Phishing Detection via Form Field Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting phishing websites lack the ability to identify zero-day phishing attacks and do not analyze the behavior of unknown web pages, leading to potential missed detections and compromised user data.
Innovation Solution
A method that introduces a control layer to interact with web pages by recording and submitting fake credentials to input forms, comparing the initial and response pages to determine if the site is phishing, and allowing user interaction only if the site is deemed safe.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If blacklisting and whitelisting approaches are used to detect phishing sites, then known phishing sites can be blocked, but zero-day phishing detection capability is lost
Solution Approach 1:
The system performs preliminary actions by automatically submitting test form data to suspicious websites before the user submits their actual sensitive information. This preliminary submission allows the system to detect whether the site is phishing by analyzing the response, thereby preventing zero-day phishing attacks that blacklisting and whitelisting methods cannot detect.
Solution Approach 2:
The invention introduces an intermediary layer between the user and the website that automatically submits test credentials through forms. This intermediary system analyzes the website's response to determine if it is phishing, providing detection capability for unknown phishing sites without relying on pre-existing blacklists or whitelists.
2Measurement precision
If static feature analysis is used to classify unknown pages, then some phishing pages can be detected, but behavior analysis according to user actions is unable
Solution Approach 1:
The system transitions from static feature analysis to dynamic behavior analysis by automatically submitting test form data and analyzing the website's response in real-time. This dynamic approach allows the system to detect phishing sites based on their actual behavior when receiving form submissions, rather than relying solely on static characteristics of the page.
3Reliability
If fake credentials are submitted to test websites, then phishing detection is enhanced, but usability is affected for legitimate sites
Solution Approach 1:
The system creates a copy of the form submission process by automatically submitting test credentials through the website's forms. This copying mechanism allows the system to evaluate the website's response without requiring the user to actually submit their sensitive information, thereby maintaining security while minimizing impact on user experience.
Data Source
AI summary
There is provided a method to detect phishing websites so as to protect users from sending their sensitive information to criminal servers. When browsing a web site having an input form asking sensitive information, the input fields are recorded (i.e. username field and password field). Then false credentials are generated and submitted in background. The new control layer then checks the response page content whether it includes an input form and if there is an input, it checks whether the form has the same fields as the first form. If the responded page does not have a form, or it has a form but includes different fields than the initial page's form, then the original site is identified as phishing.