Phishing Detection via Visual-Text Rendering Mismatch
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting phishing attacks are inadequate, as they rely on coarse domain name information and are vulnerable to domain name similarities and DNS poisoning attacks, leading to false alarms and failure in identifying impersonated websites.
Innovation Solution
A method that compares the graphical and text versions of a candidate destination with a stored destination, generating a fraud warning if the graphical rendering is similar but the text version differs, using a database of protected destinations and visual cues to identify potential phishing sites.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If browser tool bars extract and normalize URL to present effective site, then attacks with URL overfilling browser location window are eliminated, but attacks using two very similar-looking domain names are not detected
Solution Approach 1:
The patent transitions from one-dimensional text-based URL comparison to two-dimensional visual rendering comparison. By capturing and comparing the visual rendering of URLs alongside text version, the system can detect phishing sites that use visually similar domain names, adding a graphical dimension to the detection process that overcomes the limitations of text-only analysis.
Solution Approach 2:
The patent introduces visual rendering as an intermediary layer between the raw URL and the user perception. Instead of directly comparing text URLs which can be easily spoofed, the system renders both the candidate and stored URLs visually and compares these renderings, using the visual representation as a mediator to identify subtle phishing attempts that text comparison would miss.
2Ease of operation
If DNS resolution is used to resolve destination host, then web page access is enabled, but DNS poisoning attacks redirect users to subverted IP addresses
Solution Approach 1:
The patent performs preliminary visual rendering and comparison of the URL destination before the user interacts with the web page. By capturing the visual rendering of the candidate destination and comparing it with stored legitimate destinations before allowing access, the system can detect DNS poisoning attacks in advance, preventing users from being redirected to malicious sites while maintaining normal browsing functionality.
3Reliability
If graphical rendering comparison is used to detect visual similarities, then phishing sites with similar domain names are detected, but false alarms may occur for legitimate sites in different countries
Solution Approach 1:
The patent employs multiple comparison parameters beyond just visual rendering, including text version matching, domain name analysis, and organizational information verification. By changing and combining multiple detection parameters, the system can distinguish between legitimate variations (such as international sites with different country codes) and actual phishing attempts, reducing false alarms while maintaining high detection accuracy.
Data Source
AI summary
Techniques are provided for detecting computer fraud. The techniques include obtaining a text version of a candidate destination and a graphical rendering of the candidate destination, comparing the text version of the candidate destination and the graphical rendering of the candidate destination with a corresponding text version of a stored destination and a corresponding graphical rendering of the stored destination, and generating a fraud warning if the graphical rendering of the candidate destination is substantially similar to the graphical rendering of the stored destination while the text version of the candidate destination differs substantially from the corresponding text version of the stored destination.