Phishing Detection via User Input Analysis

The patent introduces an intermediary analysis layer that processes webpage elements between the surface content and the detection engine. Instead of directly analyzing text keywords or images, the system uses an intermediary representation that captures the functional purpose of elements (e.g., identifying that an image serves as a login button or that a form field collects credentials). This intermediary layer maintains detection simplicity while improving effectiveness by translating various phishing techniques into a common analysis framework.

The patent replaces the mechanical text-matching system with a more sophisticated detection mechanism that analyzes webpage structure, element relationships, and functional behavior. Instead of relying on simple keyword presence, the system examines how elements are organized, what data they collect, and how they interact, thereby detecting phishing attempts that use images or flash while maintaining ease of implementation through automated analysis.

The patent extracts only the essential and relevant features from webpages for analysis, rather than processing all content. It identifies and extracts key elements such as form fields, input boxes, credential collection points, and structural patterns that indicate phishing. By taking out only these critical features, the system achieves high detection effectiveness while reducing computational complexity by ignoring irrelevant webpage content.

The patent applies different analysis depths to different parts of the webpage based on their relevance to phishing detection. Critical areas such as login forms, credential input fields, and authentication-related elements receive detailed analysis, while other parts of the page receive minimal or no analysis. This local quality approach ensures high detection effectiveness for phishing indicators while reducing overall computational complexity by focusing resources where they are most needed.