Phishing Detection via Visual Keypoint Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current phishing detection systems relying on textual search and analysis are inadequate due to insufficient text data, inability to process text within images, and language limitations, leading to inefficient and unreliable detection of phishing attacks.
Innovation Solution
A phishing detection and analysis system (PDAS) utilizing computer vision techniques to analyze the graphic representation of webpages, generating a machine learning model based on keypoints and feature vectors to determine if a webpage mimics a legitimate one, thereby identifying potential phishing attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If textual search-based analysis is used to detect phishing attacks, then the system can process webpages with sufficient text data, but it fails when the website contains insufficient text or text within images
Solution Approach 1:
The patent replaces the mechanical textual search-based analysis system with a computer vision-based system. Instead of using text processing algorithms to analyze webpage content, the system uses image processing techniques to capture and analyze screenshots of webpages. This substitution enables the system to detect phishing attacks on webpages with insufficient text or text embedded in images, as computer vision can process visual information directly without requiring extractable text.
2Loss of information
If textual search-based solutions are used, then the system can analyze webpage content, but it cannot perform analysis when text is contained within images
Solution Approach 1:
The patent substitutes text extraction and analysis with computer vision-based image analysis. Instead of attempting to extract text from images using OCR or text processing methods, the system captures screenshots and analyzes them as images directly. This approach eliminates the difficulty of text extraction from images by treating the entire webpage visual representation as the object of analysis, preserving all visual information including text within images without requiring text extraction.
3Reliability
If textual search-based analysis is used, then the system can process webpages with sufficient corpus data, but it lacks effectiveness in many languages due to insufficient data
Solution Approach 1:
The patent replaces language-dependent textual search and analysis with language-independent computer vision analysis. By capturing webpages as screenshots and analyzing visual features such as layout, color schemes, logos, and image arrangements, the system can detect phishing attacks across multiple languages without requiring language-specific corpora or text processing capabilities. This visual analysis approach is universally applicable to any language while maintaining detection accuracy.
4Adaptability or versatility
If computer vision techniques are used to analyze webpage graphics, then the system can detect phishing attacks on webpages with limited text or in various languages, but the device complexity increases
Solution Approach 1:
The patent extracts only the essential visual features from webpage screenshots for analysis, rather than processing the entire image data. By identifying and extracting key visual characteristics such as layout patterns, color schemes, logo positions, and structural elements, the system reduces the complexity of analysis while maintaining the ability to detect phishing attacks across diverse webpage formats. This extraction approach simplifies the computational burden compared to analyzing complete high-resolution images.
Data Source
AI summary
A computerized method for analyzing a subject URL to determine whether the subject URL is associated with a phishing attack is disclosed. The method includes steps of detecting keypoints within a screenshot of a webpage corresponding to the subject URL and determining a set of confidences based on an analysis of the detected keypoints with a model. Each confidence within the set of confidences is assigned to feature vector within a set of training feature vectors representing a training set of URLs used in generating the model. The method comprises performing an image comparison between the screenshot and a screenshot corresponding to a feature vector within the set of training feature vectors, the feature vector being assigned a highest confidence. Responsive to determining the image comparison result exceeds a predefined threshold, transmitting an alert indicating that the subject URL is associated with the phishing attack.