Phishing Protection Methods and Systems
AssigneeCyberfish LTD.
InventorsDmitry Kagan, Evgeni Geht
Life of this patent
Estimating the term…
Abstract
A method and a system for phishing detection includes converting unauthenticated web content to a browser image, determining that the browser image has a visual similarity to visual characteristics of a legitimate website, determining that a top-level domain (TLD) of the unauthenticated web content is different from a TLD of the legitimate website, and responsively determining that the unauthenticated web content is a phishing attack.
Claims23
A method of phishing detection, implemented by a computer system having a processor and a memory comprising instructions that when executed on the processor perform the method, comprising:
- acquiring a set of legitimate web content from a webpage hosted at a legitimate domain;
- generating from the set of legitimate web content a set of legitimate browser images;
- determining from the set of legitimate browser images a set of legitimate visual characteristics;
- accessing a hyperlink acquired from an email message, the email message having been received by a user in an email inbox associated with the user, and processing the hyperlink to receive unauthenticated web content at the hyperlink from a domain that is not identical to the legitimate domain;
- generating from the unauthenticated web content at the link background browser image;
- identifying a similarity between an unauthenticated web content visual characteristic in the background browser image and a legitimate visual characteristic from the set of legitimate visual characteristics, and determining that the domain of the unauthenticated web content is not the domain of the legitimate visual characteristic;
- and
- responsively recording the unauthenticated web content as a potential phishing attack.
(canceled)
(canceled)
10-12. (canceled)
17-21. (canceled)
A method of phishing detection, implemented by a computer system having a processor and a memory comprising instructions that when executed on the processor perform the method, comprising:
- receiving phishing content from phishing website URLs and phishing kits;
- generating from the phishing content a respective set of phishing browser images;
- determining from each set of phishing browser images a group of phishing visual characteristics;
- receiving unauthenticated web content from an email message in a message inbox addressed to a content recipient;
- generating from the unauthenticated web content a new browser image;
- identifying a similarity between an unauthenticated web content visual characteristic in the new browser image and at least one phishing visual characteristic from the groups of phishing visual characteristics;
- responsively recording that the unauthenticated web content is a phishing attack;
- and
- removing the email message from the message inbox.
A system of phishing detection, comprising a computer system having a processor and a memory comprising instructions that, when executed on the processor, perform steps comprising:
- acquiring a set of legitimate web content from each of one or more webpages of legitimate TLDs;
- generating from each set of legitimate web content a set of legitimate browser images;
- determining from each set of legitimate browser images a group of legitimate visual characteristics;
- receiving unauthenticated web content addressed to a content recipient;
- generating from the unauthenticated web content a new browser image;
- identifying a similarity between an unauthenticated web content visual characteristic in the new browser image and at least one legitimate visual characteristic from the groups of legitimate visual characteristics, and determining that the TLD of the unauthenticated web content is not the TLD of the legitimate visual characteristic;
- and
- responsively recording that the unauthenticated web content is a phishing attack.
Dependencies are inferred from the claim text.