Machine learning for visual similarity-based phishing detection

1 . A computer-implemented method in a network device for web site phishing detection using machine learning of web site similarity without dependence on web site similarity thresholds, the method comprising:

calculating a similarity index from characteristics of a suspected phishing web page to a database of known phishing web pages, wherein the characteristics derive from both Hyper Text Markup Language (HTML) tags of the suspected phishing web page and a screenshot of the suspected phishing web page;

estimating, with machine learning using the similarity index as an input, a probability that the suspected web page comprises each of one or more candidate known phishing web pages from the database of known phishing web pages;

selecting a known phishing web page from the one or more candidate known phishing web pages, based on having a highest probability, among the one or more candidate known phishing web pages, that the suspected web page comprises the known phishing web page;

determining if the estimated probability of the selected phishing web page exceeds a probability threshold; and

responsive to exceeding the probability threshold, taking a security action to prevent actuation of the phishing web page.

2 . The method of claim 1 , wherein the estimated probability is from a Bayesian Classifier.

3 . The method of claim 1 , wherein the similarity index calculation is based at least in part on a Jaccard similarity coefficient.

4 . The method of claim 1 , wherein the estimated probability is based at least in part on a Hamming distance.

5 . A non-transitory computer-readable medium storing source code in a network device that, when executed by a processor, performs a method for web site phishing detection using machine learning of web site similarity without dependence on web site similarity thresholds, the method comprising:

calculating a similarity index from characteristics of a suspected phishing web page to a database of known phishing web pages, wherein the characteristics derive from both Hyper Text Markup Language (HTML) tags of the suspected phishing web page and a screenshot of the suspected phishing web page;

estimating, with machine learning using the similarity index as an input, a probability that the suspected web page comprises each of one or more candidate known phishing web pages from the database of known phishing web pages;

selecting a known phishing web page from the one or more candidate known phishing web pages, based on having a highest probability, among the one or more candidate known phishing web pages, that the suspected web page comprises the known phishing web page;

determining if the estimated probability of the selected phishing web page exceeds a probability threshold; and

responsive to exceeding the probability threshold, taking a security action to prevent actuation of the phishing web page.

6 . The method of claim 5 , wherein the estimated probability is from a Bayesian Classifier.

7 . The method of claim 5 , wherein the similarity index calculation is based at least in part on a Jaccard similarity coefficient.

8 . The method of claim 5 , wherein the estimated probability is based at least in part on a Hamming distance.

9 . A network device for web site phishing detection using machine learning of web site similarity without dependence on web site similarity thresholds, the network device comprising:

a processor;

a network interface communicatively coupled to the processor and to a Wireless Local Area Network (WLAN); and

a memory, communicatively coupled to the processor and storing:

a page similarity module to calculate a similarity index from characteristics of a suspected phishing web page to a database of known phishing web pages, wherein the characteristics derive from both Hyper Text Markup Language (HTML) tags of the suspected phishing web page and a screenshot of the suspected phishing web page;

a phishing probability module to estimate, with machine learning using the similarity index as an input, a probability that the suspected web page comprises each of one or more candidate known phishing web pages from the database of known phishing web pages;

a phishing page selection module to select a known phishing web page from the one or more candidate known phishing web pages, based on having a highest probability, among the one or more candidate known phishing web pages, that the suspected web page comprises the known phishing web page;

a probability threshold module to determine if the estimated probability of the selected phishing web page exceeds a probability threshold; and

a security action module to, responsive to exceeding the probability threshold, take a security action to prevent actuation of the web page.

10 . The network device of claim 9 , wherein the estimated probability is from a Bayesian Classifier.

11 . The network device of claim 9 , wherein the similarity index calculation is based at least in part on a Jaccard similarity coefficient.

12 . The network device of claim 9 , wherein the estimated probability is based at least in part on a Hamming distance.