Patent Publication Number: US-2021176275-A1

Title: System and method for page impersonation detection in phishing attacks

Description:
FIELD 
     This disclosure relates generally to computer security and, more particularly, to an application programming interface for use with computer security systems and methods to detect and reduce security threats presented through phishing attempts. 
     BACKGROUND 
     In the recent years, hackers create fake login pages and they register similar domain names for websites they are trying to impersonate. The hackers then send phishing URLs to unsuspecting victims via an e-mail message. Currently there is no solution to detect these fake page impersonations and fake login pages. 
     As can be seen, there is a need for an application programming interface for use with a system and method that automatically detect phishing URLs that are leveraged through page impersonation attacks. 
     SUMMARY 
     In one aspect of the present invention, a system for detecting page impersonation in phishing attacks is disclosed. The system includes an application programming interface (API) comprising machine-readable program code for causing, when executed, a computer to perform a series of process steps. The steps include automatically analyzing the body of an e-mail message to detect an embedded universal resource locator (URL). The embedded URL is automatically extracted and a screenshot of a website referenced by the embedded URL is captured. The captured screenshot is compared with a record screenshot without any preprocessing of the captured screenshot, wherein the record screenshot corresponds to a trusted site. If the captured screenshot does not match the record screenshot, the embedded URL marked as safe. 
     If the captured screenshot matches the record screenshot, the system then determines if a domain of the embedded URL corresponds to a trusted domain. If the domain of the embedded URL corresponds to the trusted domain, the embedded URL is marked as safe. If the domain of the embedded URL does not correspond to the trusted domain, the e-mail message is marked as a page impersonation attempt. 
     The system may also include a page impersonation database storing data associated with the trusted site. The trusted site data includes: a trusted URL, a trusted domain corresponding to the trusted URL, and the record screenshot. The system may also receive a URL designating a contributed site from a user and the contributed site is stored in the page impersonation database. The system may then automatically capture a screenshot of the contributed site and store the screenshot for the contributed site in the page impersonation database. 
     Other aspects of the invention include a method for an application programming interface (API) to detect a page impersonation phishing attempt presented by an e-mail message. The method includes automatically analyzing the body of an e-mail message to extract an embedded universal resource locator (URL). A screenshot of a website referenced by the embedded URL is automatically captured. The captured screenshot is then compared with a record screenshot without any preprocessing of the captured screenshot, wherein the record screenshot corresponds with a trusted site. 
     If the captured screenshot does not match the record screenshot, the embedded URL is marked as safe. If the captured screenshot matches the record screenshot, the method determines if a domain of the embedded URL corresponds to a trusted domain associated with the trusted site. 
     If the domain of the embedded URL corresponds to the trusted domain, the embedded URL is marked as safe. If the domain of the embedded URL does not correspond to the trusted domain, the e-mail message is marked as a page impersonation attempt. 
     In embodiments of the invention, one or more trusted sites are stored in a page impersonation database. The stored trusted site includes a trusted URL, a trusted domain corresponding to the trusted URL, and the record screenshot. The method may also include receiving a URL designating a contributed site from a user and storing the contributed site in the page impersonation database. 
     The method may then automatically capture a screenshot of the contributed site and store the screenshot for the contributed site in the page impersonation database. 
     Yet other aspects of the invention include a non-transitory computer-readable memory having an application programming interface (API) stored therein which directs a computer to perform process steps which detect page impersonation phishing attacks. The process steps include automatically analyzing the body of an e-mail message to extract an embedded universal resource locator (URL), automatically capturing a screenshot of a website referenced by the embedded URL, and automatically comparing the captured screenshot with a record screenshot without any preprocessing of the captured screenshot, wherein the record screenshot corresponds with a trusted site. 
     If the captured screenshot does not match the record screenshot, the embedded URL is marked as safe. However, if the captured screenshot matches the record screenshot, the method includes determining if a domain of the embedded URL corresponds to a trusted domain associated with the trusted site. 
     If the domain of the embedded URL corresponds to the trusted domain, the embedded URL is marked as safe. If the domain of the embedded URL does not correspond to the trusted domain, the e-mail message is marked as a page impersonation attempt. 
     Other aspects of the method include storing one or more trusted site in a page impersonation database, wherein the trusted site includes a trusted URL, a trusted domain corresponding to the trusted URL, and the record screenshot. The method may also include receiving a URL designating a contributed site from a user. A screenshot of the contributed site and the screenshot of the contributed site may be automatically stored in the page impersonation database. 
     These and other features, aspects and advantages of the present invention will become better understood with reference to the following drawings, description and claims. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       The following detailed description, given by way of example and not intended to limit the present disclosure solely thereto, will best be understood in conjunction with the accompanying drawings in which: 
         FIG. 1  is a schematic view of the protected list population according to an aspect of the present disclosure; 
         FIG. 2  is a schematic view of a typical analysis process according to an aspect of the present disclosure; and 
         FIG. 3  is a flow chart of the operation of the system and method of the present disclosure. 
     
    
    
     DETAILED DESCRIPTION 
     In the present disclosure, like reference numbers refer to like elements throughout the drawings, which illustrate various exemplary embodiments of the present disclosure. 
     The following detailed description is of the best currently contemplated modes of carrying out exemplary embodiments of the invention. The description is not to be taken in a limiting sense, but is made merely for the purpose of illustrating the general principles of the invention, since the scope of the invention is best defined by the appended claims. 
     Broadly, an embodiment of the present invention provides an application programming interface (API) for a system and method that detects page impersonation in phishing attacks. 
     As seen in reference to  FIG. 1 , aspects of the invention include a security software  10 , which may be included in a gateway appliance, as a plugin, or other application such as an application programming interface (API). The system includes a list of URLs for a plurality of trusted sites  16  and their respective domains that are to be protected, which are stored in a database  14 . The system captures a record screenshot  24  (shown in  FIG. 2 ) of the trusted sites  16  and services in advance, which is stored with the trusted list  16  in the database  14 . 
     As seen in reference to  FIGS. 2 and 3 , the security software application  10  is installed and configured to analyze an e-mail  20  that is received by an e-mail client for a user  12  (step  40  in  FIG. 3 ). 
     As shown by step  42  in  FIG. 3 , a user  12  may also add URLs for services and websites to the protected list, as contributed sites  18 . The security software application  10  is configured to then capture a record screenshot of the user contributed sites  18 . As shown by step  44  in  FIG. 3 , screenshots of sites on the trusted list are periodically updated to ensure they are current. 
     When the user  12  opens an e-mail in an e-mail client linked to the security software application  10 , the e-mail is analyzed to detect the presence of one or more embedded URLs  22  within the body of the e-mail (step  46  in  FIG. 3 ). The security software application  10  extracts the embedded URLs  22  from the e-mail for image impersonation processing (step  46  in  FIG. 3 ). 
     An image impersonation analysis engine  28  that is part of the security software application  10  captures a screenshot of the site that is linked by the embedded URL  22  (step  48  in  FIG. 3 ). 
     The image impersonation analysis engine  28  compares the captured screenshot  26  with the record screenshot  24  (steps  50  and  52  in  FIG. 3 ). The captured screenshot  26  may be compared with the record screenshot  24  without any preprocessing of the captured screenshot. If the captured screenshot  26  is different from a record screenshot  24 , the URL is marked as safe (step  58  in  FIG. 3 ). If the captured screenshot  26  is the same as a record screenshot  24 , the extracted URL  22  is then compared to determine if its domain is referencing a protected domain (step  54 ). If the domain of the extracted URL  22  is not from a protected site  16 , the e-mail  20  is blocked, or otherwise marked as a phishing attempt  32  (step  56  in  FIG. 3 ). If the domain of the extracted URL  22  is the same as the corresponding domain for the matched record screenshot  24 , the extracted URL  22  is marked as a safe e-mail  30  (step  58  in  FIG. 3 ). 
     The system then determines whether there are additional extracted URLs  22  to process (step  60  in  FIG. 3 ). If there are additional extracted URLs to process, the analysis process is repeated for each URL. If there are no additional extracted URLs  22  to process, the image impersonation analysis engine  28  marks the e-mail as approved (step  62  in  FIG. 3 ). 
     The system of the present invention may operate on at least one computer with a user interface. The computer may include any computer including, but not limited to, a desktop, laptop, and smart device, such as, a tablet and smart phone. The computer includes a program product (e.g., an API) including a machine-readable program code for causing, when executed, the computer to perform steps. The program product may include software which may either be loaded onto the computer or accessed by the computer. The loaded software may include an application on a smart device. The software may be accessed by the computer using a web browser. The computer may access the software via the web browser using the internet, extranet, intranet, host server, internet cloud and the like. 
     The computer-based data processing system and method described above is for purposes of example only, and may be implemented in any type of computer system or programming or processing environment, or in a computer program, alone or in conjunction with hardware. The present invention may also be implemented in software stored on a non-transitory computer-readable medium and executed as a computer program on a general purpose or special purpose computer. For clarity, only those aspects of the system germane to the invention are described, and product details well known in the art are omitted. For the same reason, the computer hardware is not described in further detail. It should thus be understood that the invention is not limited to any specific computer language, program, or computer. It is further contemplated that the present invention may be run on a stand-alone computer system, or may be run from a server computer system that can be accessed by a plurality of client computer systems interconnected over an intranet network, or that is accessible to clients over the Internet. In addition, many embodiments of the present invention have application to a wide range of industries. To the extent the present application discloses a system, the method implemented by that system, as well as software stored on a computer-readable medium and executed as a computer program to perform the method on a general purpose or special purpose computer, are within the scope of the present invention. Further, to the extent the present application discloses a method, a system of apparatuses configured to implement the method are within the scope of the present invention. 
     Although the present disclosure has been particularly shown and described with reference to the preferred embodiments and various aspects thereof, it will be appreciated by those of ordinary skill in the art that various changes and modifications may be made without departing from the spirit and scope of the disclosure. It is intended that the appended claims be interpreted as including the embodiments described herein, the alternatives mentioned above, and all equivalents thereto.