Identifying and blocking overlay phishing
AssigneeCA, Inc.
InventorDinesh Venkatesan
Life of this patent
Estimating the term…
Abstract
A method to block overlay phishing attempt is described. In one embodiment, the method includes detecting a first application displaying a page of the first application on a display of a computing device, detecting a second application displaying a page of the second application on the display of the computing device, upon detecting the second application displaying the page of the second application, comparing a schematic representation of the page of the first application to a schematic representation of the page of the second application, and determining whether an overlay phishing attempt occurs based at least in part on the comparing.
Claims20
A computer-implemented method to block overlay phishing, at least a portion of the method being performed by a computing device comprising one or more processors, the method comprising:
- detecting, via the computing device, a first application displaying a first page of the first application on a display of the computing device;
- detecting, via the computing device, a second application displaying a second page of the second application on the display of the computing device;
- upon detecting the second application displaying the second page of the second application, comparing, via the computing device, a first schematic representation of the first page of the first application to a second schematic representation of the second page of the second application, the first schematic representation of the first page of the first application being a first wireframe of the first page of the first application and the second schematic representation of the second page of the second application being a second wireframe of the second page of the second application;
- and
- determining, via the computing device, whether an overlay phishing attempt occurs based at least in part on the comparing.
A computer-implemented method to block overlay phishing, at least a portion of the method being performed by a computing device comprising one or more processors the method comprising:
- detecting a first application displaying a first page of the first application on a display of the computing device;
- detecting a second application displaying a second page of the second application on the display of the computing device;
- upon detecting the second application displaying the second page of the second application;
- comparing a first schematic representation of the first page of the first application to a second schematic representation of the second page of the second application, and
- measuring a time between the first application initially displaying the first page of the first application on the display and the second application displaying the second page of the second application over the first page;
- and
- determining whether an overlay phishing attempt occurs based at least in part on:
- the comparing, and
- whether the measured time satisfies a predetermined time threshold.
A computer-implemented method to block overlay phishing, at least a portion of the method being performed by a computing device comprising one or more processors, the method comprising:
- detecting a first application displaying a first page of the first application on a display of the computing device;
- detecting a second application displaying a second page of the second application on the display of the computing device;
- upon detecting the second application displaying the second page of the second application:
- comparing a first schematic representation of the first page of the first application to a second schematic representation of the second page of the second application, and
- determining a sensitivity level associated with the first page of the first application,
- determining whether the sensitivity level satisfies a predetermined threshold;
- and
- determining that an overlay phishing attempt occurred by the second application based at least in part on:
- determining that the first schematic representation of the first page of the first application and the second schematic representation of the second page of the second application match;
- and
- determining that the sensitivity level satisfies the predetermined threshold.
Dependencies are inferred from the claim text.