Phishing attack detection
A computerized method for analyzing a subject URL to determine whether the subject URL is associated with a phishing attack is disclosed. The method includes steps of detecting keypoints within a screenshot of a webpage corresponding to the subject URL and determining a set of confidences based on an analysis of the detected keypoints with a model. Each confidence within the set of confidences is assigned to feature vector within a set of training feature vectors representing a training set of URLs used in generating the model. The method comprises performing an image comparison between the screenshot and a screenshot corresponding to a feature vector within the set of training feature vectors, the feature vector being assigned a highest confidence. Responsive to determining the image comparison result exceeds a predefined threshold, transmitting an alert indicating that the subject URL is associated with the phishing attack.
1. A computerized method for analyzing a subject Uniform Resource Locator (URL) by a phishing detection and analysis system (PDAS) to determine whether the subject URL is associated with a phishing attack, the PDAS including one or more processors and a storage medium, the method comprising:
performing, by the PDAS, a first set of operations including:
detecting a plurality of keypoints within a subject screenshot of a subject webpage corresponding to the subject URL;
providing the plurality of keypoints to a machine learning model, wherein the machine learning model is a representation of relationships between a set of training feature vectors representing a training set of URLs, each of the training feature vectors corresponds to a separate webpage family within a set of webpage families;
executing the machine learning model using the plurality of keypoints as input to the machine learning model to determine a set of confidences, wherein each confidence within the set of confidences reflects a potential relationship between the subject screenshot and a webpage family within the set of webpage families, and wherein a first webpage family within the set of webpage families is associated with a highest confidence of the set of confidences;
performing, by the PDAS, a second set of operations including:
performing an image comparison between the subject screenshot and one or more screenshots corresponding to webpages within the first webpage family;
determining whether a result of the image comparison exceeds a predefined threshold;
responsive to the determining that the result of the image comparison exceeds the predefined threshold, generating an alert or report indicating that the subject URL is associated with the phishing attack.
2. The computerized method of claim 1 , further comprising:
receiving, by the PDAS, the subject URL; and
obtaining, by the PDAS, the subject screenshot of the subject webpage corresponding to the subject URL.
3. The computerized method of claim 1 , further comprising:
performing, by the PDAS, a pre-filter check on the subject URL, the pre-filter check including one or more static analyses.
4. The computerized method of claim 1 , further comprising:
determining, by the PDAS, from the subject screenshot, one or more keypoint descriptors for each of the plurality of keypoints, each of the one or more keypoint descriptors including one or more parameters of a keypoint of the plurality of keypoints; and
generating, by the PDAS, a feature vector including the plurality of keypoints and the one or more keypoint descriptors for each of the plurality of keypoints,
wherein determining, by the PDAS, the set of confidences includes analyzing the feature vector accordingly to the machine learning model.
5. The computerized method of claim 1 , wherein the image comparison includes:
retrieving, by the PDAS, previously determined keypoints of a first screenshot of the one or more screenshots; and
correlating, by the PDAS, the previously determined keypoints of the first screenshot with the plurality of keypoints of the subject screenshot.
6. The computerized method of claim 1 , wherein the subject screenshot includes image data of the subject webpage that is configured to be displayable on a computer screen.
7. The computerized method of claim 1 , wherein each keypoint of the plurality of keypoints includes an image region having a known orientation within a set of pixels representing the subject screenshot.
8. The computerized method of claim 1 , wherein a first confidence corresponds to a likelihood that the subject webpage is mimicking a first screenshot of a first webpage of the first webpage family, the first confidence included within the set of confidences.
9. The computerized method of claim 1 , wherein the machine learning model is generated and trained with a plurality of screenshots of each of a plurality of webpages using a combination of an internet browser and an operating system.
10. The computerized method of claim 1 , wherein the performing of the image comparison includes:
performing the image comparison between the subject screenshot and one or more screenshots corresponding to webpages of the first webpage family until a result of an image comparison is greater than or equal to the predefined threshold.
11. The computerized method of claim 1 , wherein
the responsive to the determining that the result of the image comparison exceeds the predefined threshold includes transmitting the alert or report to one or more of a user of an endpoint device or an analyst.
12. The computerized method of claim 1 , wherein the executing of the machine learning model indicates that a plurality of webpage families are closely correlated with the subject screenshot and the performing the image comparison is between the subject screenshot and a screenshot of at least one webpage from each of the set of webpage families including the one or more screenshots corresponding to the webpages within the first webpage family.
13. The computerized method of claim 1 , further comprising:
responsive to the determining that the result of the image comparison is below the predefined threshold, indicating that the subject URL is not associated with the phishing attack.
14. A non-transitory computer-readable medium, when processed by one or more processors, analyzes a subject Uniform Resource Locator (URL) to determine whether the subject URL is associated with a phishing attack, the non-transitory computer readable medium comprising:
a feature generation logic module that, when executed by the one or more processors, detects a plurality of keypoints within a subject screenshot of a subject webpage corresponding to the subject URL and generates a subject feature vector that includes the detected plurality of keypoints;
a classifier logic module that, when executed by the one or more processors, executes a machine learning model using the detected the plurality of keypoints as input to the machine learning model to determine a set of confidences, wherein each confidence of the set of confidences reflects a potential relationship between the subject screenshot and a first webpage family within a set of webpage families, and wherein the first webpage family within the set of webpage families is associated with a highest confidence of the set of confidence, wherein the machine learning model is a representation of relationships between a set of training feature vectors representing a training set of URLs, each of the training feature vectors corresponds to a separate webpage family within the set of webpage families;
an image comparator logic module that, when executed by the one or more processors, (i) performs an image comparison between the subject screenshot and one or more screenshots corresponding to webpages within the first webpage family, and (ii) determines whether a result of the image comparison exceeds a predefined threshold; and
a reporting logic module that, when executed by the one or more processors, responsive to the image comparator logic module determining that the result of the image comparison exceeds the predefined threshold, generates an alert or report indicating that the subject URL is associated with the phishing attack.
15. The computer-readable medium of claim 14 , wherein the subject screenshot is captured as an image file.
16. The computer-readable medium of claim 14 , further comprising: a content fetcher logic module that, when executed by the one or more processors, obtains the subject screenshot by accessing a data caching system that stores one or more previously captured screenshots.
17. The computer-readable medium of claim 14 , further comprising:
a pre-filter logic module that, when executed by the one or more processors, performs static scanning the subject URL including an analysis of one or more of a blacklist or white list.
18. The computer-readable medium of claim 14 , wherein the image comparison includes:
retrieving previously determined keypoints of a first screenshot of a first webpage; and
correlating the previously determined keypoints of the first screenshot with the detected keypoints of the subject screenshot.
19. The computer-readable medium of claim 14 , wherein each keypoint of the detected keypoints includes an image region having a known orientation within a set of pixels representing the subject screenshot.
20. The computer-readable medium of claim 14 , wherein the machine learning model includes a representation of a correlation of the set of training feature vectors,
wherein a first feature vector corresponds to a first webpage corresponding to a first webpage family of a set of webpage families.
21. The computer-readable medium of claim 14 , wherein the machine learning model is generated and trained with a plurality of screenshots of each of a plurality of webpages using a combination of an internet browser and an operating system.
22. The computer-readable medium of claim 14 , wherein the performing of the image comparison includes:
performing the image comparison between the subject screenshot and one or more screenshots corresponding to webpages of the first webpage family until a result of an image comparison is greater than or equal to the predefined threshold.
23. The computer-readable medium of claim 14 , wherein
the responsive to the determining that the result of the image comparison exceeds the predefined threshold includes transmitting the alert or report to one or more of a user of an endpoint device or an analyst.
24. The computer-readable medium of claim 14 , wherein the executing of the machine learning model indicates that a plurality of webpage families are closely correlated with the subject screenshot and the performing the image comparison is between the subject screenshot and a screenshot of at least one webpage from each of the set of webpage families including the one or more screenshots corresponding to the webpages within the first webpage family.
25. The computer-readable medium of claim 14 , further comprising:
responsive to the determining that the result of the image comparison is below the predefined threshold, indicating that the subject URL is not associated with the phishing attack.
26. A non-transitory computer-readable medium, when processed by one or more processors, generates a machine learning model used in determining whether a subject Uniform Resource Locator (URL) is associated with a phishing attack, the non-transitory computer readable medium comprising:
a feature generation logic module that, when executed by the one or more processors, for each screenshot corresponding to a URL within a set of training URLs detects keypoints within each screenshot and generates a feature vector for each screenshot that includes the detected keypoints of the corresponding screenshot;
a domain mapper logic module that, when executed by the one or more processors, receives each feature vector generated by the feature generation logic module and labels each feature vector according to a webpage family of the screenshot to which the feature vector corresponds to generate a plurality of labeled feature vectors; and
a training module logic that, when executed by the one or more processors, generates the machine learning model including a digitized representation of a correlation of the plurality of labeled feature vectors corresponding to the set of training URLs, wherein the machine learning model is a representation of relationships between a set of training feature vectors representing the set of training URLs, each of the training feature vectors corresponds to a separate webpage family within a set of webpage families, and wherein execution of the machine learning model using a plurality of keypoints of a subject screenshot as input determines a set of confidences, wherein each confidence within the set of confidences reflects a potential relationship between the subject screenshot and a webpage family within the set of webpage families, and wherein a first webpage family within the set of webpage families is associated with a highest confidence of the set of confidences; and
an image comparison logic module that, when executed by the one or more processors, (i) performs an image comparison between the subject screenshot and one or more screenshots corresponding to webpages within the first webpage family, and (ii) determines whether a result of the image comparison exceeds a predefined threshold.
27. The computer-readable medium of claim 26 , wherein the subject screenshot is captured as an image file.
28. The computer-readable medium of claim 26 , wherein the feature generation logic module uses at least one computer vision technique to detect the keypoints within each screenshot.
29. The computer-readable medium of claim 26 , wherein the machine learning model represents one or more hyperplanes onto which features of each feature vector are categorized.
30. The non-transitory computer-readable medium of claim 26 , further comprising:
a content fetcher logic module that, when executed by the one or more processors, obtains a screenshot of a web site corresponding to each URL within the set of training URLs, the set of training URLs including URLs determined as likely to be targeted for phishing attacks, wherein each screenshot is obtained using a different combination of an internet browser and an operating system.
31. The computer-readable medium of claim 30 , wherein the content fetcher logic module obtains a first screenshot by accessing a data caching system that stores one or more previously captured screenshots.
32. The non-transitory computer-readable medium of claim 26 , further comprising:
a reporting logic module that, when executed by the one or more processors, responsive to the image comparator logic module determining that the result of the image comparison exceeds the predefined threshold, generates an alert or report indicating that the subject URL is associated with the phishing attack.