communication platforms.
Innovation Solution
The system employs a processor and memory with computer code instructions to detect phishing events by using an object detection convolutional neural network (CNN) to identify brand logos, compare domains, and perform visual fingerprinting, alerting users when unauthorized domains or phishing attempts are detected, and preventing password submission to unauthorized sources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional phishing detection methods are used, then the system is simpler to implement, but the detection precision and reliability are insufficient to effectively identify deceptive communications
Solution Approach 1:
The patent introduces an image rendering intermediary that captures visual content of communications as images, enabling advanced analysis. This intermediary layer transforms text-based communications into visual representations that can be analyzed by deep learning models, significantly improving detection precision while managing complexity through modular architecture
Solution Approach 2:
The patent replaces traditional rule-based and keyword-based detection mechanisms with deep learning-based image analysis. By substituting mechanical detection systems with neural network-based visual analysis, the system achieves superior detection precision for phishing attempts that mimic legitimate communications
2Reliability
If the system analyzes all communication content in real-time, then detection reliability improves, but processing speed and productivity decrease
Solution Approach 1:
The patent extracts only the critical visual elements (logos, branding elements) from communications for analysis using object detection CNNs. By extracting and analyzing only the most relevant visual features rather than processing entire communication contents, the system maintains high detection reliability while significantly improving processing speed
Solution Approach 2:
The system performs preliminary image rendering and pre-processing of visual content before main analysis. By preparing visual representations in advance and using object detection to identify key elements beforehand, the system enables faster real-time detection without compromising reliability
3Reliability
If the system uses multiple detection agents across different hardware platforms, then detection coverage and reliability improve, but device complexity increases
Solution Approach 1:
The patent implements a universal image-based detection framework that can operate across multiple hardware platforms (mobile devices, desktops, servers). By using a common image rendering and analysis approach that adapts to different platforms, the system achieves broad detection coverage while managing complexity through a unified architecture
Solution Approach 2:
The system segments detection functionality into separate agents that can operate independently on different hardware platforms. Each agent handles specific detection tasks locally, and results are aggregated for comprehensive analysis. This segmentation enables distributed detection coverage while maintaining manageable complexity through modular design
Data Source
AI summary
A method of detecting a phishing event comprises acquiring an image of visual content rendered in association with a source, and determining that the visual content includes a password prompt. The method comprises performing an object detection, using an object detection convolutional network, on a brand logo in the visual content, to detect one or more targeted brands. Spatial analysis of the visual content may be performed to identify one or more solicitations of personally identifiable information. The method further comprises determining, based on the object detection and the spatial analysis, that at least a portion of the visual content resembles content of a candidate brand, and comparing the domain of the source with one or more authorized domains of the candidate brand. A phishing event is declared when the comparing indicates that the domain of the source is not one of the authorized domains of the candidate brand.