Phishing Detection via Visual Content Image Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for identifying phishing web resources are inefficient due to their reliance on coded data, which can result in false responses and fail to differentiate between phishing pages using similar scripts or icons.
Innovation Solution
The method involves analyzing visual content images of phishing web resources by identifying contours of elements, removing identical contours, and conducting pairwise comparisons with stored clusters to determine similarity values, thereby clustering phishing resources based on visual content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If coded data analysis methods are used to identify phishing web resources, then the detection process is simple, but the accuracy is low and false responses occur frequently
Solution Approach 1:
The patent replaces traditional coded data analysis methods with visual content image analysis. Instead of analyzing HTML, CSS, and JavaScript code structures, the system captures and analyzes visual screenshots of web pages, substituting a mechanical code-parsing approach with an image-processing approach that directly examines the visual presentation of the phishing site.
Solution Approach 2:
The patent creates visual content images (screenshots) as copies of the actual phishing web pages. These visual copies capture the appearance, layout, and graphical elements of the phishing sites, allowing analysis of the visual characteristics without needing to execute or deeply analyze the underlying code, thereby improving detection accuracy while maintaining manageable system complexity.
2Reliability
If visual content analysis is implemented, then false responses are reduced, but the processing time increases
Solution Approach 1:
The patent performs preliminary actions by capturing visual content images of web pages before conducting the actual phishing detection analysis. By pre-processing and storing these visual representations, the system prepares the data in advance, allowing for faster comparison and analysis during the detection phase, thus reducing the overall processing time while maintaining high reliability.
Solution Approach 2:
The patent segments the visual content analysis into distinct components such as identifying logos, analyzing layout structures, examining graphical elements, and comparing visual features. This segmentation allows the system to process different aspects of the visual content in parallel or in a optimized sequence, reducing the total processing time while ensuring comprehensive and reliable phishing detection.
3Adaptability or versatility
If traditional clustering methods are used, then the system is easy to implement, but it cannot differentiate between phishing pages using similar scripts or icons
Solution Approach 1:
The patent applies local quality analysis by examining specific visual elements within the web page images, such as logos, buttons, form fields, and layout patterns. Instead of treating the entire page as a single unit, the system focuses on locally distinctive features that characterize phishing pages, enabling differentiation between sites that use similar scripts or icons but have unique visual presentations.
Solution Approach 2:
The patent transitions from analyzing web pages in the code dimension (HTML, CSS, JavaScript) to the visual dimension (screenshots and image features). This dimensional change allows the system to detect phishing pages based on their visual appearance rather than their code structure, providing a new perspective that effectively differentiates between pages that may share similar coding patterns but have distinct visual characteristics.
Data Source
AI summary
A method and a computing device for clustering phishing web resources based on images of visual content thereof are provided. The method comprises: receiving references to a plurality of phishing web resources; generating, for a given phishing web resource of the plurality of phishing web resources, at least one image of a visual content of the given phishing web resource; analyzing the at least one image associated with the given phishing web resource, the analyzing comprising identifying contours of elements of the visual content of the given phishing web resource within the at least one image; conducting pairwise comparison between the contours associated with the given phishing web resource and contours of stored clusters of visual content images; and storing, in a database, data indicative of an association between the given phishing web resource and a respective cluster of the at least one image.