Phishing Detection via Screenshot Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Phishing attacks have become prevalent, making it difficult for users and trusted website entities to detect suspicious URLs, leading to potential data breaches and brand tarnishment, as attackers can pose as legitimate institutions and create phishing webpages that appear similar to genuine sites.
Innovation Solution
A method involving a bot that compares the content of suspicious URLs with legitimate domain landing pages by downloading, rendering, and analyzing screenshots using algorithms for keypoint extraction, color histogram comparison, and HTML DOM structure analysis to generate a score indicating the likelihood of a phishing attack.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If phishing webpages are made to appear similar to legitimate sites, then the欺骗性 (deceptiveness) increases, but the detectability decreases
Solution Approach 1:
The system performs preliminary actions by proactively downloading, rendering, and screenshotting suspicious URLs before users access them. By capturing the phishing webpage in advance and comparing it with the legitimate site, the system detects phishing attacks before they can deceive users, thus maintaining high deceptiveness while improving detectability through preemptive analysis
Solution Approach 2:
The system introduces an intermediary comparison mechanism that places the suspicious URL screenshot alongside the legitimate site screenshot. This intermediary visual comparison allows the system to detect subtle differences between phishing and legitimate pages, enabling detection even when the phishing site closely mimics the original
2Measurement precision
If visual comparison methods are used to detect phishing, then the accuracy of detection improves, but the complexity of the system increases
Solution Approach 1:
The system creates visual copies (screenshots) of both the suspicious URL and the legitimate site. By working with these copied visual representations rather than analyzing the actual webpage code or structure, the system achieves high detection accuracy through visual pattern recognition while keeping the implementation relatively simple and accessible
Solution Approach 2:
The system replaces complex code-based analysis mechanisms with visual screenshot comparison. Instead of parsing HTML, analyzing DOM structures, or examining JavaScript code, the system uses visual rendering and image comparison techniques, substituting mechanical code analysis with optical pattern recognition that is both accurate and computationally efficient
Data Source
AI summary
A method, computer system, and a computer program product for identifying a phishing attack is provided. The present invention may include receiving an alert of a suspicious URL. The present invention may include making an HTTP request to the suspicious URL. The present invention may include downloading and rendering the suspicious URL content. The present invention may include producing a screenshot of the rendered suspicious URL content. The present invention may include making an HTTP request to a domain landing page. The present invention may include downloading and rendering the domain landing page URL content. The present invention may include producing a screenshot of the rendered domain landing page URL content. The present invention may include generating a score based on comparing the produced first screenshot and the produced second screenshot.