Systems and methods for phishing attack protection based on identity provider verification

A method for protection of user credentials comprising:

• training, by a computer system, a neural network, the training including:
• navigating to an identity provider (IdP) web page based on a second domain name associated with the IdP web page;
• capturing an image of the IdP web page;
• generating variations of the image of the IdP web page by modifying attributes of the image of the IdP, the attributes including one or more of a background color, logos, fonts, dimensions, languages, words, or phrases;
• and
• employing the variations to train the neural network;
• capturing, by the computer system, an image of a browser web page;
• identifying, by the computer system, a first domain name associated with the browser web page;
• employing, by the computer system, the neural network to determine that the captured image matches an image of the IdP web page;
• determining, by the computer system, that the first domain name differs from the second domain name;
• and
• detecting, by the computer system, a phishing attempt in response to the determination that the captured image matches the image of the IdP web page and the determination that the first domain name differs from the second domain name.

A non-transitory computer readable medium storing executable sequences of instructions to provide protection of user credentials, the sequences of instructions comprising instructions to:

• train a neural network, the training including:
• navigating to an identity provider (IdP) web page based on a domain name associated with the IdP web page;
• capturing an image of the IdP web page;
• generating variations of the image of the IdP web page by modifying attributes of the image of the IdP, the attributes including one or more of a background color, logos, fonts, dimensions, languages, words, or phrases;
• and
• employing the variations to train the neural network;
• capture an image of a browser web page;
• identify a domain name associated with the browser web page;
• employ the neural network to determine an image match where the captured image matches the image of the IdP web page;
• and
• detect a phishing attempt in response to the determination of the image match, if the domain name associated with the browser web page differs from the domain name associated with the IdP web page.