US 11,637,863 B2 · Detection of user interface imitation

Abstract

Techniques are disclosed relating to generating trained machine learning modules to identify whether user interfaces accessed by a computing device match user interfaces associated with a set of Internet domain names. A server computer system receives a set of Internet domain names and generates screenshots for user interfaces associated with the set of Internet domain names. The server computer system then trains machine learning modules that are customized for the set of Internet domain names using the screenshots. The server then transmits the machine learning modules to the computing device, where the machine learning modules are usable by an application executing on the computing device to identify whether a user interface accessed by the device matches a user interface associated with the set of Internet domain names. Such techniques may advantageously allow servers to identify whether user interfaces are suspicious without introducing latency and increased page load times.

Claims20

Dependent claims

A method for reducing latency of user interface suspiciousness determination operations relative to suspiciousness determination operations performed externally to computing devices, comprising:

capturing, by a plugin executing on a computing device of the computing devices, a current screenshot of a user interface that is requested for display by a user of the computing device of the computing devices;
and
providing the current screenshot of the user interface to at least one of a plurality of machine learning modules within the plugin, wherein the plurality of machine learning modules are trained at a server computer system using customized sets of screenshots of different authentic user interfaces generated based on a set of Internet domain names that are generated based on information stored in a browser account manager of the computing device of the requesting user;
in response to the at least one machine learning module indicating that the user interface matches a particular one of the authentic user interfaces:
verifying a uniform resource locator (URL) of the user interface;
and
determining, by the plugin locally to the computing device, whether the user interface is suspicious.

4 more elements

An apparatus, comprising:

one or more processors;
and
one or more memory comprising storage elements having program instructions stored thereon that are executable by the one or more processors to:
capture a current screenshot of a user interface that is requested for display by a user of the apparatus;
and
provide the current screenshot of the user interface to at least one of a plurality of machine learning modules within an application executed locally by the apparatus, wherein the plurality of machine learning modules are trained at a server computer system using customized sets of screenshots of different authentic user interfaces generated based on Internet domain names that are determined based on information stored in a browser account manager of the apparatus;
in response to the at least one machine learning module indicating that the user interface matches a particular one of the authentic user interfaces:
verify a uniform resource locator (URL) of the user interface;
and
determine whether the user interface is suspicious, wherein the determining reduces latency relative to suspiciousness determinations performed by another device and accessible to the apparatus.

7 more elements

A non-transitory computer-readable medium having instructions stored thereon that are executable by a plugin of a browser of a computing device to reduce latency relative to suspiciousness determinations performed externally to the computing device by performing a set of security operations comprising:

capturing a current screenshot of a user interface that is requested for display by a user of the computing device;
and
providing the current screenshot of the user interface to at least one of a plurality of machine learning modules within the plugin, wherein the plurality of machine learning modules are trained at a server computer system using customized sets of screenshots of different authentic user interfaces generated based on Internet domain names stored in a browser account manager of the computing device;
in response to the at least one machine learning module indicating that the user interface matches a particular one of the authentic user interfaces:
verifying a uniform resource locator (URL) of the user interface;
and
determining at the computing device whether the user interface is suspicious.

4 more elements

Dependencies are inferred from the claim text.

Detection of user interface imitation

Life of this patent

Detection of user interface imitation

Life of this patent

Abstract

Claims20