Detection of user interface imitation

Patent metadata

Field	Value
Publication number	US-12452302-B2
Application number	US-202318138115-A
Country	US
Kind code	B2
Filing date	Apr 23, 2023
Priority date	Apr 3, 2020
Publication date	Oct 21, 2025
Grant date	Oct 21, 2025

Abstract

A server computer system receives a set of Internet domain names and generates screenshots for user interfaces associated with the set of Internet domain names. The server computer system then trains machine learning modules that are customized for the set of Internet domain names using the screenshots. The server then transmits the machine learning modules to the computing device, where the machine learning modules are usable by an application executing on the computing device to identify whether a user interface accessed by the device matches a user interface associated with the set of Internet domain names. Such techniques may advantageously allow servers to identify whether user interfaces are suspicious without introducing latency and increased page load times.

First claim

What is claimed is:

1. A method, comprising:
accessing, by a server computer system, a plurality of domain names;
capturing, by the server computer system, a first set of screenshots for user interfaces associated with a first domain name of the plurality of domain names and a second set of screenshots for user interfaces associated with a second, different domain name of the plurality of domain names;
training, by the server computer system, a first machine learning module that is customized for the first domain name using the first set of screenshots and a second machine learning module that is customized for the second, different domain name using the second set of screenshots to identify whether user interfaces accessed by a computing device match a user interface associated with one of the first and second domain names; and
transmitting, by the server computer system to the computing device, at least one of the first and second machine learning modules, wherein the at least one transmitted machine learning module is executable by an application executing on the computing device.

2. The method of claim 1 , wherein training the first machine learning module includes:
determining, based on the screenshots, a plurality of attributes of the user interfaces associated with the first domain name, wherein the plurality of attributes include one or more of: input attributes, location attributes, and style attributes; and
inputting the plurality of attributes into the first machine learning module during training.

3. The method of claim 1 , wherein the capturing includes:
identifying, based on program code of user interfaces associated with domain names included in the plurality of domain names, one or more user interfaces that include requests for personal information of a user of the computing device; and
capturing screenshots of user interfaces that include requests for personal information.

4. The method of claim 1 , wherein the server computer system trains a plurality of machine learning modules based on the plurality of domain names including multiple domain names.

5. The method of claim 1 , further comprising:
receiving, from the computing device, a report indicating suspiciousness of a user interface accessed by the computing device, wherein the report includes at least geolocation information of the computing device and a screenshot of the user interface accessed by the computing device.

6. The method of claim 1 , wherein the first machine learning module includes a support vector machine and the second machine learning module includes a random forest regression model.

7. An apparatus, comprising:
one or more processors; and
one or more memory comprising storage elements having program instructions stored thereon that are executable by the one or more processors to:
access two or more previously received Internet domain names;
obtain a first set of images of user interfaces associated with a first domain name of the two or more previously received Internet domain names and a second set of images of user interfaces associated with a second, different domain name of the two or more previously received Internet domain names;
train a first machine learning module that is customized for the first domain name using the first set of images and a second machine learning module that is customized for the second, different domain name using the second set of images to identify whether user interfaces accessed by a computing device match a user interface associated with one of the first and second domain names; and
transmit, to the computing device, the first and second machine learning modules, wherein the first and second machine learning modules are configured to be used by an application at the computing device.

8. The apparatus of claim 7 , wherein, in response to identifying that a user interface accessed by the computing device matches a user interface associated with the two or more previously received Internet domain names, the application is executable to verify an address used by the computing device to access the user interface, wherein the computing device accesses the user interface via a web browser, and wherein the user interface accessed by the computing device is a webpage.

9. The apparatus of claim 8 , wherein the application is a browser plugin configured to download one or more machine learning modules from the apparatus, and wherein the address is a uniform resource locator (URL) that is usable by the web browser to display the webpage.

10. The apparatus of claim 7 , wherein training the second machine learning module includes:
determining, based on the second set of images, a plurality of attributes of the user interfaces associated with the second, different domain name, wherein the plurality of attributes include one or more of: input attributes, location attributes, and style attributes; and
inputting the plurality of attributes into the second machine learning module during training.

11. The apparatus of claim 7 , wherein obtaining the first and second sets of images includes:
accessing authentic user interfaces for the two or more previously received Internet domain names; and
capturing images of the accessed authentic user interfaces.

12. The apparatus of claim 7 , wherein obtaining the first and second sets of images includes receiving the first set of images and the second set of images from one or more entities corresponding to the first domain name and the second, different domain name.

13. The apparatus of claim 7 , wherein the first and second machine learning modules include machine learning classifiers.

14. The apparatus of claim 7 , wherein, in response to identifying that a user interface accessed by the computing device matches a user interface associated with the two or more previously received Internet domain names, the application at the computing device is executable to verify an address used by the computing device to access the user interface, wherein the computing device accesses the user interface via a web browser, and wherein the user interface accessed by the computing device is a webpage.

15. The apparatus of claim 14 , wherein the application is a browser plugin module installed on the computing device that is executable to download one or more machine learning modules from the apparatus, and wherein the address is a uniform resource locator (URL) that is usable by the web browser to display the webpage.

16. A non-transitory computer-readable medium having instructions stored thereon that are executable by a server computer system to perform operations comprising:
accessing a first domain name and a second, different domain name;
accessing a first set of renderings for user interfaces associated with the first domain name and a second set of renderings for user interfaces associated with the second, different domain name;
training a first machine learning model that is customized for the first domain name using the first set of renderings and a second machine learning model that is customized for the second, different domain name using the second set of renderings to identify whether user interfaces accessed by a computing device match a user interface associated with one of the first and second domain names; and
transmitting, to the computing device, at least one of the first and second machine learning models, wherein the at least one transmitted machine learning model is usable by the computing device to determine whether a user interface accessed by the computing device is anomalous.

17. The non-transito

Assignees

• Paypal Inc

Inventors

• Yadav Meethil Vijay
• Nunes Eric

Classifications

• G06N20/00

  Machine learning · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• G06F16/955

  using information identifiers, e.g. uniform resource locators [URL] · CPC title

• G06N5/01

  Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound · CPC title

• G06N20/10

  using kernel methods, e.g. support vector machines [SVM] · CPC title