Phishing Detection via Screenshot Text Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing visual-similarity-based phishing detection methods struggle to effectively identify zero-day phishing attacks, as hackers can evade detection by introducing random content changes within phishing page templates.
Innovation Solution
A machine learning-based approach for web site phishing detection that utilizes keyword recognition and analysis of keyword positioning and formatting from screenshots of web pages, combined with verification through search engine results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If visual-similarity-based detection methods are used to detect phishing pages, then detection effectiveness against template-based phishing is improved, but hackers can easily evade detection by introducing random content changes within templates
Solution Approach 1:
The patent extracts and isolates specific stable elements (keywords, logos, structural components) from the phishing page screenshot. By focusing detection on these extracted stable features rather than the entire visual layout, the system maintains reliability even when hackers modify other parts of the template. The OCR process specifically targets and extracts text content that serves as stable identifiers.
Solution Approach 2:
The patent applies different analysis strategies to different parts of the phishing page. Stable elements like keywords and logos are analyzed for their inherent properties (text content, positioning), while variable elements are either ignored or analyzed differently. This local differentiation allows the system to focus on features that remain constant despite template modifications.
2Measurement precision
If keyword-based detection is used to identify stable indicators, then detection accuracy for zero-day phishing is improved, but the system complexity increases due to multiple analysis layers
Solution Approach 1:
The patent segments the phishing detection process into distinct modular stages: screenshot capture, OCR text extraction, keyword identification, positioning analysis, and final detection. Each module performs a specific function and can be independently optimized or adjusted. This segmentation manages complexity by breaking down the overall complex task into smaller, more manageable components.
Solution Approach 2:
The patent employs a multi-functional detection framework where the same system handles multiple detection tasks: visual similarity comparison, keyword recognition, positioning analysis, and phishing classification. This universal approach consolidates multiple functions into a single integrated system rather than requiring separate systems for each detection method.
3Reliability
If OCR and machine learning processes are applied to analyze text and positioning, then detection capability against sophisticated phishing is improved, but processing time and computational resources increase
Solution Approach 1:
The patent performs preliminary text extraction and keyword identification before the final phishing detection decision. By pre-processing the screenshot to extract and identify key textual elements and their positions upfront, the system prepares data in advance for the machine learning model, reducing the computational burden during the actual detection phase and enabling faster overall processing.
Data Source
AI summary
To check for phishing, text from a screenshot of the web page and a feature vector describing the text are generated and recognized with OCR. If OCR text is on keyword list, it is determined if web page is suspicious for phishing by inputting features of the web page text in a keyword feature model trained from keyword features of known phishing web pages and/or known legitimate web pages. Responsive to a suspicious web page, web search results are generated from the keywords. Responsive to the suspicious web page not appearing within top web search results, the suspicious web page can be flagged as a phishing web page.