Detection of user interface imitation

Patent metadata

Field	Value
Publication number	US-11637863-B2
Application number	US-202016839553-A
Country	US
Kind code	B2
Filing date	Apr 3, 2020
Priority date	Apr 3, 2020
Publication date	Apr 25, 2023
Grant date	Apr 25, 2023

Abstract

Techniques are disclosed relating to generating trained machine learning modules to identify whether user interfaces accessed by a computing device match user interfaces associated with a set of Internet domain names. A server computer system receives a set of Internet domain names and generates screenshots for user interfaces associated with the set of Internet domain names. The server computer system then trains machine learning modules that are customized for the set of Internet domain names using the screenshots. The server then transmits the machine learning modules to the computing device, where the machine learning modules are usable by an application executing on the computing device to identify whether a user interface accessed by the device matches a user interface associated with the set of Internet domain names. Such techniques may advantageously allow servers to identify whether user interfaces are suspicious without introducing latency and increased page load times.

First claim

What is claimed is:

1. A method for reducing latency of user interface suspiciousness determination operations relative to suspiciousness determination operations performed externally to computing devices, comprising:
capturing, by a plugin executing on a computing device of the computing devices, a current screenshot of a user interface that is requested for display by a user of the computing device of the computing devices; and
providing the current screenshot of the user interface to at least one of a plurality of machine learning modules within the plugin, wherein the plurality of machine learning modules are trained at a server computer system using customized sets of screenshots of different authentic user interfaces generated based on a set of Internet domain names that are generated based on information stored in a browser account manager of the computing device of the requesting user;
in response to the at least one machine learning module indicating that the user interface matches a particular one of the authentic user interfaces:
verifying a uniform resource locator (URL) of the user interface; and
determining, by the plugin locally to the computing device, whether the user interface is suspicious.

2. The method of claim 1 , wherein the plurality of machine learning modules are trained at the server computer system using the customized sets of screenshots of different authentic user interfaces by:
determining, based on screenshots in one of the customized sets of screenshots of authentic user interfaces, a plurality of attributes of the authentic user interfaces associated with a first Internet domain name, wherein the plurality of attributes include one or more of: input attributes, location attributes, and style attributes; and
inputting the determined plurality of attributes to a first machine learning module during training.

3. The method of claim 1 , wherein the capturing of the current screenshot is performed in response to identifying that the user interface requested for display includes a request for personal information of the user of the computing device.

4. The method of claim 1 , further comprising:
performing a set of training operations that comprise:
transmitting a set of Internet domain names to a training server that is configured to:
access authentic user interfaces for the set of Internet domain names; and
use screenshots of the accessed authentic user interfaces to train a machine learning module.

5. The method of claim 4 , wherein performing the set of training operations further comprises:
receiving the trained machine learning module from the training server.

6. The method of claim 1 , wherein the verifying includes:
determining whether a uniform resource locator (URL) of the user interface requested for display and a URL of the particular authentic user interface are the same.

7. The method of claim 6 , wherein the verifying further includes:
in response to determining that the URL of the user interface requested for display and the URL of the particular authentic user interface are not the same, determining that the user interface requested for display is suspicious.

8. The method of claim 1 , wherein the set of training operations further comprises:
generating, based on the determining, a report for the user interface requested for display, wherein the report includes at least the current screenshot and the URL of the user interface.

9. An apparatus, comprising:
one or more processors; and
one or more memory comprising storage elements having program instructions stored thereon that are executable by the one or more processors to:
capture a current screenshot of a user interface that is requested for display by a user of the apparatus; and
provide the current screenshot of the user interface to at least one of a plurality of machine learning modules within an application executed locally by the apparatus, wherein the plurality of machine learning modules are trained at a server computer system using customized sets of screenshots of different authentic user interfaces generated based on Internet domain names that are determined based on information stored in a browser account manager of the apparatus;
in response to the at least one machine learning module indicating that the user interface matches a particular one of the authentic user interfaces:
verify a uniform resource locator (URL) of the user interface; and
determine whether the user interface is suspicious, wherein the determining reduces latency relative to suspiciousness determinations performed by another device and accessible to the apparatus.

10. The apparatus of claim 9 , wherein the capturing of the current screenshot is performed in response to identifying that the user interface requested for display includes a request for personal information of a user of the apparatus.

11. The apparatus of claim 10 , wherein the instructions are further executable by the one or more processors to perform a set of training operations that comprise:
transmitting a set of Internet domain names to a training server that is configured to:
access authentic user interfaces for the set of Internet domain names; and
use screenshots of the accessed authentic user interfaces to train a machine learning module.

12. The apparatus of claim 11 , wherein performing the set of training operations further comprises:
receiving the trained machine learning module from the training server.

13. The apparatus of claim 9 , wherein the verifying includes: determining whether a uniform resource locator (URL) of the user interface requested for display and a URL of the particular authentic user interface are the same.

14. A non-transitory computer-readable medium having instructions stored thereon that are executable by a plugin of a browser of a computing device to reduce latency relative to suspiciousness determinations performed externally to the computing device by performing a set of security operations comprising:
capturing a current screenshot of a user interface that is requested for display by a user of the computing device; and
providing the current screenshot of the user interface to at least one of a plurality of machine learning modules within the plugin, wherein the plurality of machine learning modules are trained at a server computer system using customized sets of screenshots of different authentic user interfaces generated based on Internet domain names stored in a browser account manager of the computing device;
in response to the at least one machine learning module indicating that the user interface matches a particular one of the authentic user interfaces:
verifying a uniform resource locator (URL) of the user interface; and
determining at the computing device whether the user interface is suspicious.

15. The non-transitory computer-readable medium of claim 14 , wherein the capturing of the current screenshot is performed in response to identifying that the user interface requested for display includes a request for personal information of the user of the computing device.

16. The non-transitory computer-readable medium of claim 15 , wherein the instructions are further executable by the plugin to perform a set of training operations that comprise:
transmitting a set of Internet domain names to a training server that is configured to:
access authentic user interfaces for the set of Internet domain names; and
use screenshots of the accessed authentic user interfaces to train a machine learning module.

17. The non-transitory computer-reada

Assignees

• Paypal Inc

Inventors

• Yadav Meethil Vijay
• Nunes Eric

Classifications

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1483 Primary

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• G06F16/955

  using information identifiers, e.g. uniform resource locators [URL] · CPC title

• G06N5/01

  Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound · CPC title

• G06N20/10

  using kernel methods, e.g. support vector machines [SVM] · CPC title