Webpage Spoofing Detection via Multi-Dimensional Feature Fingerprinting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Internet security methods are inadequate in detecting webpage spoofing attacks, particularly due to incomplete URL blacklists, whitelists, and advanced spoofing techniques such as markup-reflected content spoofing and domain forwarding, which can evade detection.
Innovation Solution
A method involving a computer system that intercepts inbound emails, extracts and analyzes URL links to access target webpages, captures redirect paths, text, markup, and visual features, generates a fingerprint, and uses a classification model to identify spoofed webpages by comparing these features against a corpus of verified webpages, allocating increasing computational resources until a conclusive classification is made.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional URL blacklist/whitelist methods are used, then detection simplicity is maintained, but detection accuracy deteriorates due to incomplete blacklists and advanced spoofing techniques
Solution Approach 1:
The patent segments the webpage detection process into multiple independent feature extraction components: text features, markup features, visual features, and redirect path features. Each feature type is extracted and analyzed separately, then combined to form a comprehensive fingerprint for classification. This segmentation allows the system to achieve high detection accuracy by examining multiple dimensions of the webpage without requiring a single overly complex detection mechanism.
Solution Approach 2:
The patent transitions from traditional single-dimension URL-based detection to multi-dimensional webpage analysis. By extracting and analyzing text, markup, visual, and redirect path features simultaneously, the system creates a multi-dimensional fingerprint space where spoofed webpages can be distinguished from legitimate ones. This dimensional expansion enables detection of advanced spoofing techniques that evade traditional URL blacklists.
2Measurement precision
If comprehensive feature extraction and fingerprinting is implemented, then detection accuracy improves, but computational resource consumption increases
Solution Approach 1:
The patent performs preliminary feature extraction during the webpage access phase, capturing text, markup, visual, and redirect path features before the classification decision is made. By preparing these features in advance and storing them in a structured fingerprint format, the system reduces the computational burden during the actual classification process. The features are extracted once and reused for comparison against the corpus of known webpages.
Solution Approach 2:
The patent creates simplified copies of webpage features in the form of fingerprints that can be rapidly compared against a corpus of known webpages. Instead of analyzing entire webpages during classification, the system uses compact feature representations (fingerprints) that capture the essential characteristics. This copying approach enables efficient comparison and classification while maintaining high detection accuracy.
3Reliability
If multiple classification phases with increasing computational resources are used, then detection reliability improves, but processing time increases
Solution Approach 1:
The patent implements a dynamic, multi-phase classification process where the system adapts its computational resource allocation based on the confidence level of each classification phase. The process begins with lower-resource text-based classification, then progresses to markup-based classification, and finally to visual feature-based classification if needed. This dynamic approach ensures high detection reliability by using multiple phases while minimizing processing time by stopping early when a conclusive classification is achieved.
Data Source
AI summary
A method for detecting spoofed webpages includes: accessing an email; and scanning the email for links. The method also includes, in response to detecting a link in the email: accessing web content contained in a target webpage at the link; extracting target visual features from the web content; accessing a set of verified webpage templates, each verified webpage template in the set of verified webpage templates containing a set of verified features present in a verified webpage associated with a verified resource locator; identifying a particular verified webpage template, in the set of verified webpage templates, containing a particular set of verified features approximating the target visual features; characterizing a difference between the link and a particular verified resource locator associated with the particular verified webpage template; and, in response to the difference exceeding a threshold difference, flagging the email as malicious.


