Website Phishing Brand Detection Through Screenshot Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional methods for detecting phishing campaigns are ineffective if the targeted brand is not present in the dataset, allowing potential phishing URLs associated with unknown brands to go undetected.
Innovation Solution
Capture website screenshots using a capture module, transform them into image representations using a deep learning model, cluster screenshots with visual similarities, and perform security actions to identify and add brand information to a dataset for phishing protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional multi-feed processing and dataset comparison methods are used for phishing detection, then detection accuracy for known brands is improved, but detection capability for unknown brands deteriorates
Solution Approach 1:
The system automatically captures screenshots of phishing URLs, transforms them into image representations, clusters similar images, and extracts brand information without human intervention. This self-service mechanism enables continuous automatic expansion of the brand dataset, improving both detection accuracy and adaptability to unknown brands simultaneously
Solution Approach 2:
The system implements a feedback loop where detected phishing URLs are processed to extract new brand information, which is then added to the dataset for future detection. This closed-loop feedback mechanism continuously improves detection capability for previously unknown brands while maintaining high accuracy for known brands
2Reliability
If a fixed dataset of known brands is used for comparison, then detection reliability for established brands is improved, but detection coverage for emerging brands deteriorates
Solution Approach 1:
The brand dataset transitions from a static fixed collection to a dynamic structure that automatically grows through clustering and extraction of new brands from phishing URLs. This dynamic update mechanism maintains reliable detection of known brands while continuously expanding coverage to emerging brands
Solution Approach 2:
The system performs preliminary clustering and brand extraction on captured phishing screenshots before adding them to the dataset. This preliminary processing ensures that new brands are identified and prepared in advance, enabling immediate detection coverage expansion without compromising existing detection reliability
Data Source
AI summary
A computer-implemented method for identifying brands utilized in website phishing campaigns may include (i) capturing a website screenshot including visual elements representing a potential phishing vulnerability, (ii) transforming, utilizing a deep learning model, the website screenshot into an image representation including embeddings, (iii) determining whether the transformed website screenshot matches a dataset including reference transformed website screenshots representing previously identified brands utilized in phishing campaigns, (iv) clustering, upon determining a mismatch between the transformed website screenshot and the dataset, the transformed website screenshot with other transformed website screenshots sharing the visual elements representing the potential phishing vulnerability and one or more visual similarities, and (v) performing, based on the clustering, a security action that protects against potential phishing attacks by extracting brand information for adding to the dataset. Various other methods, systems, and computer-readable media are also disclosed.