Visual detection of phishing websites via headless browser

1. A computing apparatus, comprising:

a processor and a memory;

a network interface; and

instructions encoded within the memory to instruct the processor to:

receive a uniform resource locator (URL) for analysis, the URL to access a web page via a remote server;

via the network interface, retrieve from the remote server a copy of the web page;

render the web page in a headless browser to provide a computer-accessible visual output;

perform visual analysis of the visual output via a digital eye;

compare the visual analysis to a plurality of known phishing target websites; and

if the comparison identifies the web page as visually similar to a known phishing target website, detect the web page as a phishing web page.

2. The computing apparatus of claim 1 , wherein the instructions are further to provide a pre-filter stage before retrieving the web page from the remote server.

3. The computing apparatus of claim 2 , wherein the pre-filter stage comprises checking whether the URL has an existing cached local, enterprise, or global reputation.

4. The computing apparatus of claim 3 , wherein the instructions are to pass the URL if it has a known benign reputation.

5. The computing apparatus of claim 3 , wherein the instructions are to block the URL if it has a known malicious or phishing reputation.

6. The computing apparatus of claim 2 , wherein the pre-filter stage comprises identifying the URL for visual analysis only if it has input fields.

7. The computing apparatus of claim 6 , wherein the pre-filter stage comprises identifying the URL for visual analysis if the input fields collect potentially private or sensitive information.

8. The computing apparatus of claim 6 , wherein the pre-filter stage comprises identifying the URL for visual analysis if the purpose of the input fields cannot be determined.

9. The computing apparatus of claim 2 , wherein the pre-filter stage comprises identifying the URL for visual analysis if it includes non-encrypted hypertext transfer protocol (HTTP).

10. The computing apparatus of claim 2 , wherein the pre-filter stage comprises identifying the URL for visual analysis if the web page provides a self-signed transport layer security (TLS) certificate.

11. The computing apparatus of claim 2 , wherein the pre-filter stage comprises identifying the URL for visual analysis if the web page provides a transport layer security (TLS) certificate that does not match the URL.

12. The computing apparatus of claim 2 , wherein the pre-filter stage comprises identifying the URL for visual analysis if the web page is hosted on a personal blog or personal webpage subdomain of a reputable URL.

13. One or more tangible, non-transitory computer-readable media having stored thereon executable instructions to:

select a uniform resource locator (URL) for visual analysis, the URL to access a web page under analysis via a remote server;

retrieve a copy of the web page under analysis from the remote server;

visually analyze the web page under analysis, comprising:

visually rendering the web page under analysis in a headless browser;

applying a computer vision machine learning model to the visual rendering, the machine learning model trained on a plurality of web pages known to be phishing targets;

within the computer vision machine learning model, detecting the web page under analysis as an instance of a web page known to be a phishing target;

detecting the web page under analysis as a phishing attack; and

blocking the web page under analysis.

14. The one or more tangible, non-transitory computer-readable media of claim 13 , wherein performing visual analysis comprises abstracting out a selected element of the visual output.

15. The one or more tangible, non-transitory computer-readable media of claim 14 , wherein the selected element is a logo.

16. The one or more tangible, non-transitory computer-readable media of claim 14 , wherein the selected element is a font.

17. The one or more tangible, non-transitory computer-readable media of claim 14 , wherein the selected element is a background color or image.

18. A computer-implemented method of providing zero-day-capable phishing detection for unknown URLs, comprising:

receiving an incoming URL providing a reference to a web page;

determining that the URL does not have a known reliable reputation;

applying a pre-filtering stage to the URL;

upon determining that the URL did not pass the pre-filtering stage, subjecting the URL to visual machine learning analysis, comprising:

rendering the web page in a headless browser to provide a machine-readable visual representation of the web page;

instructing a machine learning model to identify the web page, wherein the machine learning model has been trained on a set of web page captures of online services known to be phishing targets;

receiving an identification from the machine learning model; and

if the machine learning model has identified the web page as being identical or substantially similar to a web service known to be a phishing target, detecting the URL as a phishing attack, and assigning the URL a malicious reputation.

19. The method of claim 18 , wherein the pre-filter stage comprises identifying the URL for visual analysis if it has input fields.

20. The method of claim 18 , wherein performing visual analysis comprises abstracting out a selected element of the visual output.