Patent Description:
In recent years, phishing websites disguised as legitimate websites have been used to convince Internet users to unknowingly divulge personal information (e.g., bank account numbers, social security number, etc.). Detection and/or blocking of such phishing websites can protect Internet users from privacy breaches. However, phishing websites can be difficult to detect because they often appear very similar or identical to a known legitimate website. Documents <CIT> and <CIT> constitute relevant prior art.

The figures are not to scale. Instead, the thickness of the layers or regions may be enlarged in the drawings. In general, the same reference numbers will be used throughout the drawing(s) and accompanying written description to refer to the same or like parts. Connection references (e.g., attached, coupled, connected, and joined) are to be construed broadly and may include intermediate members between a collection of elements and relative movement between elements unless otherwise indicated. As such, connection references do not necessarily infer that two elements are directly connected and in fixed relation to each other.

A website typically includes an icon (e.g., a favicon, a shortcut icon, a website icon) associated with the website. The icon is used to identify the website to an Internet user. Typically, the icon of a website is referenced in a HyperText Markup Language (HTML) code of the website. In some examples, such reference may be omitted, causing a browser (or another application) to attempt to utilize an icon at a default and/or otherwise standardized location. As used herein, a phishing website is defined to be an illegitimate website that attempts to solicit information from a user while masquerading as a corresponding legitimate site. A phishing website sometimes re-uses the icon of the corresponding legitimate website (e.g., clean website) for use on the phishing website to make the phishing website seem legitimate to the Internet user. In such cases, the phishing website can reference the icon to a domain of the legitimate website in the HTML code of the phishing website. The use of the icon by the phishing website can trick the user into believing that the phishing website is the legitimate website.

Examples disclosed herein can be used to detect whether a website visited by an Internet user is a phishing website or a legitimate website. Further, examples disclosed herein enable phishing detection by determining whether an icon (e.g., a favicon, a shortcut icon, a website icon) of a website is legitimate. In particular, examples disclosed herein determine whether the icon is referenced to a different domain than a domain of the website and, in response to determining that the icon is referenced to a different domain, identify the website as a phishing website. Additionally or alternatively, examples disclosed herein generate a hash of the icon and compare the hash to a database, where the database stores icon hash entries corresponding to known legitimate websites. In response to determining that the hash matches an icon hash entry corresponding to a known legitimate website, examples disclosed herein identify the website as a phishing website. Further, in response to identifying the website as a phishing website, examples disclosed herein can notify the user that the website is a phishing website and/or can block the user from accessing the website.

<FIG> illustrates an example phishing detection controller <NUM> in accordance with the teachings of this disclosure implemented in an example environment <NUM>. The example environment <NUM> includes the phishing detection controller <NUM>, an example user device <NUM>, an example browser <NUM>, an example network <NUM>, an example clean website <NUM>, an example phishing website A <NUM>, an example phishing website B <NUM>, and an example central server <NUM>. The example central server <NUM> includes an example icon hash database controller <NUM> and an example icon hash database <NUM>. The example clean website <NUM> includes an example clean website icon <NUM>. The example phishing website A <NUM> includes an example clean website icon A <NUM>, associated with an example clean website domain <NUM>. The example phishing website B <NUM> includes an example clean website icon B <NUM>, associated with an example phishing website B domain <NUM>.

In the illustrated example of <FIG>, the example user device <NUM> is operated by a user to access one or more websites (e.g., the clean website <NUM>, the phishing website A <NUM>, and/or the phishing website B <NUM>) via the network <NUM>. The user device <NUM> is in communication with the network <NUM> (e.g., the Internet) via a network interface (e.g., an Ethernet Interface). In the illustrated example of <FIG>, the user device <NUM> is implemented as a laptop computer. However, in other examples, the user device <NUM> may be implemented by any other past, present, or future type of computing device, such as a desktop computer, a mobile device, a tablet, a mobile phone, etc..

In the illustrated example of <FIG>, the browser (e.g., web browser) <NUM> is implemented using executable instructions executed by one or more processors of the user device <NUM>. The example browser <NUM> provides an interface (e.g., via a display of the user device <NUM>) by which a user can access a website via the network <NUM>. The browser <NUM> receives requests from the user device <NUM> to access one or more websites on the network <NUM>. The browser <NUM> displays the one or more websites on the user device <NUM>. In examples disclosed herein, the phishing detection controller <NUM> is implemented as a browser extension to interface with the browser <NUM>. However, the phishing detection controller <NUM> may be implemented in any other past, present, or future fashion. In some examples, the phishing detection controller <NUM> can be implemented on the user device <NUM> as an antivirus package, the phishing detection controller <NUM> may be implemented as a standalone program, the phishing detection controller <NUM> may be implemented as a plug-in, etc..

In the illustrated example of <FIG>, the clean website (e.g., legitimate website) <NUM> is accessible via the browser <NUM>. The clean website <NUM> is a website identified by the icon hash database controller <NUM> to be legitimate (e.g., not used for phishing). The clean website includes the clean website icon <NUM>, which is hosted at a domain of the clean website.

In the illustrated example of <FIG>, the phishing website A <NUM> is a first phishing website of the example environment <NUM>. The phishing website A <NUM> is disguised as and/or copies the appearance of the clean website <NUM> to convince the user, in response to the user visiting the phishing website A <NUM>, that the phishing website A <NUM> is the clean website <NUM>. The phishing website A <NUM> includes the clean website icon A <NUM>, where the clean website icon A <NUM> is the same icon as the clean website icon <NUM> of the clean website <NUM>. In the illustrated example, the clean website <NUM> is associated with a first website domain (e.g., www. com, the clean website domain <NUM>) and the phishing website A <NUM> is associated with a second website domain (e.g., www. However, both the clean website icon <NUM> and the clean website icon A <NUM> are hosted at the www. com domain (e.g., the first website domain, the clean website domain <NUM>).

In the illustrated example of <FIG>, the phishing website B <NUM> is a second phishing website of the example environment <NUM>. The phishing website B <NUM> is disguised as and/or copies the appearance of the clean website <NUM> to convince the user, in response to the user visiting the phishing website B <NUM>, that the phishing website B <NUM> is the clean website <NUM>. The phishing website B <NUM> includes the clean website icon B <NUM>, where the clean website icon B <NUM> is the same icon as the clean website icon <NUM> of the clean website <NUM>. In the illustrated example, the phishing website B <NUM> is associated with a third website domain (e.g., www. com, the phishing website B domain <NUM>). In the illustrated example, the clean website icon B <NUM> is hosted at the www. com domain (e.g., the third website domain, the phishing website B domain <NUM>) instead of the www. com domain.

In the illustrated example of <FIG>, the central server <NUM> communicates via the network <NUM> to the user device <NUM>. In the illustrated example of <FIG>, the central server <NUM> includes the icon hash database controller <NUM> and/or the icon hash database <NUM>. The example icon hash database controller <NUM> is to generate and/or update the icon hash database <NUM>. In some examples, the icon hash database controller <NUM> and/or the icon hash database <NUM> can be stored in a different location from the central server <NUM>. In some examples, the central server <NUM> allows the user device <NUM> to access the icon hash database <NUM> via the network <NUM>.

In the illustrated example of <FIG>, the example icon hash database controller <NUM> generates one or more hash entries to be stored in the icon hash database <NUM>. The example icon hash database controller <NUM> generates each of the one or more hash entries based on a respective known legitimate website, such as the clean website <NUM>. In some examples, the icon hash database controller <NUM> is configured to continuously and/or periodically update the icon hash database <NUM>. The icon hash database controller updates the icon hash database <NUM> by updating the stored information of the existing hash entries and/or generating new hash entries based on new known legitimate websites.

In the illustrated example of <FIG>, the icon hash database <NUM> stores one or more hash entries generated by the icon hash database controller <NUM>. In the illustrated example of <FIG>, each of the one or more hash entries corresponds to a known legitimate website. In some examples, each hash entry includes at least one of an icon hash corresponding to the known legitimate website and/or a URL (or a portion thereof, such as, for example, a domain name) corresponding to a known legitimate website. In the illustrated example of <FIG>, the example icon hash database <NUM> is implemented by any memory, storage device and/or storage disc for storing data such as, for example, flash memory, magnetic media, optical media, solid state memory, hard drive(s), thumb drive(s), etc. Furthermore, the data stored in the example icon hash database <NUM> may be in any data format such as, for example, binary data, comma delimited data, tab delimited data, structured query language (SQL) structures, etc. While, in the illustrated example, the example icon hash database <NUM> is illustrated as a single device, the example icon hash database <NUM> and/or any other data storage devices described herein may be implemented by any number and/or type(s) of memories.

In the illustrated example of <FIG>, the example phishing detection controller <NUM> determines whether a website visited by the user device <NUM> is a phishing website or a legitimate website based on an icon of the website. In some examples, in response to the phishing detection controller <NUM> determining that the website is a phishing website, the phishing detection controller <NUM> warns the user via a message to the user device and/or blocks the user device from accessing the website.

In examples disclosed herein, the example icon hash database controller <NUM> and/or the example phishing detection controller <NUM> is/are implemented by a logic circuit such as, for example, a hardware processor. However, any other type of circuitry may additionally or alternatively be used such as, for example, one or more analog or digital circuit(s), logic circuits, programmable processor(s), application specific integrated circuit(s) (ASIC(s)), programmable logic device(s) (PLD(s)), field programmable logic device(s) (FPLD(s)), digital signal processor(s) (DSP(s)), graphics processing units (GPUs), etc..

<FIG> illustrates an example implementation of phishing detection controller <NUM> of <FIG> to determine whether a website (e.g., the phishing website B <NUM> of <FIG>) is a phishing website based on a URL of the website and an icon (e.g., the clean website icon B <NUM> of <FIG>) of the website. In the illustrated example of <FIG>, the phishing website B <NUM> further includes phishing website B HTML code <NUM>. The phishing website B HTML code <NUM> further includes a reference to the clean website icon B <NUM> of <FIG>, and a phishing website B URL <NUM> associated with the phishing website B <NUM>. In the illustrated example, the example phishing detection controller <NUM> accesses a database hash entry <NUM> from the icon hash database <NUM> of <FIG>. The database hash entry <NUM> includes a clean website icon hash <NUM>, and a clean website URL <NUM> associated with the clean website <NUM> of <FIG>.

In the illustrated example of <FIG>, the phishing website B HTML code <NUM> represents HTML code sent by the phishing website B <NUM> to the user device <NUM> of <FIG>. In response to the user device <NUM> of <FIG> visiting the phishing website B <NUM>, the phishing detection controller <NUM> retrieves the phishing website B HTML code <NUM> of the phishing website B <NUM>. In the illustrated example, the phishing detection controller <NUM> parses the phishing website B HTML code <NUM> to locate a reference to the clean website icon B <NUM> and/or the phishing website B URL <NUM>. In some examples, the phishing detection controller <NUM> downloads the clean website icon B <NUM> and generates a hash of the clean website icon B <NUM> based on a hashing algorithm implemented in the phishing detection controller <NUM>. As used herein, the hashing algorithm is a function that maps data (e.g., a website icon) to a hash value. For example, the hashing algorithm can be one of an MD5 hash function, an SHA-<NUM> hash function, a RIPEMD-<NUM> hash function, or another type of hash function.

In the illustrated example of <FIG>, the example icon hash database <NUM> includes the example database hash entry <NUM>. In the illustrated example, the database hash entry <NUM> is associated with the clean website <NUM> of <FIG>. In some examples, the database hash entry <NUM> is one hash entry of a plurality of hash entries in the icon hash database <NUM>. In some examples, an entry of the plurality of hash entries corresponds to a known legitimate website. In some examples, one or more of the hash entries correspond to a known phishing website. In such examples, the hash entries include a flag to indicate whether a website associated with a hash entry is legitimate. In the illustrated example, the database hash entry <NUM> includes the clean website icon hash <NUM> and the clean website URL <NUM> associated with the clean website <NUM>. Additionally or alternatively, the database hash entry <NUM> can include other data associated with the clean website <NUM>. Such other data may include, for example, a hash of the content of the website, a timestamp indicating the time at which the hash of the icon was computed, a flag indicating whether the hash entry corresponds to a legitimate website, etc. In the illustrated example, the clean website icon hash <NUM> is a hash of the clean website icon <NUM> of <FIG>. The icon hash database controller <NUM> of <FIG> generates the clean website icon hash <NUM> based on the hashing algorithm of the phishing detection controller <NUM>.

In the illustrated example of <FIG>, the phishing detection controller <NUM> generates the hash of the clean website icon B <NUM>. The phishing detection controller <NUM> determines whether the hash of the clean website icon B <NUM> matches an existing icon hash in the plurality of hash entries of the icon hash database <NUM>. In the illustrated example of <FIG>, the phishing detection controller <NUM> determines that the hash of the clean website icon B <NUM> matches the clean website icon hash <NUM> of the database hash entry <NUM>. In response to the phishing detection controller <NUM> determining that the hash of the clean website icon B <NUM> matches the clean website icon hash <NUM>, the phishing detection controller <NUM> retrieves the database hash entry <NUM>. In the illustrated example, the phishing detection controller <NUM> compares the phishing website B URL <NUM> to a URL of the database hash entry <NUM> corresponding to the clean website icon hash <NUM> (e.g., the clean website URL <NUM>). In response to the phishing detection controller <NUM> determining that the phishing website B URL <NUM> does not match the clean website URL <NUM>, the phishing detection controller <NUM> determines that the phishing website B <NUM> is a phishing website.

<FIG> is a block diagram of the example icon hash database controller <NUM> of <FIG> implemented to generate the plurality of hash entries of the example icon hash database <NUM> of <FIG> and <FIG>. In the illustrated example of <FIG>, the example icon hash database controller <NUM> includes an example database code parser <NUM>, an example reference detector <NUM>, an example location detector <NUM>, and an example hash generator <NUM>. In the illustrated example of <FIG>, the example icon hash database controller <NUM> retrieves HTML code from one or more known legitimate websites via the network <NUM> of <FIG>. The example icon hash database controller <NUM> generates a hash entry corresponding to each of the one or more known legitimate websites.

The example database code parser <NUM> of the illustrated example of <FIG> parses the HTML code retrieved from one of the known legitimate websites. In examples disclosed herein, the parsed HTML code includes at least one of a reference to a website icon (e.g., the clean website icon <NUM> of <FIG>) of the legitimate website or a URL (e.g., the clean website URL <NUM> of <FIG>) of the legitimate website.

The example reference detector <NUM> of the illustrated example of <FIG> retrieves the parsed HTML code from the database code parser <NUM>. The example reference detector <NUM> determines whether the parsed HTML code includes a reference to a website icon of the legitimate website. In response to the reference detector <NUM> determining that the parsed HTML code includes a reference to a website icon, the example reference detector <NUM> directs the example hash generator <NUM> to download the website icon. Alternatively, in response to the reference detector <NUM> determining that the parsed HTML code does not include a reference to a website icon, the reference detector <NUM> invokes the location detector <NUM>.

The example location detector <NUM> of the illustrated example of <FIG>, in response to the reference detector <NUM> determining that the parsed HTML code does not include a reference to a website icon, determines whether the website icon of the legitimate website is located at a standard (e.g., typical, expected) location. In response to the location detector <NUM> locating the website icon at the standard location, the location detector <NUM> directs the hash generator <NUM> to download the website icon. Alternatively, in response to the location detector <NUM> not locating the website icon at the standard location, the location detector <NUM> determines that the legitimate website does not include a website icon.

The example hash generator <NUM> of the illustrated example of <FIG> downloads the website icon of the legitimate website and generates a hash of the website icon based on the hashing algorithm of the icon hash database controller <NUM> and/or the phishing detection controller <NUM> of <FIG>. In the illustrated example, the hash generator <NUM> further generates a hash entry corresponding to the legitimate website. The hash entry includes the hash of the website icon and/or the URL of the legitimate website. In the illustrated example, the hash generator <NUM> is in communication with the icon hash database <NUM> of <FIG> and <FIG>. In response to the hash generator <NUM> generating the hash entry corresponding to the legitimate website, the hash generator <NUM> transmits the hash entry to the icon hash database <NUM> to be stored with the plurality of hash entries of the icon hash database <NUM>.

In the illustrated example of <FIG>, the example database code parser <NUM>, the example reference detector <NUM>, the example location detector <NUM>, and/or the example hash generator <NUM> is/are implemented by a logic circuit such as, for example, a hardware processor. However, any other type of circuitry may additionally or alternatively be used such as, for example, one or more analog or digital circuit(s), logic circuits, programmable processor(s), application specific integrated circuit(s) (ASIC(s)), programmable logic device(s) (PLD(s)), field programmable logic device(s) (FPLD(s)), digital signal processor(s) (DSP(s)), graphics processing units (GPUs), etc..

While an example manner of implementing the icon hash database controller <NUM> of <FIG> is illustrated in <FIG>, one or more of the elements, processes and/or devices illustrated in <FIG> may be combined, divided, re-arranged, omitted, eliminated and/or implemented in any other way. Further, the example database code parser <NUM>, the example reference detector <NUM>, the example location detector <NUM>, the example hash generator <NUM> and/or, more generally, the example icon hash database controller <NUM> of <FIG> may be implemented by hardware, software, firmware and/or any combination of hardware, software and/or firmware. Thus, for example, any of the example database code parser <NUM>, the example reference detector <NUM>, the example location detector <NUM>, the example hash generator <NUM> and/or, more generally, the example icon hash database controller <NUM> could be implemented by one or more analog or digital circuit(s), logic circuits, programmable processor(s), programmable controller(s), graphics processing unit(s) (GPU(s)), digital signal processor(s) (DSP(s)), application specific integrated circuit(s) (ASIC(s)), programmable logic device(s) (PLD(s)) and/or field programmable logic device(s) (FPLD(s)). When reading any of the apparatus or system claims of this patent to cover a purely software and/or firmware implementation, at least one of the example database code parser <NUM>, the example reference detector <NUM>, the example location detector <NUM>, and/or the example hash generator <NUM> is/are hereby expressly defined to include a non-transitory computer readable storage device or storage disk such as a memory, a digital versatile disk (DVD), a compact disk (CD), a Blu-ray disk, etc. including the software and/or firmware. Further still, the example icon hash database controller <NUM> of <FIG> may include one or more elements, processes and/or devices in addition to, or instead of, those illustrated in <FIG>, and/or may include more than one of any or all of the illustrated elements, processes and devices. As used herein, the phrase "in communication," including variations thereof, encompasses direct communication and/or indirect communication through one or more intermediary components, and does not require direct physical (e.g., wired) communication and/or constant communication, but rather additionally includes selective communication at periodic intervals, scheduled intervals, aperiodic intervals, and/or one-time events.

<FIG> is a block diagram of the example phishing detection controller <NUM> of <FIG> and/or <NUM> implemented to determine whether an unknown website visited by the user device <NUM> is a phishing website or a legitimate website. The example phishing detection controller <NUM> includes an example website detector <NUM>, an example code parser <NUM>, an example reference checker <NUM>, an example location checker <NUM>, an example icon hasher <NUM>, an example local icon hash database <NUM>, an example hash checker <NUM>, and an example alert generator <NUM>. In the illustrated example of <FIG>, a user of the user device <NUM> navigates to an unknown website (e.g., visited website, the phishing website A <NUM> of <FIG>, the phishing website B <NUM> of <FIG> and <FIG>).

The example website detector <NUM> is in communication with the browser <NUM> of <FIG> and/or a component of the browser <NUM> to detect when a user of the user device <NUM> has navigated to a website. In response to the website detector <NUM> detecting that the user device <NUM> is loading the unknown website, the example web detector <NUM> retrieves HTML code associated with the unknown website.

The example code parser <NUM> of the illustrated example of <FIG>, in response to the phishing detection controller <NUM> retrieving the HTML code of the unknown website, code parser <NUM> parses the HTML code. The parsed HTML code may include a reference to a website icon (e.g., the clean website icon A <NUM> of <FIG>, the clean website icon B <NUM> of <FIG> and <FIG>) to be used when displaying the unknown website. In some examples, the reference to the website icon may be a reference to a file (e.g., an icon file) provided by a same domain as the unknown website.

The example reference checker <NUM> in the illustrated example of <FIG> retrieves the parsed HTML code from the code parser <NUM> and determines whether the parsed HTML code includes a reference to a website icon for the unknown website. In response to the reference checker <NUM> determining that the parsed HTML code does not include a reference to a website icon, the reference checker <NUM> invokes the location checker <NUM>.

Alternatively, in response to the reference detector <NUM> determining that the parsed HTML code includes a reference to a website icon, the reference checker <NUM> determines a referenced domain of the website icon (e.g., the clean website icon A <NUM> of <FIG>). In response to the reference checker <NUM> determining that the referenced domain does not match a domain of the unknown website, the reference checker <NUM> informs the alert generator <NUM> that the unknown website is a phishing website. For example, in response to the unknown website being the phishing website A <NUM> of <FIG>, the reference checker <NUM> determines that the referenced domain (e.g., the clean website domain <NUM> of <FIG>) of the website icon (e.g., the clean website icon A) does not match the domain (e.g., a phishing website A <NUM> domain) of the unknown website. Thus, in this example, the reference checker determines that the unknown website (e.g., the phishing website A <NUM>) is a phishing website.

In another example, in response to the unknown website being the phishing website B <NUM>, the reference checker <NUM> determines that the referenced domain (e.g., the phishing website B domain <NUM> of <FIG>) matches the domain of the unknown website (e.g., the phishing website B <NUM>). In such examples, where the reference checker <NUM> determines that the referenced domain matches the domain of the unknown website, the reference checker <NUM> invokes the icon hasher <NUM>.

The example location checker <NUM> in the illustrated example of <FIG>, in response to the reference checker <NUM> determining that the parsed HTML code does not include a reference to a website icon, determines whether a website icon of the visited website is located at the standard (e.g., typical, expected) location. In response to the location checker <NUM> locating a website icon at the standard location, the location checker <NUM> invokes the icon hasher <NUM>. Alternatively, in response to the location checker <NUM> not locating a website icon at the standard location, the location detector <NUM> determines that the unknown website does not include a website icon. In such examples (e.g., where a website icon is not located), the phishing detection controller <NUM> is unable to determine whether the unknown website is a phishing website or a legitimate website.

The example icon hasher <NUM> in the illustrated example of <FIG> downloads the website icon of the unknown website and generates a hash of the website icon based on the hashing algorithm of the phishing detection controller <NUM>. In the illustrated example, the icon hasher <NUM> sends the hash of the website icon to the example hash checker <NUM>.

The example local icon hash database <NUM> of the illustrated example of <FIG> stores one or more of the hash entries from the plurality of hash entries of the icon hash database <NUM> of <FIG>, <FIG>, and <FIG>. In some examples, the example local icon hash database <NUM> enables the phishing detection controller <NUM> to determine whether the unknown website is a phishing website without the phishing detection controller <NUM> accessing the icon hash database <NUM>. In some examples, the hash entries of the local icon hash database <NUM> are initialized by the phishing detection controller <NUM> upon implementation of the phishing detection controller <NUM> on the user device <NUM> and/or the browser <NUM> of <FIG>. In such examples, the phishing detection controller <NUM> selects one or more of the hash entries of the icon hash database <NUM> and stores the downloaded hash entries in the local icon hash database <NUM>. In some examples, the selected hash entries of the local icon hash database <NUM> correspond to legitimate websites that are more likely to be the target of phishing attempts (e.g., websites for financial institutions). In some examples, the phishing detection controller <NUM> periodically updates the hash entries of the local icon hash database <NUM> by downloading new hash entries from the icon hash database <NUM>. In some examples, the phishing detection controller <NUM> updates the hash entries of the local icon hash database <NUM> in response to a command from the user device <NUM> and/or the central server <NUM> of <FIG>.

In the illustrated example of <FIG>, the example local icon hash database <NUM> is implemented by any memory, storage device and/or storage disc for storing data such as, for example, flash memory, magnetic media, optical media, solid state memory, hard drive(s), thumb drive(s), etc. Furthermore, the data stored in the example local icon hash database <NUM> may be in any data format such as, for example, binary data, comma delimited data, tab delimited data, structured query language (SQL) structures, etc. While, in the illustrated example, the example local icon hash database <NUM> is illustrated as a single device, the example local icon hash database <NUM> and/or any other data storage devices described herein may be implemented by any number and/or type(s) of memories.

The example hash checker <NUM> in the illustrated example of <FIG> determines whether the hash of the website icon matches an icon hash of a hash entry in the local icon hash database <NUM> and/or the icon hash database <NUM>. In some examples, the example hash checker <NUM> is configured to search the hash entries of the local icon hash database <NUM> and identify a matching icon hash from the hash entries of the local icon hash database <NUM>. In some examples, in response to the example hash checker <NUM> not identifying a matching icon hash from the local icon hash database <NUM>, the example hash checker <NUM> searches the hash entries of the icon hash database <NUM> to identify the matching icon hash. In some examples, in response to the example hash checker <NUM> not identifying a matching icon hash from at least one of the local icon hash database <NUM> or the icon hash database <NUM>, the phishing detection controller <NUM> is unable to determine whether the unknown website is a phishing website or a legitimate website.

Alternatively, in response to the example hash checker <NUM> identifying a matching icon hash from at least one of the local icon hash database <NUM> or the icon hash database <NUM>, the example hash checker <NUM> retrieves a matching hash entry from the respective database (e.g., the local icon hash database <NUM> or the icon hash database <NUM>). In the illustrated example of <FIG>, the matching hash entry includes the matching icon hash and the URL of a known legitimate website corresponding to the matching icon hash. The hash checker <NUM> compares the URL from the matching hash entry to the URL of the unknown website. In response to the hash checker <NUM> determining that the URL from the matching hash entry matches the URL of the unknown website, the hash checker <NUM> determines that the unknown website is a legitimate website. Alternatively, in response to the hash checker <NUM> determining that the URL from the matching hash entry does not match the URL of the unknown website, the hash checker <NUM> determines that the unknown website is a phishing website. In some examples, in response to the hash checker <NUM> determining that the unknown website is a phishing website, the hash checker <NUM> invokes the example alert generator <NUM>.

The example alert generator <NUM> in the illustrated example of <FIG> is in communication with the user device <NUM>. In the illustrated example of <FIG>, in response to the reference checker <NUM> and/or the hash checker <NUM> determining that the unknown website is a phishing website, the example alert generator <NUM> at least one of alerts a user of the user device <NUM> (e.g., via a message to the user device <NUM>) that the unknown website is a phishing website, or blocks the user device <NUM> from further accessing the unknown website.

In the illustrated example of <FIG>, the example website detector <NUM>, the example code parser <NUM>, the example reference checker <NUM>, the example location checker <NUM>, the example icon hasher <NUM>, the example hash checker <NUM>, and the example alert generator <NUM> are implemented by a logic circuit such as, for example, a hardware processor. However, any other type of circuitry may additionally or alternatively be used such as, for example, one or more analog or digital circuit(s), logic circuits, programmable processor(s), application specific integrated circuit(s) (ASIC(s)), programmable logic device(s) (PLD(s)), field programmable logic device(s) (FPLD(s)), digital signal processor(s) (DSP(s)), graphics processing units (GPUs), etc..

While an example manner of implementing the phishing detection controller <NUM> of <FIG> and/or <NUM> is illustrated in <FIG>, one or more of the elements, processes and/or devices illustrated in <FIG> may be combined, divided, re-arranged, omitted, eliminated and/or implemented in any other way. Further, the example website detector <NUM>, the example code parser <NUM>, the example reference checker <NUM>, the example location checker <NUM>, the example icon hasher <NUM>, the example local icon hash database <NUM>, the example hash checker <NUM>, the example alert generator <NUM> and/or, more generally, the example phishing detection controller <NUM> of <FIG> may be implemented by hardware, software, firmware and/or any combination of hardware, software and/or firmware. Thus, for example, any of the example website detector <NUM>, the example code parser <NUM>, the example reference checker <NUM>, the example location checker <NUM>, the example icon hasher <NUM>, the example local icon hash database <NUM>, the example hash checker <NUM>, the example alert generator <NUM> and/or, more generally, the example phishing detection controller <NUM> could be implemented by one or more analog or digital circuit(s), logic circuits, programmable processor(s), programmable controller(s), graphics processing unit(s) (GPU(s)), digital signal processor(s) (DSP(s)), application specific integrated circuit(s) (ASIC(s)), programmable logic device(s) (PLD(s)) and/or field programmable logic device(s) (FPLD(s)). When reading any of the apparatus or system claims of this patent to cover a purely software and/or firmware implementation, at least one of the example website detector <NUM>, the example code parser <NUM>, the example reference checker <NUM>, the example location checker <NUM>, the example icon hasher <NUM>, the example local icon hash database <NUM>, the example hash checker <NUM>, and/or the example alert generator <NUM> is/are hereby expressly defined to include a non-transitory computer readable storage device or storage disk such as a memory, a digital versatile disk (DVD), a compact disk (CD), a Blu-ray disk, etc. including the software and/or firmware. Further still, the example phishing detection controller <NUM> of <FIG> may include one or more elements, processes and/or devices in addition to, or instead of, those illustrated in <FIG>, and/or may include more than one of any or all of the illustrated elements, processes and devices. As used herein, the phrase "in communication," including variations thereof, encompasses direct communication and/or indirect communication through one or more intermediary components, and does not require direct physical (e.g., wired) communication and/or constant communication, but rather additionally includes selective communication at periodic intervals, scheduled intervals, aperiodic intervals, and/or one-time events.

Flowcharts representative of example hardware logic, machine readable instructions, hardware implemented state machines, and/or any combination thereof for implementing the icon hash database controller <NUM> of <FIG> and/or <NUM> and/or the phishing detection controller <NUM> of <FIG>, <FIG>, and/or <NUM> are shown in <FIG> and/or <NUM>. The machine readable instructions may be one or more executable programs or portion(s) of an executable program for execution by a computer processor and/or processor circuitry, such as the processor <NUM> shown in the example processor platform <NUM> discussed below in connection with <FIG>. The program may be embodied in software stored on a non-transitory computer readable storage medium such as a CD-ROM, a floppy disk, a hard drive, a DVD, a Blu-ray disk, or a memory associated with the processor <NUM>, but the entire program and/or parts thereof could alternatively be executed by a device other than the processor <NUM> and/or embodied in firmware or dedicated hardware. Further, although the example program is described with reference to the flowcharts illustrated in <FIG> and/or <NUM>, many other methods of implementing the example icon hash database controller <NUM> and/or the example phishing detection controller <NUM> may alternatively be used. For example, the order of execution of the blocks may be changed, and/or some of the blocks described may be changed, eliminated, or combined. Additionally or alternatively, any or all of the blocks may be implemented by one or more hardware circuits (e.g., discrete and/or integrated analog and/or digital circuitry, an FPGA, an ASIC, a comparator, an operational-amplifier (op-amp), a logic circuit, etc.) structured to perform the corresponding operation without executing software or firmware. The processor circuitry may be distributed in different network locations and/or local to one or more devices (e.g., a multi-core processor in a single machine, multiple processors distributed across a server rack, etc.).

The machine readable instructions described herein may be stored in one or more of a compressed format, an encrypted format, a fragmented format, a compiled format, an executable format, a packaged format, etc. Machine readable instructions as described herein may be stored as data or a data structure (e.g., portions of instructions, code, representations of code, etc.) that may be utilized to create, manufacture, and/or produce machine executable instructions. For example, the machine readable instructions may be fragmented and stored on one or more storage devices and/or computing devices (e.g., servers) located at the same or different locations of a network or collection of networks (e.g., in the cloud, in edge devices, etc.). The machine readable instructions may require one or more of installation, modification, adaptation, updating, combining, supplementing, configuring, decryption, decompression, unpacking, distribution, reassignment, compilation, etc. in order to make them directly readable, interpretable, and/or executable by a computing device and/or other machine. For example, the machine readable instructions may be stored in multiple parts, which are individually compressed, encrypted, and stored on separate computing devices, wherein the parts when decrypted, decompressed, and combined form a set of executable instructions that implement one or more functions that may together form a program such as that described herein.

In another example, the machine readable instructions may be stored in a state in which they may be read by processor circuitry, but require addition of a library (e.g., a dynamic link library (DLL)), a software development kit (SDK), an application programming interface (API), etc. in order to execute the instructions on a particular computing device or other device. In another example, the machine readable instructions may need to be configured (e.g., settings stored, data input, network addresses recorded, etc.) before the machine readable instructions and/or the corresponding program(s) can be executed in whole or in part. Thus, machine readable media, as used herein, may include machine readable instructions and/or program(s) regardless of the particular format or state of the machine readable instructions and/or program(s) when stored or otherwise at rest or in transit.

As mentioned above, the example processes of <FIG> and/or <NUM> may be implemented using executable instructions (e.g., computer and/or machine readable instructions) stored on a non-transitory computer and/or machine readable medium such as a hard disk drive, a flash memory, a read-only memory, a compact disk, a digital versatile disk, a cache, a random-access memory and/or any other storage device or storage disk in which information is stored for any duration (e.g., for extended time periods, permanently, for brief instances, for temporarily buffering, and/or for caching of the information). As used herein, the term non-transitory computer readable medium is expressly defined to include any type of computer readable storage device and/or storage disk and to exclude propagating signals and to exclude transmission media.

<FIG> is a flowchart representative of machine readable instructions <NUM> which may be executed to implement the example icon hash database controller <NUM> of <FIG> and/or <NUM> to generate a hash entry (e.g., the database hash entry <NUM> of <FIG>) of the example icon hash database <NUM> of <FIG>, <FIG>, and/or <NUM>. The example instructions <NUM> begin as the central server <NUM> of <FIG> accesses a known legitimate website (e.g., known clean website, the clean website <NUM> of <FIG>) via the network <NUM> of <FIG>.

The icon hash database controller <NUM> requests HTML code from the known legitimate website (block <NUM>) by sending a request to the known legitimate website via the network <NUM>. In response to the icon hash database controller <NUM> sending the request, the known legitimate website sends HTML code associated with the known legitimate website to the icon hash database controller <NUM>. In some examples, the known legitimate website is from a list of known legitimate websites provided to the icon hash database controller <NUM> from the central server <NUM>.

The database code parser <NUM> parses the HTML code from the known legitimate website (block <NUM>). In some examples, the parsed HTML code includes at least one of a reference to a website icon (e.g., the clean website icon <NUM> of <FIG>) for the known legitimate website or a URL (e.g., the clean website URL <NUM> of <FIG>) of the known legitimate website.

The reference detector <NUM> determines whether the parsed HTML code includes a reference to a website icon of the known legitimate website (block <NUM>). In some examples, the HTML code defines a location for an icon. In other examples, a default location (e.g., standard location) for the website icon is assumed. In response to the reference detector <NUM> determining that the website icon of the known legitimate website is referenced in the parsed HTML code (e.g., block <NUM> returns a result of YES), control proceeds to block <NUM>, where the hash generator <NUM> downloads the website icon and generates a hash of the website icon.

Returning to block <NUM>, if the reference detector <NUM> determines that the website icon of the known legitimate website is not referenced in the parsed code (e.g., block <NUM> returns a result of NO), control proceeds to block <NUM>, where the location detector <NUM> determines whether the website icon is located at the standard location.

The location detector <NUM> determines whether the website icon of the known legitimate website is located the standard location (block <NUM>). In response to the location detector <NUM> locating the website icon at the standard location (e.g., block <NUM> returns a result of YES), the control proceeds to block <NUM>, where the hash generator <NUM> downloads the website icon and generates a hash of the website icon.

Returning to block <NUM>, in response to the location detector <NUM> not locating the website icon at the expected location (e.g., block <NUM> returns a result of NO), control proceeds to block <NUM>, where the location detector <NUM> determines that no website icon exists for the known legitimate website.

The location detector <NUM> determines that no website icon exists for the known legitimate website (block <NUM>) and, thus, the hash entry cannot be generated for the known legitimate website. The example process of <FIG> is then terminated.

The hash generator <NUM> downloads the website icon of the known legitimate website and generates a hash of the website icon (block <NUM>). The hash generator <NUM> generates the hash of the website icon based on the hashing algorithm of the icon hash database controller <NUM> and/or the phishing detection controller <NUM> of <FIG>.

The hash generator <NUM> stores the hash of the website icon and the URL corresponding to the known legitimate website (block <NUM>) as a new hash entry in the icon hash database <NUM>. The example process of <FIG> is then terminated. The example process of <FIG> may be repeated for other known clean websites (e.g., a list of known clean websites may be iterated upon to create hashes for known clean websites).

<FIG> is a flowchart representative of machine readable instructions <NUM> which may be executed to implement the example phishing detection controller <NUM> of <FIG>, <FIG>, and <FIG> to detect whether a website is a phishing website. The example instructions <NUM> begin upon initialization of the example phishing detection controller <NUM>. In some examples, the instructions <NUM> may begin execution upon initialization of the browser <NUM> to, for example, provide phishing detection protection while a user is using the browser <NUM> (or another application).

The example website detector <NUM> determines whether loading of a website is detected (block <NUM>). The detecting may be performed by, for example, monitoring the browser <NUM> for an event indicating navigation to a website, monitoring network communications into and/or out of the browser <NUM> (or other application) to detect loading of a website, etc. If no loading of a website is detected, control proceeds to block <NUM> where the example website detector <NUM> continues to monitor for loading of a website.

In response to the website detector <NUM> detecting that the user device <NUM> is loading a website (e.g., block <NUM> returns a result of YES), the example code parser <NUM> parses HTML code of the website (block <NUM>). In some examples, the parsed HTML code includes a reference to a website icon for the website. The example reference checker <NUM> determines whether the parsed HTML code includes the reference to the website icon (block <NUM>). If the example reference checker <NUM> determines that the HTML code does not include the reference to the website icon (e.g., block <NUM> returns a result of NO), the example location checker <NUM> determines whether the website icon is located at a standard location. In some examples, a standard location may be the domain of the website visited, followed by a standard icon name, such as "favicon. The location checker <NUM> determines whether the website icon is located at the standard location (block <NUM>). In response to the location checker <NUM> locating the website icon at the standard location (e.g., block <NUM> returns a result of YES), control proceeds to block <NUM>, where the identified icon is used to determine whether the website is a phishing website. If, instead, no icon is identified, (e.g., block <NUM> returns a result of NO), no determination of whether the website is a phishing website can be made based on the icon. Control proceeds to block <NUM>, where the example website detector <NUM> determines whether to continue monitoring (block <NUM>). If monitoring is to continue (e.g., block <NUM> returns a result of YES), control proceeds to block <NUM>. If monitoring is not to continue (e.g., block <NUM> returns a result of NO), the example process <NUM> of <FIG> terminates. Returning to block <NUM>, if the example reference checker <NUM> determines that the parsed HTML code includes the reference to the website icon (e.g., block <NUM> returns a result of YES), the reference checker <NUM> determines whether the website icon is hosted at a different domain than the domain of the website (block <NUM>). In some examples, a phishing website may include a reference to a known website to attempt to cause a browser to re-use the icon hosted at the known website. Such activity is not typically performed by legitimate websites, which traditionally host their own website icons. If the website icon is hosted at the different domain (e.g., block <NUM> returns a result of YES), control proceeds to block <NUM>, where the user is alerted to the possibility of the website being a phishing website.

If the reference checker <NUM> determines that the website icon is not referenced to a different domain than the domain of the website (e.g., block <NUM> returns a result of NO), the icon hasher <NUM> generates a hash of the website icon (block <NUM>). In some examples, the icon hasher <NUM> downloads a copy of the icon (e.g., an additional request is transmitted to the website). However, in some examples, the icon may be accessed via the browser <NUM> (e.g., via a local cache of the browser <NUM>).

The example hash checker <NUM> compares the hash of the website icon against a list of known hashes stored in the local icon hash database <NUM> of <FIG> and/or the icon hash database <NUM> of <FIG>, <FIG>, and/or <NUM> (block <NUM>).

The hash checker <NUM> determines whether the hash of the website icon matches an existing icon hash in the list of known hashes stored in the local icon hash database <NUM> and/or the icon hash database <NUM> (block <NUM>). In response to the hash checker <NUM> determining that the hash of the website icon does not match any one of the existing icon hashes in the list of known hashes (e.g., block <NUM> returns a result of NO), the hash checker <NUM> determines that the unknown website is not a phishing website and control proceeds to block <NUM>. If the hash checker <NUM> determines that the hash of the website icon matches an existing icon hash in the list of known hashes (e.g., block <NUM> returns a result of YES), the example hash checker <NUM> compares the URL of the visited website to a database URL corresponding to the existing icon hash. Performing such a comparison enables the phishing detection controller <NUM> to confirm that the icon is being used in connection with a known website (as opposed to a phishing website).

The hash checker <NUM> compares the URL of the website to the database URL corresponding to the existing icon hash (block <NUM>). In this example, the existing icon hash and the database URL correspond to a known legitimate website. In some examples, the database URL and the existing hash icon are stored in a hash entry of the local icon hash database <NUM> and/or the icon hash database <NUM>.

The hash checker <NUM> determines whether the database URL matches the URL of the unknown website (block <NUM>). In response to the hash checker <NUM> determining that the database URL matches the URL of the unknown website (e.g., block <NUM> returns a result of YES), the hash checker <NUM> determines that the unknown website is not a phishing website and control proceeds to block <NUM>.

If the example hash checker <NUM> determines that the database URL does not match the URL of the visited website (e.g., block <NUM> returns a result of NO), control proceeds to block <NUM>, where the alert generator <NUM> alerts a user of the user device <NUM> that the unknown website is a phishing website.

In examples disclosed herein, the alert generator <NUM> alerts a user of the user device <NUM> that the unknown website is a phishing website (block <NUM>). In some examples, the alert causes display of a visual indicator (e.g., a pop-up) to alert the user. In some examples, an audible alert may be provided (e.g., a sound) to indicate that the visited website may be a phishing website. In some examples, the alert generator <NUM> causes navigation to the website to be blocked, and/or may require an additional action from the user before allowing navigation to the website (e.g., the user must acknowledge that they are about to visit a phishing website). Control then proceeds to block <NUM>, where the example website detector <NUM> determines whether to continue monitoring (block <NUM>). If monitoring is to continue (e.g., block <NUM> returns a result of YES), control proceeds to block <NUM>. If monitoring is not to continue (e.g., block <NUM> returns a result of NO), the example process <NUM> of <FIG> terminates. The example process <NUM> of <FIG> may be executed again upon, for example, re-initialization of the browser <NUM>.

<FIG> is a block diagram of an example processor platform <NUM> structured to execute the instructions of <FIG> and/or <NUM> to implement the icon hash database controller <NUM> and/or the phishing detection controller <NUM> of <FIG> and/or <NUM>. The processor platform <NUM> can be, for example, a server, a personal computer, a workstation, a self-learning machine (e.g., a neural network), a mobile device (e.g., a cell phone, a smart phone, a tablet such as an iPad™), a personal digital assistant (PDA), an Internet appliance, a DVD player, a CD player, a digital video recorder, a Blu-ray player, a gaming console, a personal video recorder, a set top box, a headset or other wearable device, or any other type of computing device.

For example, the processor <NUM> can be implemented by one or more integrated circuits, logic circuits, microprocessors, GPUs, DSPs, or controllers from any desired family or manufacturer. The hardware processor may be a semiconductor based (e.g., silicon based) device. In this example, the processor implements the database code parser <NUM>, the reference detector <NUM>, the location detector <NUM>, the hash generator <NUM>, the website detector <NUM>, the code parser <NUM>, the reference checker <NUM>, the location checker <NUM>, the icon hasher <NUM>, the hash checker <NUM>, and the alert generator <NUM>.

The machine executable instructions <NUM> of <FIG> and/or <NUM> may be stored in the mass storage device <NUM>, in the volatile memory <NUM>, in the non-volatile memory <NUM>, and/or on a removable non-transitory computer readable storage medium such as a CD or DVD.

A block diagram illustrating an example software distribution platform <NUM> to distribute software such as the example computer readable instructions <NUM> of <FIG> to third parties is illustrated in <FIG>. The example software distribution platform <NUM> may be implemented by any computer server, data facility, cloud service, etc., capable of storing and transmitting software to other computing devices. The third parties may be customers of the entity owning and/or operating the software distribution platform. For example, the entity that owns and/or operates the software distribution platform may be a developer, a seller, and/or a licensor of software such as the example computer readable instructions <NUM> of <FIG>. The third parties may be consumers, users, retailers, OEMs, etc., who purchase and/or license the software for use and/or re-sale and/or sub-licensing. In the illustrated example, the software distribution platform <NUM> includes one or more servers and one or more storage devices. The storage devices store the computer readable instructions <NUM>, which may correspond to the example computer readable instructions <NUM>, <NUM> of <FIG> and/or <NUM>, as described above. The one or more servers of the example software distribution platform <NUM> are in communication with a network <NUM>, which may correspond to any one or more of the Internet and/or any of the example networks <NUM> described above. In some examples, the one or more servers are responsive to requests to transmit the software to a requesting party as part of a commercial transaction. Payment for the delivery, sale and/or license of the software may be handled by the one or more servers of the software distribution platform and/or via a third party payment entity. The servers enable purchasers and/or licensors to download the computer readable instructions <NUM> from the software distribution platform <NUM>. For example, the software, which may correspond to the example computer readable instructions <NUM> of <FIG>, may be downloaded to the example processor platform <NUM>, which is to execute the computer readable instructions <NUM> to implement the example icon hash database controller <NUM> and/or the example phishing detection controller <NUM>. In some example, one or more servers of the software distribution platform <NUM> periodically offer, transmit, and/or force updates to the software (e.g., the example computer readable instructions <NUM> of <FIG>) to ensure improvements, patches, updates, etc. are distributed and applied to the software at the end user devices.

From the foregoing, it will be appreciated that example methods, apparatus and articles of manufacture have been disclosed that protect a user of a computing device from phishing-based attacks. The disclosed methods, apparatus and articles of manufacture improve the efficiency of using a computing device by reducing the processor load and improving processor performance by automatically detecting malicious websites and, as such, reducing computing resources spent on displaying the malicious websites. The disclosed methods, apparatus and articles of manufacture are accordingly directed to one or more improvement(s) in the functioning of a computer.

Although certain example methods, apparatus and articles of manufacture have been disclosed herein, the scope of coverage of this patent is not limited thereto. On the contrary, this patent covers all methods, apparatus and articles of manufacture fairly falling within the scope of the claims of this patent.

Claim 1:
An apparatus for detecting a phishing website based on website icons, the apparatus comprising:
a parser (<NUM>) to locate a first website icon (<NUM>, <NUM>) corresponding to a first website (<NUM>, <NUM>);
an icon hasher (<NUM>) to generate a first hash of the first website icon (<NUM>, <NUM>); and
a hash checker (<NUM>) to determine whether the first hash matches a second hash of a second website icon (<NUM>) corresponding to a second website (<NUM>) in an icon hash database (<NUM>), the hash checker (<NUM>) to, in response to the first hash matching the second hash, determine whether a first portion of a first Uniform Resource Locator, URL, (<NUM>) corresponding to the first website (<NUM>, <NUM>) matches a second portion of a second URL (<NUM>) corresponding to the second website (<NUM>), the hash checker (<NUM>) to, in response to the first portion not matching the second portion, identify the first website (<NUM>, <NUM>) as a phishing website.