Phishing Site Detection via Image Segmentation and Visual Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Phishing websites are transient and often resemble legitimate sites, making traditional methods like 'known bad' site lists and pure OCR ineffective for detection.
Innovation Solution
A cyber security appliance with a phishing site detector using a segmentation module to analyze images, create digital signatures for key text-like features, and compare them with trained AI models to identify malicious sites, employing machine learning algorithms like Fully Convolutional Neural Networks to differentiate between legitimate and phishing sites.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional methods like 'known bad' site lists are used, then detection of known phishing sites is achieved, but detection of new and transient phishing sites is ineffective
Solution Approach 1:
The patent segments the website page into multiple image segments and analyzes each segment independently for text-like features. This segmentation approach allows the system to handle transient and new phishing sites by focusing on local visual characteristics rather than relying on global site reputation databases, thereby improving adaptability to new threats while maintaining reliable detection.
2Measurement precision
If direct visual comparison is used, then exact replica detection is achieved, but detection of close replicas resembling legitimate sites is ineffective
Solution Approach 1:
The patent applies local quality analysis by examining specific segments of the page image rather than performing global visual comparison. Each segment is analyzed for text-like features with specific visual characteristics, allowing the system to detect subtle variations and close replicas of legitimate sites while maintaining precision in identifying malicious content.
3Loss of information
If pure OCR approach is used, then text extraction is achieved, but detection of visually similar malicious text is ineffective
Solution Approach 1:
The patent merges multiple analysis approaches by combining segment-based visual analysis with text-like feature detection. Instead of relying solely on pure OCR, the system integrates visual characteristic analysis with text recognition, allowing it to detect malicious text that visually resembles legitimate text while maintaining accurate text extraction for comparison.
Data Source
AI summary
The cyber security appliance can have at least the following components. A phishing site detector that has a segmentation module to break up an image of a page of a site under analysis into multiple segments and then analyze each segment of the image to determine visually whether a key text-like feature exists in that segment. A signature creator creates a digital signature for each segment containing a particular key text-like feature. The digital signature for that segment is indicative of a visual appearance of the particular key text-like feature. Trained AI models compare digital signatures from a set of key text-like features detected in the image of that page under analysis to digital signatures of a set of key text-like features from known bad phishing sites in order to output a likelihood of maliciousness of the unknown site under analysis.