Phishing Detection Method And System

A method of detecting a phishing event, comprising:

• by a processor and a memory with computer code instructions stored thereon, the memory operatively coupled to the processor such that, when executed by the processor, the computer code instructions cause the system to implement:
• acquiring an image of rendered visual content;
• generating image coordinates associated with an action triggered by a user click on the image, cropping a region of the image according to the coordinates to form a cropped region, and identifying a characteristic corresponding to a final terminus associated with the triggered action;
• performing an object detection operation, using an object detection convolutional network (CNN), on the cropped region of the image to detect a brand logo located within the region;
• determining, based on the object detection operation, that the detected brand logo resembles content of a candidate brand;
• comparing the characteristic associated with the triggered action, with one or more authorized characteristics associated with the candidate brand;
• and
• declaring a phishing event when the comparing indicates that the characteristic associated with the triggered action is not one of the authorized characteristics of the candidate brand.

A method of detecting an unauthorized password event, comprising:

• by a processor and a memory with computer code instructions stored thereon, the memory operatively coupled to the processor such that, when executed by the processor, the computer code instructions cause the system to implement:
• receiving a password entered by a user into a webpage password prompt;
• determining a domain associated with the webpage;
• upon receiving the password, halting a submission of the password to a source of the webpage;
• querying a password-domain record for a list of domains approved for the password;
• comparing the domain associated with the webpage to the domains approved for the password;
• and
• preventing the password from being sent to the webpage when the domain associated the webpage does not match one or more of the associated domains.

A method of detecting a phishing event, comprising:

• by a processor and a memory with computer code instructions stored thereon, the memory operatively coupled to the processor such that, when executed by the processor, the computer code instructions cause the system to implement:
• sending, by a first user, an email associated with a sender domain;
• generating a sender hash based on one or more components of the email, and storing the sender hash in a data storage facility;
• receiving, by a second user, the email;
• determining that the sender domain is an accepted organization domain;
• when the determining establishes that the sender domain is the accepted organization domain, generating a receiver hash based on the one or more components of the email;
• retrieving the sender hash from the memory;
• and
• declaring a phishing event when the sender hash does not match the receiver hash.

A non-transitory computer-readable medium with computer code instruction stored thereon, the computer code instructions, when executed by a processor, cause an apparatus to:

• acquire an image of visual content rendered in association with a source, and identifying a domain of the source;
• perform an object detection operation, using an object detection convolutional network (CNN), on one or more brand logos located within the visual content, to detect an instantiation of one or more targeted brands;
• perform a spatial analysis of the visual content to identify one or more solicitations of personally identifiable information (PII);
• determine, based on the object detection operation and the spatial analysis, that at least a portion of the visual content resembles content of a candidate brand;
• compare the domain of the source with one or more authorized domains of the candidate brand;
• and
• declare a phishing event when the comparing indicates that the domain of the source is not one of the authorized domains of the candidate brand.

A non-transitory computer-readable medium with computer code instruction stored thereon, the computer code instructions, when executed by a processor, cause an apparatus to:

• acquire an image of rendered visual content;
• generate image coordinates associated with an action triggered by a user click on the image, cropping a region of the image according to the coordinates to form a cropped region, and identifying a domain corresponding to a final terminus associated with the triggered action;
• perform an object detection operation, using an object detection convolutional network (CNN), on the cropped region of the image to detect a brand logo located within the region;
• determine, based on the object detection operation, that the detected brand logo resembles content of a candidate brand;
• compare a characteristic associated with the triggered action, with one or more authorized characteristics associated with the candidate brand;
• and
• declare a phishing event when the comparing indicates that the domain of the embedded link is not one of the authorized domains of the candidate brand.