Detection of site phishing using neural network-enabled site image analysis leveraging few-shot learning

Patent metadata

Field	Value
Publication number	US-12323461-B2
Application number	US-202318135778-A
Country	US
Kind code	B2
Filing date	Apr 18, 2023
Priority date	Apr 18, 2023
Publication date	Jun 3, 2025
Grant date	Jun 3, 2025

Abstract

Website phishing detection is enabled using a siamese neural network. One twin receives a query image associated with a website page. The other twin receives a subset of a set of reference website images together with positive (phishing) examples that were used to train the networks, the subset of reference website images having been determined by applying an identifier associated with a brand of interest. The operation of applying the identifier significantly reduces the relevant search space for the inferencing task. If the inferencing determines a sufficient likelihood that the website page is a phishing page, control signaling is generated to control a system to take a given mitigation action n.

First claim

What I claim is as follows:

1. A method of protecting an online system from a phishing attack, comprising:
receiving a query image associated with a website page;
receiving a dataset representing a set of reference website images against which the query image is to be applied;
applying an identifier to the dataset to identify a subset of reference website images against which the query image is to be applied, wherein the identifier is a brand associated to the website page;
applying the query image to a first instance of a neural network, and applying the subset of reference website images to a second instance of the neural network, the neural network generating an output that indicates a likelihood that the website page is a phishing page; and
upon a determination that that the website page is a phishing page, generating signaling information to cause a control system to take a given mitigation action with respect to the website page.

2. The method as described in claim 1 wherein the first and second instances comprise a siamese neural network having attention layers.

3. The method as described in claim 1 wherein the first and second instances of the neural network have identical structure and weight parameters.

4. The method as described in claim 1 wherein each instance of the neural network comprises a convolutional block attention module that uses spatial- and channel-features of inputs for inferencing.

5. The method as described in claim 1 wherein the dataset representing the set of reference website pages comprises a bank of anchors associated with a set of active brands against which phishing protection is being applied.

6. The method as described in claim 5 wherein the bank of anchors comprises one or more brands and, for each brand, a set of one or more anchors, wherein each anchor in the set of anchors corresponds to a screenshot of a reference website page.

7. The method as described in claim 1 further including few-shot learning-based training the neural network against a set of training data comprising the set of reference website images and a set of associated positive phishing examples.

8. The method as described in claim 7 wherein, for a given website image, the training generates an embedding into a feature space such that a squared distance between all website images of a website of a same brand is small, and wherein a squared distance between a pair of website images from websites of different brands is large.

9. The method as described in claim 8 wherein the training uses a triplet loss function.

10. The method as described in claim 9 wherein the triplet loss function guarantees that a website image of the same brand is closer to all other website images of the same brand than to any website image of at least one other brand.

11. The method as described in claim 7 wherein a fit quality of the neural network with respect to the set of training data is monitored using a gradient disparity metric.

12. The method as described in claim 1 wherein the query image is received in response to occurrence of a security event at a server.

13. The method as described in claim 12 further including:
responsive to the security event, fetching the website page; and
generating a screenshot of the fetched website page.

14. The method as described in claim 1 wherein the website page is associated with a content provider that uses a content delivery network (CDN), and wherein the identifier is received from a CDN data feed.

15. An apparatus for protecting an online system from a phishing attack, comprising:
one or more hardware processors; and
computer memory holding computer program code executed by the one or more hardware processors and configured to:
receive a query image associated with a website page;
receive a dataset representing a set of reference website images against which the query image is to be applied;
apply an identifier to the dataset to identify a subset of reference website images against which the query image is to be applied, wherein the identifier is a brand associated to the website page;
apply the query image to a first instance of a neural network, and applying the subset of reference website images to a second instance of the neural network, the neural network generating an output that indicates a likelihood that the website page is a phishing page; and
upon a determination that the website page is a phishing page, generate signaling information to cause a control system to take a given mitigation action with respect to the website page.

16. The apparatus as described in claim 15 wherein the first and second instances of the neural network comprise a siamese neural network having attention layers.

17. The apparatus as described in claim 16 wherein the first and second instances of the neural network have identical structure and weight parameters.

18. The apparatus as described in claim 15 wherein each instance of the neural network comprises a convolutional block attention module configured to use spatial- and channel-features of inputs for inferencing.

19. The apparatus as described in claim 16 wherein the computer program code is further configured to train the neural network against a set of training data using few-shot learning, the set of training data comprising the set of reference website images and a set of associated positive phishing examples.

20. The apparatus as described in claim 19 wherein, for a given website image, the computer program code generates an embedding into a feature space such that a squared distance between all website images of a website of a same brand is small, and wherein a squared distance between a pair of website images from websites of different brands is large.

21. A computer program product comprising a non-transitory computer readable medium, the computer readable medium comprising computer program code configured to execute in one or more hardware processors to protect an online system from a phishing attack, the computer program code configured to:
receive a query image associated with a website page;
receive a dataset representing a set of reference website images against which the query image is to be applied;
apply an identifier to the dataset to identify a subset of reference website images against which the query image is to be applied, wherein the identifier is a brand associated to the website page;
apply the query image to a first instance of a neural network, and applying the subset of reference website images to a second instance of the neural network;
generate an output that indicates a likelihood that the website page is a phishing page; and
upon a determination that that the website page is a phishing page, generate signaling information to cause a control system to take a given mitigation action with respect to the website page.

22. A method of protecting an online system from a phishing attack, comprising:
few-shot learning-based training a neural network using a set of training data comprising screenshots of reference website pages together with a set of associated positive phishing examples;
during training, monitoring a fit quality of the neural network with respect to the training data using a gradient disparity metric;
following training of the neural network:
receiving a query screenshot associated with a website page; and
applying the query screenshot to a first instance of the neural network, and applying at least some of the screenshots of the

Assignees

• Akamai Tech Inc

Inventors

• Costa Nadav George

Classifications

• G06V10/82 Primary

  using neural networks · CPC title

• H04L63/1483 Primary

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title