Phishing Detection via Login Screen Latent Representations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methodologies for phishing webpages are ineffective against design-arounds where cyber-attackers make minor alterations to login screen components, evading detection based on hash comparisons.
Innovation Solution
A method utilizing an encoder to generate a latent representation of a candidate phishing webpage's login screen component, followed by classification with a machine learning model and correlation with allow/deny lists to determine phishing status.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional hash comparison methods are used for phishing detection, then the detection process is simple and fast, but it becomes ineffective against phishing webpages with minor alterations to login screen components
Solution Approach 1:
The patent transforms the login screen from image pixel data into color histogram parameters, creating a new feature representation that is more resilient to minor visual alterations. By comparing color distribution statistics rather than raw pixels, the system maintains high detection effectiveness while reducing sensitivity to design-arounds
Solution Approach 2:
The patent replaces the mechanical hash comparison approach with a statistical color histogram analysis system. This substitution enables the detection method to capture semantic similarities in login screens while ignoring minor cosmetic changes, thereby resolving the contradiction between simplicity and effectiveness
2Measurement precision
If hash comparison is used for login screen verification, then the implementation is straightforward, but it fails to detect phishing attempts with altered designs
Solution Approach 1:
The system changes the measurement parameters from exact pixel hash values to color histogram distributions. This parameter transformation maintains implementation straightforwardness while dramatically improving detection accuracy, as color histograms capture the essential visual characteristics of login screens without being sensitive to minor alterations
Solution Approach 2:
The patent creates a color histogram copy or representation of the legitimate login screen and uses this for comparison. This copied representation serves as a robust reference that can detect phishing attempts while maintaining ease of implementation through straightforward histogram comparison algorithms
Data Source
AI summary
One implementation is directed to a phishing detection methodology including operations of obtaining an image of a candidate phishing webpage having a login screen component, where encoder is deployed on the image resulting in the generation of a latent representation corresponding to the login screen component. The login screen component may then be classified as one of a defined set of classes by deploying a machine learning model taking the latent representation as input. Further, an additional operation may include obtaining allow/deny lists of account authentication providers for the domain of the URL of the candidate phishing webpage. Finally, a determination may be made as to whether the candidate phishing webpage is a phishing webpage when the login class assigned by the classifying machine learning model does not appear on the allow list.