Phishing Detection via Web Page Snapshot Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing phishing detection methods rely heavily on blacklists, which are ineffective in identifying new or variant phishing web pages, as hackers can easily use different addresses for phishing attacks, making it difficult to filter out such pages precisely.
Innovation Solution
A method that compares the snapshot of a target web page with pre-stored snapshots and addresses to determine if it is a phishing page, using a network apparatus with a database to match the snapshot and address, and generates a notice or blocks the page if a mismatch is found.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If blacklist-based detection methods are used, then known phishing addresses can be identified, but new or variant phishing web pages using different addresses cannot be detected
Solution Approach 1:
The system pre-stores snapshots of legitimate web pages in a database before phishing attempts occur. When a web page is requested, the system compares it against these pre-stored snapshots to detect phishing, enabling detection of new phishing variants without relying on pre-existing blacklists of specific phishing URLs.
Solution Approach 2:
The system creates and stores copies (snapshots) of legitimate web page content in a database. These snapshots serve as reference templates for comparison, allowing the system to identify phishing pages by detecting deviations from the stored legitimate content, regardless of the URL used.
2Reliability
If snapshot comparison with address verification is implemented, then phishing pages using different addresses can be identified, but system complexity increases
Solution Approach 1:
The snapshot comparison mechanism serves multiple functions: it detects phishing pages, verifies address authenticity, and provides a universal method for identifying fraudulent sites regardless of their URL. This multi-functionality reduces the need for separate detection systems for different phishing techniques.
Solution Approach 2:
The web page snapshot acts as an intermediary between the URL and the content verification process. Instead of directly comparing URLs or analyzing complex page structures, the system uses snapshots as a mediator to simplify the detection process while maintaining high accuracy.
Data Source
AI summary
A phishing detecting method includes: a web-page accessing request for accessing a target web page at a target address is received; the target web page from the target address is obtained; the target web page is snapshotted to obtain a present page snapshot; the present page snapshot is compared with several pre-stored page snapshots stored in a database, wherein each of the pre-stored page snapshots corresponds to a pre-stored address; if the present page snapshot matches one of the pre-stored page snapshots, the target address is compared with the pre-stored address, corresponding pre-stored page snapshot of which matches the present page snapshot; if the target address does not match the pre-stored address, the corresponding pre-stored page snapshot of which matches the present page snapshot, it is determined that the target web page is a phishing web page.