Machine learning for visual similarity-based phishing detection
In one embodiment, a similarity index is calculated from characteristics of a suspected phishing web page to a database of known phishing web pages. The characteristics derive from both HTML tags of the suspected phishing web page and a screenshot of the suspected phishing web page. With machine learning using the similarity index as an input, a probability is estimated that the suspected web page comprises a known phishing web page from the database of known phishing web pages. A known phishing web page is selected from one or more candidates known phishing web pages, based on having a highest probability.
1 . A computer-implemented method in a network device for web site phishing detection using machine learning of web site similarity without dependence on web site similarity thresholds, the method comprising:
calculating a similarity index from characteristics of a suspected phishing web page to a database of known phishing web pages, wherein the characteristics derive from both Hyper Text Markup Language (HTML) tags of the suspected phishing web page and a screenshot of the suspected phishing web page;
estimating, with machine learning using the similarity index as an input, a probability that the suspected web page comprises each of one or more candidate known phishing web pages from the database of known phishing web pages;
selecting a known phishing web page from the one or more candidate known phishing web pages, based on having a highest probability, among the one or more candidate known phishing web pages, that the suspected web page comprises the known phishing web page;
determining if the estimated probability of the selected phishing web page exceeds a probability threshold; and
responsive to exceeding the probability threshold, taking a security action to prevent actuation of the phishing web page.
2 . The method of claim 1 , wherein the estimated probability is from a Bayesian Classifier.
3 . The method of claim 1 , wherein the similarity index calculation is based at least in part on a Jaccard similarity coefficient.
4 . The method of claim 1 , wherein the estimated probability is based at least in part on a Hamming distance.
5 . A non-transitory computer-readable medium storing source code in a network device that, when executed by a processor, performs a method for web site phishing detection using machine learning of web site similarity without dependence on web site similarity thresholds, the method comprising:
calculating a similarity index from characteristics of a suspected phishing web page to a database of known phishing web pages, wherein the characteristics derive from both Hyper Text Markup Language (HTML) tags of the suspected phishing web page and a screenshot of the suspected phishing web page;
estimating, with machine learning using the similarity index as an input, a probability that the suspected web page comprises each of one or more candidate known phishing web pages from the database of known phishing web pages;
selecting a known phishing web page from the one or more candidate known phishing web pages, based on having a highest probability, among the one or more candidate known phishing web pages, that the suspected web page comprises the known phishing web page;
determining if the estimated probability of the selected phishing web page exceeds a probability threshold; and
responsive to exceeding the probability threshold, taking a security action to prevent actuation of the phishing web page.
6 . The method of claim 5 , wherein the estimated probability is from a Bayesian Classifier.
7 . The method of claim 5 , wherein the similarity index calculation is based at least in part on a Jaccard similarity coefficient.
8 . The method of claim 5 , wherein the estimated probability is based at least in part on a Hamming distance.
9 . A network device for web site phishing detection using machine learning of web site similarity without dependence on web site similarity thresholds, the network device comprising:
a processor;
a network interface communicatively coupled to the processor and to a Wireless Local Area Network (WLAN); and
a memory, communicatively coupled to the processor and storing:
a page similarity module to calculate a similarity index from characteristics of a suspected phishing web page to a database of known phishing web pages, wherein the characteristics derive from both Hyper Text Markup Language (HTML) tags of the suspected phishing web page and a screenshot of the suspected phishing web page;
a phishing probability module to estimate, with machine learning using the similarity index as an input, a probability that the suspected web page comprises each of one or more candidate known phishing web pages from the database of known phishing web pages;
a phishing page selection module to select a known phishing web page from the one or more candidate known phishing web pages, based on having a highest probability, among the one or more candidate known phishing web pages, that the suspected web page comprises the known phishing web page;
a probability threshold module to determine if the estimated probability of the selected phishing web page exceeds a probability threshold; and
a security action module to, responsive to exceeding the probability threshold, take a security action to prevent actuation of the web page.
10 . The network device of claim 9 , wherein the estimated probability is from a Bayesian Classifier.
11 . The network device of claim 9 , wherein the similarity index calculation is based at least in part on a Jaccard similarity coefficient.
12 . The network device of claim 9 , wherein the estimated probability is based at least in part on a Hamming distance.