Machine learning for visual similarity-based phishing detection

A non-transitory computer-readable medium storing source code in a network device that, when executed by a processor, performs a method for web site phishing detection using machine learning of web site similarity without dependence on web site similarity thresholds, the method comprising:

• calculating a similarity index from characteristics of a suspected phishing web page to a database of known phishing web pages, wherein the characteristics derive from both Hyper Text Markup Language (HTML) tags of the suspected phishing web page and a screenshot of the suspected phishing web page;
• estimating, with machine learning using the similarity index as an input, a probability that the suspected web page comprises each of one or more candidate known phishing web pages from the database of known phishing web pages;
• selecting a known phishing web page from the one or more candidate known phishing web pages, based on having a highest probability, among the one or more candidate known phishing web pages, that the suspected web page comprises the known phishing web page;
• determining if the estimated probability of the selected phishing web page exceeds a probability threshold;
• and
• responsive to exceeding the probability threshold, taking a security action to prevent actuation of the phishing web page.

A network device for web site phishing detection using machine learning of web site similarity without dependence on web site similarity thresholds, the network device comprising:

• a processor;
• a network interface communicatively coupled to the processor and to a Wireless Local Area Network (WLAN);
• and
• a memory, communicatively coupled to the processor and storing:
• a page similarity module to calculate a similarity index from characteristics of a suspected phishing web page to a database of known phishing web pages, wherein the characteristics derive from both Hyper Text Markup Language (HTML) tags of the suspected phishing web page and a screenshot of the suspected phishing web page;
• a phishing probability module to estimate, with machine learning using the similarity index as an input, a probability that the suspected web page comprises each of one or more candidate known phishing web pages from the database of known phishing web pages;
• a phishing page selection module to select a known phishing web page from the one or more candidate known phishing web pages, based on having a highest probability, among the one or more candidate known phishing web pages, that the suspected web page comprises the known phishing web page;
• a probability threshold module to determine if the estimated probability of the selected phishing web page exceeds a probability threshold;
• and
• a security action module to, responsive to exceeding the probability threshold, take a security action to prevent actuation of the web page.