Snapshot Phishing Detection Using OS-Level Context
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing phishing prevention systems fail to provide sufficient context for detecting and mitigating phishing attacks, as they rely solely on application-level data, which is insufficient for identifying the user experience leading to phishing attempts.
Innovation Solution
The technology intercepts user input at the operating system level, captures snapshots of the user interface, and performs a threat assessment using a machine learning model trained on labeled snapshots to classify and mitigate phishing threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If phishing detection is performed at the application level, then the system is simpler to implement, but the detection accuracy and context availability are insufficient
Solution Approach 1:
The patent transitions the detection dimension from application level to operating system level, enabling access to additional context dimensions such as window hierarchy, focus state, and input timing that are unavailable at the application level. This dimensional shift resolves the contradiction by providing richer detection context without requiring complete system reconstruction.
Solution Approach 2:
The patent introduces an intermediary component that operates between the application and the user, capturing input events and window state information at the operating system level. This intermediary layer provides enhanced detection context while maintaining system modularity, allowing improved accuracy without proportionally increasing overall system complexity.
2Measurement precision
If snapshots are captured and analyzed at the operating system level, then the threat detection accuracy improves, but the processing time and computational resources increase
Solution Approach 1:
The patent performs preliminary actions by continuously monitoring and capturing window state information and input events in real-time before phishing attempts occur. This pre-capturing of contextual data enables rapid threat assessment when credential input is detected, reducing processing time while maintaining high accuracy through pre-available context.
Solution Approach 2:
The patent extracts only the essential snapshot features relevant to phishing detection (such as window focus state, active application, and input timing) rather than processing complete screen captures. This selective extraction maintains high detection accuracy while significantly reducing computational overhead and processing time.
3Reliability
If more context information is collected for threat assessment, then the phishing detection capability improves, but the data privacy and user security risks increase
Solution Approach 1:
The patent applies local quality by collecting detailed context information only in the specific local context where credential input is detected, rather than continuously monitoring all system activities. This targeted approach improves phishing detection reliability while minimizing unnecessary data collection and associated privacy risks.
Solution Approach 2:
The patent implements preliminary anti-action by designing the snapshot capture mechanism to collect only the minimum necessary information for threat assessment, and by implementing local processing that prevents unnecessary transmission of sensitive data. This preemptive approach to data minimization reduces privacy risks while maintaining effective phishing detection capability.
Data Source
AI summary
Embodiments of the technology described herein identify and mitigate phishing attempts by analyzing user input received at the operating system level. Initially, a credential, such as a username or password, is registered with the threat detection system. The technology described herein intercepts user input at the operating system level, generates a hash of the input, and compares it with a hash of a credential being monitored. The technology described herein will perform a threat assessment when a secret entry is detected. The threat assessment may use the application context and the network context as inputs to the assessment. When the threat assessment results in an unknown classification or when the snapshot is otherwise requested, a snapshot is captured to supplement the threat assessment. Based on user settings, the snapshot is consumed by a snapshot phishing machine learning model. Various mitigation actions may be taken when a threat is detected.