Phishing URL Detection via AI Web Page Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional techniques for detecting phishing sites are inadequate due to inconsistent victim responses and increasingly sophisticated phishing message compositions, leading to insufficient detection and notification.
Innovation Solution
A method and apparatus using an artificial intelligence algorithm to detect URLs related to phishing sites by preprocessing URLs, confirming their presence in databases of known phishing and non-phishing sites, accessing and analyzing web page content, and utilizing similarity databases and AI models to identify phishing sites.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional techniques recognize specific words in phishing messages to detect phishing sites, then the detection process is simple, but the detection accuracy is insufficient due to sophisticated message composition
Solution Approach 1:
The patent segments the URL into multiple components (domain name, path, query parameters, etc.) and analyzes each component separately using different features. This segmentation allows the system to examine specific suspicious elements without being overwhelmed by the entire URL structure, improving detection accuracy while maintaining manageable complexity.
Solution Approach 2:
The patent transitions from analyzing only textual content to incorporating visual elements by capturing and analyzing screenshots of web pages. This adds a visual dimension to the detection process, enabling the system to identify phishing sites through visual characteristics such as logo placement, layout patterns, and image authenticity, thereby improving detection accuracy beyond what text-based methods can achieve.
2Measurement precision
If the system analyzes web page content to improve phishing detection, then detection accuracy improves, but processing time and computational resources increase
Solution Approach 1:
The patent performs preliminary actions by pre-processing URLs (extracting domain names, paths, and parameters) before actual analysis. It also pre-captures screenshots and pre-extracts visual features. These preliminary steps organize data in advance, making the subsequent analysis more efficient and reducing the time required during actual phishing detection operations.
Solution Approach 2:
The patent extracts only the essential and suspicious features from web pages rather than analyzing entire page contents. It specifically extracts domain names, paths, query parameters, and key visual elements, discarding redundant information. This selective extraction significantly reduces processing time and computational resources while maintaining high detection accuracy.
3Reliability
If the system uses multiple types of data from web pages for analysis, then detection reliability improves, but the complexity of data processing increases
Solution Approach 1:
The patent merges multiple types of data (textual features from URL components, visual features from screenshots, and structural features from web page layout) into a unified analysis framework. By combining these diverse data types, the system achieves more reliable phishing detection through multi-faceted verification, while the integrated approach manages complexity through systematic data fusion rather than separate processing streams.
Data Source
AI summary
A method for detecting a URL related to a phishing site includes: acquiring a target URL related to a first URL included in a text message; confirming whether the target URL is included in at least one among a first DB and a second DB; accessing the target URL and capturing a first web page screen, based on that the target URL is confirmed not to be included in at least one among the first DB and the second DB; and storing information related to the target URL in a result DB through the first web page screen, and acquiring information related to the target URL by inputting a plurality of types of data into a first artificial intelligence model, and storing the information related to the target URL in the result DB, based on that whether the target URL is related to a phishing site is not identified on the basis of the plurality of types of data.