Systems and methods for phishing and brand protection

Patent metadata

Field	Value
Publication number	US-10778704-B2
Application number	US-201916266984-A
Country	US
Kind code	B2
Filing date	Feb 4, 2019
Priority date	Aug 5, 2015
Publication date	Sep 15, 2020
Grant date	Sep 15, 2020

Abstract

Systems and methods for phishing and brand protection of websites via copycat detection are disclosed herein. An example apparatus includes at least one processor, a display, and memory including instructions that, when executed, cause the at least one processor to determine a first hash of a first image in a webpage and a second hash of a second image in the webpage, the second image different from the first image, the first hash different from the second hash, generate a temporary page profile associated with the webpage based on the first hash and the second hash, fuzzy match the temporary page profile to a baseline page profile, and in response to a determination that the temporary page profile does not match the baseline page profile, generate an alert to be displayed via the display to indicate that fraud has been detected for the webpage.

First claim

What is claimed is:

1. An apparatus to detect fraud in a webpage, the apparatus comprising:
at least one processor;
a display;
memory including instructions that, when executed, cause the at least one processor to:
determine a first hash of a first image in the webpage and a second hash of a second image in the webpage, the second image different from the first image, the first hash different from the second hash;
generate a temporary page profile associated with the webpage based on the first hash, the second hash, and font information captured from a style document associated with the webpage;
fuzzy match the temporary page profile to a baseline page profile;
in response to a determination that the temporary page profile does not match the baseline page profile, generate an alert to be displayed via the display to indicate that fraud has been detected for the webpage; and
initiate transmission of a report to a remote location, the report indicating that the webpage is fraudulent, the report to include the temporary page profile and the baseline page profile.

2. The apparatus of claim 1 , wherein the at least one processor is to add the webpage to a white list in response to an input from a user.

3. The apparatus of claim 1 , wherein the at least one processor is to generate the temporary page profile associated with the webpage in response to a trigger event indicating fraud associated with the webpage.

4. The apparatus of claim 1 , wherein the at least one processor is to store the temporary page profile as the baseline page profile.

5. The apparatus of claim 1 , wherein the at least one processor is to fuzzy match the temporary page profile to the baseline page profile based on a MinHash matching algorithm.

6. The apparatus of claim 1 , wherein the at least one processor is to retrieve the baseline page profile from the memory.

7. The apparatus of claim 1 , wherein the processor is further to generate the temporary page profile based on color information from the style document corresponding to the webpage.

8. The apparatus of claim 1 , wherein the processor is further to generate the temporary page profile based on geometry information of the webpage, the geometry information identified by removing superfluous items from a page source of the webpage and retaining bare layout information.

9. A storage disk or storage device comprising computer-executable instructions which, when executed by a processor, cause the processor to at least:
determine a first hash of a first image in a webpage and a second hash of a second image in the webpage, the second image different from the first image, the first hash different from the second hash;
generate a temporary page profile associated with the webpage based on the first hash, the second hash, and font information captured from a style document associated with the webpage;
fuzzy match the temporary page profile to a baseline page profile;
in response to a determination that the temporary page profile does not match the baseline page profile, generate an alert to indicate that fraud has been detected for the webpage; and
initiate transmission of a report to a remote location, the report to indicate that the webpage is fraudulent, the report to include the temporary page profile and the baseline page profile.

10. The storage disk or storage device of claim 9 , wherein the instructions, when executed, cause the processor to add the webpage to a white list in response to an input from a user.

11. The storage disk or storage device of claim 9 , wherein the instructions, when executed, cause the processor to generate the temporary page profile associated with the webpage in response to a trigger event corresponding to fraud associated with the webpage.

12. The storage disk or storage device of claim 9 , wherein the instructions, when executed, cause the processor to initiate storage of the temporary page profile as the baseline page profile.

13. The storage disk or storage device of claim 9 , wherein the instructions, when executed, cause the processor to fuzzy match the temporary page profile to the baseline page profile based on a MinHash matching algorithm.

14. The storage disk or storage device of claim 9 , wherein the instructions, when executed, cause the processor to initiate retrieval of the baseline page profile from a local memory.

15. A method to detect fraud in a webpage, the method comprising:
determine, by executing an instruction with a processor, a first hash of a first image in the webpage and a second hash of a second image in the webpage, the second image different from the first image, the first hash different from the second hash;
generating a temporary page profile associated with the webpage based on the first hash, the second hash, and font information captured from a style document associated with the webpage;
fuzzy matching, by executing an instruction with the processor, the temporary page profile to a baseline page profile;
in response to a determination that the temporary page profile does not match the baseline page profile, generating an alert to indicate that fraud has been detected for the webpage; and
transmitting a report to a remote location, the report to indicate that the webpage is fraudulent, the report to include the temporary page profile and the baseline page profile.

16. The method of claim 15 , further including adding the webpage to a white list in response to an input from a user.

17. The method of claim 15 , further including generating the temporary page profile associated with the webpage in response to a trigger event corresponding to fraud associated with the webpage.

18. The method of claim 15 , further including initiating storage of the temporary page profile as the baseline page profile.

19. The method of claim 15 , wherein the fuzzy matching of the temporary page profile to the baseline page profile includes invoking a MinHash matching algorithm.

Assignees

• Mcafee Llc

Inventors

• Hunt Simon
• Sambandam Venkata Ramanan

Classifications

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• G06F2221/2119

  Authenticating web pages, e.g. with suspicious links · CPC title

• G06F21/645

  using a third party · CPC title