Webpage Spoofing Detection via Multi-Dimensional Feature Fingerprinting

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current Internet security methods are inadequate in detecting webpage spoofing attacks, particularly due to incomplete URL blacklists, whitelists, and advanced spoofing techniques such as markup-reflected content spoofing and domain forwarding, which can evade detection.

Innovation Solution

A method involving a computer system that intercepts inbound emails, extracts and analyzes URL links to access target webpages, captures redirect paths, text, markup, and visual features, generates a fingerprint, and uses a classification model to identify spoofed webpages by comparing these features against a corpus of verified webpages, allocating increasing computational resources until a conclusive classification is made.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If traditional URL blacklist/whitelist methods are used, then detection simplicity is maintained, but detection accuracy deteriorates due to incomplete blacklists and advanced spoofing techniques

Engineering Contradiction:
Improvedetection accuracyVSAvoiddetection method complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent segments the webpage detection process into multiple independent feature extraction components: text features, markup features, visual features, and redirect path features. Each feature type is extracted and analyzed separately, then combined to form a comprehensive fingerprint for classification. This segmentation allows the system to achieve high detection accuracy by examining multiple dimensions of the webpage without requiring a single overly complex detection mechanism.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent transitions from traditional single-dimension URL-based detection to multi-dimensional webpage analysis. By extracting and analyzing text, markup, visual, and redirect path features simultaneously, the system creates a multi-dimensional fingerprint space where spoofed webpages can be distinguished from legitimate ones. This dimensional expansion enables detection of advanced spoofing techniques that evade traditional URL blacklists.

Inventive Principle:
Principle #17Another dimension (Dimensionality change)

2Measurement precision

If comprehensive feature extraction and fingerprinting is implemented, then detection accuracy improves, but computational resource consumption increases

Engineering Contradiction:
Improvedetection accuracyVSAvoidcomputational resource consumption
Core Design Contradiction:
Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The patent performs preliminary feature extraction during the webpage access phase, capturing text, markup, visual, and redirect path features before the classification decision is made. By preparing these features in advance and storing them in a structured fingerprint format, the system reduces the computational burden during the actual classification process. The features are extracted once and reused for comparison against the corpus of known webpages.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent creates simplified copies of webpage features in the form of fingerprints that can be rapidly compared against a corpus of known webpages. Instead of analyzing entire webpages during classification, the system uses compact feature representations (fingerprints) that capture the essential characteristics. This copying approach enables efficient comparison and classification while maintaining high detection accuracy.

Inventive Principle:
Principle #26Copying

3Reliability

If multiple classification phases with increasing computational resources are used, then detection reliability improves, but processing time increases

Engineering Contradiction:
Improvedetection reliabilityVSAvoidprocessing time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The patent implements a dynamic, multi-phase classification process where the system adapts its computational resource allocation based on the confidence level of each classification phase. The process begins with lower-resource text-based classification, then progresses to markup-based classification, and finally to visual feature-based classification if needed. This dynamic approach ensures high detection reliability by using multiple phases while minimizing processing time by stopping early when a conclusive classification is achieved.

Inventive Principle:
Principle #15Dynamics

Data Source

PatentUS12021896B2Method for detecting webpage spoofing attacks
Publication Date: 2024.06.25 ARMORBLOX INC
  • US12021896B2 patent drawing
  • US12021896B2 patent drawing
  • US12021896B2 patent drawing

AI summary

A method for detecting spoofed webpages includes: accessing an email; and scanning the email for links. The method also includes, in response to detecting a link in the email: accessing web content contained in a target webpage at the link; extracting target visual features from the web content; accessing a set of verified webpage templates, each verified webpage template in the set of verified webpage templates containing a set of verified features present in a verified webpage associated with a verified resource locator; identifying a particular verified webpage template, in the set of verified webpage templates, containing a particular set of verified features approximating the target visual features; characterizing a difference between the link and a particular verified resource locator associated with the particular verified webpage template; and, in response to the difference exceeding a threshold difference, flagging the email as malicious.