Detection of phishing attacks using similarity analysis
View Patent ↗A computerized system and method to detect phishing cyber-attacks is described. The approach entails analyzing at least one displayable image of a webpage referenced by a URL associated with an email to ascertain whether the image, and thus the webpage and the email are part of a phishing cyber-attack.
1. A system to detect phishing cyber-attacks, the system comprising:
one or more processors; and
a storage device communicatively coupled to the one or more processors, the storage device is configured to store a plurality of logic modules including
an analysis logic configured to analyze an object comprising a webpage associated with a Uniform Resource Locator (URL) to identify suspicious features associated with a plurality of images pertaining to the object the analysis logic further configured to extract the plurality of images associated with the object in response to identifying suspicious features pertaining to each of the plurality of images,
a feature analyzer configured to receive the plurality of extracted images from the analysis logic and generate properties associated with each of the plurality of extracted images,
a classifier configured to (a) receive from the feature analyzer at least one or more properties associated with each of the plurality of extracted images and determine an image score associated with each particular image of the plurality of extracted images based on a correlation of the properties associated with the particular image with properties associated with known phishy images being images known to be part of or associated with a phishing cyber-attack, (b) generate an object score by combining the image scores of the plurality of extracted images associated with the object, and (c) classify the object as associated with a phishing cyber-attack when the object score exceeds a threshold, and
a reporting engine configured to generate an alert upon determining, by the object classifier, that the object is associated with the phishing cyber-attack.
2. The system of claim 1 , wherein the suspicious features include a displayable user information submission element.
3. The system of claim 1 , wherein the analysis logic comprises a dynamic analysis logic processing the object with an instrumented virtual machine.
4. The system of claim 1 , wherein the properties generated by the feature analyzer comprise a cryptographic hash of the image.
5. The system of claim 1 , wherein the properties generated by the feature analyzer comprise a perceptual hash of the image.
6. The system of claim 1 , wherein the classifier uses the perceptual hash to determine a similarity between the image and at least one of the known phi shy images.
7. The system of claim 1 , further comprising a hash store identifying properties of known phishy images.
8. The system of claim 1 , wherein images provided to the feature analyzer consist of images visible when the object is displayed to a user.
9. The system of claim 1 , wherein features associated with phishing cyber-attacks comprise a user input field.
10. The system of claim 1 , wherein the analysis logic determines a targeted entity, the targeted entity comprising a property of at least one of the images.
11. A computerized method for detecting a phishing cyber-attack, the method comprising:
processing an object comprising a webpage associated with a Uniform Resource Locator (URL) in an analysis logic to identify suspicious features associated with one or more images pertaining to the object;
extracting a set of images of the object in response to identifying the object exhibits suspicious features and providing the set of images to a feature analyzer;
generating properties associated with each image of the set of images and providing the properties associated with each image to an image classifier, each of the properties including information directed to image pixel orientation;
classifying, by the image classifier, each image of the set of images in response to a correlation of the properties associated with the image with properties associated with known phishing images, and providing the correlations to an object classifier;
classifying, by the object classifier, the object as associated with a phishing cyber-attack based, at least in part, on the correlation or correlations of the properties associated with one or more images of the set of images received from the image classifier with the properties associated with known phishing images exceeds a prescribed threshold that is based, at least in part, on an amount of display area associated with the object that is occupied by the one or more images classified as images associated with known phishing cyber-attacks; and
issuing an alert, by a reporting engine, in response to a classifying the object as associated with the phishing cyber-attack.
12. The method of claim 11 , wherein the set of images extracted by the analysis logic comprises images visible to a user when displayed.
13. The method of claim 11 , wherein the analysis logic performing a static analysis and a dynamic analysis to identify the features of the object, the dynamic analysis logic further comprising a virtual machine configured to monitor features of an object during run-time.
14. The method of claim 11 , further comprising determining a targeted entity of a webpage corresponding to the URL, the targeted entity associated with the properties of each image.
15. The method of claim 11 , further comprising comparing, by the image classifier, the correlation associated with each of the images with a first threshold to determine phishiness of the properties associated with the image.
16. The method of claim 11 , further comprising combining the image scores to form an overall object score and comparing the object score with a second threshold in classifying the object.
17. The method of claim 16 , wherein the object classifier reduces the threshold in response to the identification of a specified targeted entity.
18. The method of claim 11 , wherein features associated with phishing cyber-attacks comprise data input elements for prompting user interaction.
19. The method of claim 11 , wherein generating the properties by the feature analyzer comprises generating a cryptographic hash and a perceptual hash of the image.
20. The method of claim 11 , further comprises accessing, by the image classifier, a hash store to retrieve properties of known phishy images.
21. The system of claim 1 , wherein the threshold is based, at least in part, on an amount of display area associated with the object that is occupied by the one or more extracted images classified as phishy images.
22. The method of claim 11 , wherein image pixel orientation includes image pixel height and width associated with an image of the set of images or an aspect ratio associated with the image.
23. The system of claim 1 , wherein the one or more processors and the storage device are part of a phishing detection and analysis system hosted in a cloud network.
24. The computerized method of claim 11 , wherein the set of images includes at least the one or more images.
25. The computerized method of claim 11 being performed by a phishing detection and analysis system hosted in a cloud network.