# US 12,192,233 B2 · Systems and methods for phishing attack protection based on identity provider verification > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,233 B2 - Document ID: US12192233B2 - Status: Granted - Kind: B2 - Application number: 17/231,618 - Filed: 2021-04-15 - Published: 2022-10-20 - Granted: 2025-01-07 - Earliest claimed: 2021-04-15 - Assignees: Citrix Systems, Inc. - Applicants: Citrix Systems, Inc. - Inventors: Manbinder Pal Singh - Web page: https://patentgrep.com/patent/US12192233B2 ## CPC - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06N 3/04: Architecture, e.g. interconnection topology - G06N 3/0464: Convolutional networks [CNN, ConvNet] - G06N 3/08: Learning methods - G06N 3/09: Supervised learning - G06F 2221/2119: Authenticating web pages, e.g. with suspicious links - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A computer system is provided. The computer system includes a memory and at least one processor coupled to the memory and configured to provide phishing attack protection based on identity provider verification. The at least one processor is further configured to capture an image of a browser web page to which the user has navigated and identify the domain name associated with the browser web page. The at least one processor is further configured to determine that the captured image matches an image of a known identity provider web page. The at least one processor is further configured to detect a phishing attempt in response to the determination that the images match and that the domain name associated with the browser web page differs from the domain name associated with the identity provider web page. ## Claims ### Claim 1 A computer system comprising: a memory; and at least one processor coupled to the memory and configured to: train a neural network, the training including: navigating to an identity provider (IdP) web page based on a domain name associated with the IdP web page; capturing an image of the IdP web page; generating variations of the image of the IdP web page by modifying attributes of the image of the IdP, the attributes including one or more of a background color, logos, fonts, dimensions, languages, words, or phrases; and employing the variations to train the neural network; capture an image of a browser web page; identify a domain name associated with the browser web page; employ the neural network to determine an image match where the captured image matches the image of the IdP web page; and detect a phishing attempt in response to the determination of the image match, if the domain name associated with the browser web page differs from the domain name associated with the IdP web page. ### Claim 2 (depends on 1) The computer system of claim 1, wherein the domain name associated with the IdP web page is obtained from a datastore of IdP web pages, the datastore configured by an administrator. ### Claim 3 (depends on 1) The computer system of claim 1, wherein the at least one processor is further configured to bypass the detection of the phishing attempt in response to a determination that the browser web page is not a sign-in page. ### Claim 4 (depends on 1) The computer system of claim 1, wherein the at least one processor is further configured to perform a security action in response to the detected phishing attempt, the security action including one or more of providing a warning to a device associated with a user who navigated to the browser web page, logging the detection, and generating an alert to an administrator. ### Claim 5 A method for protection of user credentials comprising: training, by a computer system, a neural network, the training including: navigating to an identity provider (IdP) web page based on a second domain name associated with the IdP web page; capturing an image of the IdP web page; generating variations of the image of the IdP web page by modifying attributes of the image of the IdP, the attributes including one or more of a background color, logos, fonts, dimensions, languages, words, or phrases; and employing the variations to train the neural network; capturing, by the computer system, an image of a browser web page; identifying, by the computer system, a first domain name associated with the browser web page; employing, by the computer system, the neural network to determine that the captured image matches an image of the IdP web page; determining, by the computer system, that the first domain name differs from the second domain name; and detecting, by the computer system, a phishing attempt in response to the determination that the captured image matches the image of the IdP web page and the determination that the first domain name differs from the second domain name. ### Claim 6 (depends on 5) The method of claim 5, wherein the second domain name is obtained from a datastore of IdP web pages, the datastore configured by an administrator. ### Claim 7 (depends on 5) The method of claim 5, further comprising bypassing the detection of the phishing attempt in response to a determination that the browser web page is not a sign-in page. ### Claim 8 (depends on 5) The method of claim 5, further comprising performing a security action in response to the detected phishing attempt, the security action including one or more of providing a warning to a device associated with a user who navigated to the browser web page, logging the detection, and generating an alert to an administrator. ### Claim 9 A non-transitory computer readable medium storing executable sequences of instructions to provide protection of user credentials, the sequences of instructions comprising instructions to: train a neural network, the training including: navigating to an identity provider (IdP) web page based on a domain name associated with the IdP web page; capturing an image of the IdP web page; generating variations of the image of the IdP web page by modifying attributes of the image of the IdP, the attributes including one or more of a background color, logos, fonts, dimensions, languages, words, or phrases; and employing the variations to train the neural network; capture an image of a browser web page; identify a domain name associated with the browser web page; employ the neural network to determine an image match where the captured image matches the image of the IdP web page; and detect a phishing attempt in response to the determination of the image match, if the domain name associated with the browser web page differs from the domain name associated with the IdP web page. ### Claim 10 (depends on 9) The computer readable medium of claim 9, wherein the domain name associated with the IdP web page is obtained from a datastore of IdP web pages, the datastore configured by an administrator. ### Claim 11 (depends on 9) The computer readable medium of claim 9, wherein the sequences of instructions further include instructions to bypass the detection of the phishing attempt in response to a determination that the browser web page is not a sign-in page. ### Claim 12 (depends on 9) The computer readable medium of claim 9, wherein the sequences of instructions further include instructions to perform a security action in response to the detected phishing attempt, the security action including one or more of providing a warning to a device associated with a user who navigated to the browser web page, logging the detection, and generating an alert to an administrator.