Phishing attack detection

A non-transitory computer-readable medium, when processed by one or more hardware processors, analyzes a subject Uniform Resource Locator (URL) to determine whether the subject URL is associated with a phishing attack, the non-transitory computer readable medium comprising:

• a feature generation logic module that, when executed by the one or more hardware processors, detects keypoints within a subject screenshot of a subject webpage corresponding to the subject URL and generates a subject feature vector that includes the detected keypoints;
• a classifier logic module that, when executed by the one or more hardware processors, determines a set of confidences for one or more feature vectors of a set of training feature vectors through analysis of the subject feature vector using a model, wherein a first confidence of the set of confidences assigned to a first feature vector of the set of training feature vectors indicates a likelihood that the subject webpage is mimicking a first webpage corresponding to the first feature vector, the model including a set of correlation rules;
• an image comparator logic module that, when executed by the one or more hardware processors, (i) performs an image comparison between the subject screenshot and a first screenshot of a first webpage corresponding to the first feature vector, and (ii) determines whether a result of the image comparison exceeds a predefined threshold, wherein the first feature vector was determined to have a highest confidence of the set of confidences;
• and
• a reporting logic module that, when executed by the one or more hardware processors, responsive to the image comparator logic module determining the result of the image comparison exceeds the predefined threshold, generates an alert indicating that the subject URL is associated with the phishing attack and transmitting the alert to one or more of a user of an endpoint device or an analyst.

A non-transitory computer-readable medium, when processed by one or more hardware processors, generates a machine learning model used in determining whether a subject Uniform Resource Locator (URL) is associated with a phishing attack, the non-transitory computer readable medium comprising:

• a content fetcher logic module that, when executed by the one or more hardware processors, obtains a first screenshot of a first website corresponding to a first URL within a set of training URLs, the set of training URLs including URLs determined as likely to be targeted for phishing attacks;
• a feature generation logic module that, when executed by the one or more hardware processors, for each screenshot corresponding to a URL within the training set of URLs detects keypoints within each screenshot and generates a feature vector for each screenshot that includes the detected keypoints of the corresponding screenshot;
• a domain mapper logic module that, when executed by the one or more hardware processors, receives each feature vector generated by the feature generation logic module and labels each feature vector according to a webpage family of the screenshot to which the feature vector corresponds to generate a plurality of labelled feature vectors;
• and
• a training module logic that, when executed by the one or more hardware processors, generates a machine learning model including a digitized representation of the correlation of the plurality of labeled feature vectors corresponding to the set of training URLs.