Phishing Detection via Rendered Logo Analysis and Source Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing phishing detection methods struggle to accurately identify phishing attacks due to hackers obfuscating webpage or email codes, and visual similarities with legitimate sites, leading to false negatives.
Innovation Solution
A method using a convolutional neural network-based object classifier to analyze the source code and rendering of webpages or emails, identifying main logos and comparing them against authorized and unauthorized lists to determine phishing threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If visual similarity and logo recognition methods are used for phishing detection, then detection speed is maintained, but detection accuracy deteriorates when hackers obfuscate webpage or email codes
Solution Approach 1:
The patent transitions from analyzing only visual appearance (2D image space) to incorporating source code analysis (adding a textual/dimensional layer). By rendering the webpage and simultaneously analyzing its HTML source code, the system creates a multi-dimensional detection approach that remains effective even when visual elements are obfuscated through code manipulation.
Solution Approach 2:
The patent introduces an intermediary verification process that connects the visual rendering with its source code representation. By comparing elements in the rendered image against their corresponding source code definitions, the system creates a verification layer that detects discrepancies between what is displayed and what the code actually contains, revealing phishing attempts that mimic legitimate visual appearance.
2Measurement precision
If comprehensive analysis of webpage source code is performed, then detection accuracy improves, but computational complexity increases
Solution Approach 1:
The patent extracts and analyzes only the critical elements from the webpage source code that are relevant to phishing detection, rather than performing comprehensive analysis of all code. By focusing on specific high-value indicators (such as logo source attribution, domain mismatches, and structural anomalies), the system achieves high detection accuracy while minimizing computational overhead.
Solution Approach 2:
The patent applies partial analysis to the source code by rendering the webpage and selectively examining key elements in the rendered output that correspond to potential phishing indicators. This partial action approach processes only the necessary portions of the code and visual elements required for detection, avoiding the excessive computational burden of analyzing every aspect of the webpage.
3Reliability
If logo recognition is used to verify authenticity, then false positives are reduced, but false negatives increase when logos are absent or replaced
Solution Approach 1:
The patent implements a universal detection framework that performs multiple verification functions simultaneously: logo recognition, source code analysis, and structural anomaly detection. This multi-functional approach ensures that the system can verify authenticity through various means, so if one method (like logo recognition) fails due to absent or replaced logos, other methods can compensate to maintain both reliability and detection coverage.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Described herein is a method for detecting phishing attacks. The method receives (1100) the source code of a webpage or an e-mail and data of the source. Next, the method determines (1002) if the data of the source are comprised in a list and, if yes, classifies the webpage or the e-mail as safe. Otherwise, the method generates (1006) an image that corresponds to a rendering of the source code and determines (1008) via an object classifier (1200) a list of objects in the image. In particular, the classifier (1304) is configured for identifying a plurality of object classes, where the classifier is trained to detect a plurality of reference logos, where each object class corresponds to a respective reference logo. Next, the method analyses (1206, 1306) whether the image comprises a main reference logo. If yes, the method classifies (1016) the webpage or the e-mail as phishing attack.