Malicious site detection for a cyber threat response system

A cyber security appliance, comprising:

• one or more processors;
• and
• a non-transitory memory storage device accessible by the one or more processors, the non-transitory memory storage device comprises
• a phishing site detector configured to i) divide an image into a plurality of segments, ii) transform each segment of the plurality of segments into a fixed rendered size to generate a plurality of transformed segments, and iii) analyze each of the plurality of transformed segments to determine whether the transformed segment includes a key text-like feature;
• a signature creator configured to create a plurality of digital signatures, each digital signature, corresponding to one the plurality of transformed segments including a corresponding key text-like feature, is at least indicative of a visual appearance of the corresponding key text-like feature;
• and
• an Artificial-Intelligence (AI) model configured to compare i) the plurality of digital signatures associated with a plurality of key text-like features detected in the image from an unknown site under analysis to ii) digital signatures associated with a second plurality of text-like features from a plurality of known bad phishing sites to output a likelihood of maliciousness of the unknown site under analysis.

A method for detecting a malicious cyber attack, comprising:

• dividing an image into a plurality of segments;
• transforming each segment of the plurality of segments into a fixed rendered size to generate a plurality of transformed segments;
• analyzing each of the plurality of transformed segments to determine whether the transformed segment includes a key text-like feature;
• generating a plurality of digital signatures, each digital signature corresponds to one the plurality of transformed segments, includes a corresponding key text-like feature, and is at least indicative of a visual appearance of the corresponding key text-like feature;
• and
• comparing i) the plurality of digital signatures associated with a plurality of key text-like features detected in the image from an unknown site under analysis to ii) digital signatures associated with a second plurality of text-like features from a plurality of known bad phishing sites to output a likelihood of maliciousness of the unknown site under analysis.

A non-transitory memory storage device including stored data executable by one or more processors, the stored data comprising:

• a phishing site detector configured to i) divide an image into a plurality of segments, ii) transform each segment of the plurality of segments into a fixed rendered size to generate a plurality of transformed segments, and iii) analyze each of the plurality of transformed segments to determine whether the transformed segment includes a key text-like feature;
• a signature creator configured to create a plurality of digital signatures, each digital signature, corresponding to one the plurality of transformed segments including a corresponding key text-like feature, is at least indicative of a visual appearance of the corresponding key text-like feature;
• and
• an Artificial-Intelligence (AI) model configured to compare i) the plurality of digital signatures associated with a plurality of key text-like features detected in the image from an unknown site under analysis to ii) digital signatures associated with a second plurality of text-like features from a plurality of known bad phishing sites to output a likelihood of maliciousness of the unknown site under analysis.