Phishing Detection via Webpage Word Content Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting fraudulent webpages, such as phishing sites, are limited by the frequent changes in phishing website locations, making blacklist-based approaches ineffective, and lack efficient semantic content analysis for clone detection.
Innovation Solution
A system comprising a word content phishing filter and a phishing risk manager that computes a word content phishing indicator by comparing the semantic content of a target webpage to reference webpages, determining if the target webpage is a phishing page based on the similarity of its word content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If visual similarity-based methods are used for clone detection, then detection capability is improved, but computational resources and complexity increase
Solution Approach 1:
The patent extracts and analyzes only the critical textual content elements (words, phrases, sentences) from webpages rather than processing the entire visual structure. By isolating and comparing specific semantic components, the system achieves effective phishing detection without the computational burden of full visual similarity analysis.
Solution Approach 2:
The patent creates a simplified textual representation (copy) of the webpage content that captures the essential semantic meaning. This textual copy is then compared between target and reference webpages, providing an efficient alternative to complex visual comparison while maintaining detection accuracy.
2Ease of manufacture
If blacklist-based approaches are used for fraud detection, then implementation simplicity is improved, but effectiveness deteriorates due to frequent phishing location changes
Solution Approach 1:
Instead of checking whether a webpage URL is on a blacklist (static location-based approach), the patent inverts the approach by analyzing the semantic content of the webpage itself. This content-based analysis remains effective even when phishing sites change locations, as the semantic characteristics of fraudulent content remain consistent.
Solution Approach 2:
The patent changes the detection parameter from URL location (which changes frequently) to semantic content characteristics (which remain relatively stable). By analyzing word content, phrases, and textual patterns rather than relying on fixed URL blacklists, the system adapts to location changes while maintaining detection effectiveness.
Data Source
AI summary
In some embodiments, a phishing detection method includes computing a first phishing indicator of a target webpage; when the target webpage is considered suspicious of phishing according to the first phishing indicator, computing a second phishing indicator of the target webpage, and deciding whether the webpage is a phishing site according to the first and second phishing indicators. Computing the second phishing indicator comprises comparing a word content (semantic content) of the target webpage to a word content of each of a plurality of reference webpages. Comparing the word contents may include counting the number of visible words which are common to the target and reference webpages, and/or computing a ratio of a number of words which are common to the target and reference webpages to the total number of words in both the target and reference webpages.