Patent ID: 12192233

DETAILED DESCRIPTION

As noted previously, cyber security is a growing concern as attacks on computer systems and the users of those systems increase. Phishing attacks, in particular, pose a serious problem. In one example of a phishing attack, the user visits a website that is believed to be legitimate and is fooled into entering his credentials (e.g., a password) on an input form of the website. It can often be difficult or impossible for the user to recognize a nefarious website, and so urging users to be diligent is generally not an effective solution to this problem. Likewise, maintaining a blacklist of websites that are known to be dangerous is not effective, as such a list would require constant updates and can never be complete.

To address these and other problems, and as summarized above, various examples described herein are directed to systems and methods for protection against phishing attacks that can lead to theft of user credentials. In some examples, the disclosed techniques are implemented, at least in part, by a web browser plug-in or extension.

In some examples, the disclosed techniques provide protection against phishing attacks by verifying the legitimacy of an identity provider (IdP). IdPs are third party entities that provide user authentication services to client organizations. These organizations (e.g., companies, enterprises, etc.) use the services of the IdPs to manage user access to the websites and applications that are offered by the organization. For example, an IdP manages and maintains user credentials on behalf of an organization and presents a user with a sign-in page, such as the one illustrated inFIG.2, described below, which typically asks for a username and password, to be verified prior to granting access to a resource of the organization. The phishing protection system disclosed herein verifies that a sign-in page, to which a user has navigated, is being presented by a legitimate or known IdP as opposed to a phishing website that is attempting to capture the user's credentials.

In some examples, the verification is accomplished by capturing a screen image or screenshot of the webpage to which the user has navigated. The screen image is provided to a neural network based computer vision (CV) image analyzer that is trained to recognize whether or not the captured image matches the webpage of any known and/or trusted IdPs. If the screen image of the webpage is recognized as a known IdP, then the domain name associated with that webpage should match the known domain name associated with that IdP. If the domain names do not match, then the webpage to which the user has navigated is likely a phishing attack webpage. In such case, the user can be alerted, or other appropriate action can be taken to prevent a malicious website from obtaining the user's credentials. An alert may ask the user to confirm whether or not they wish to proceed. Other actions can include notifying information technology (IT) administration, logging the event for later analysis, and/or forcing a password change.

For example, a malicious phishing web site can duplicate a sign-in web page of an IdP, either exactly or with some variations. A user is then lured to the malicious web site, through an email link or by other such means. The appearance of the malicious web site is similar enough to the genuine IdP provided sign-in web site so that the user is fooled. Additionally, the user does not notice that the domain name of the malicious web site differs, perhaps only slightly, from the true IdP domain name. As such, the user enters their credentials which are then stolen. The phishing protection system, however, recognizes that the malicious web site is similar to a genuine IdP sign-in web site and further detects that the domain name of the malicious web site differs from the true IdP domain name associated with the genuine IdP. The phishing protection system can therefore take appropriate action including blocking the user from entering credentials.

In some examples, the disclosed techniques include training of the neural network. A data set of training images is generated by navigating to the sign-in web page of a known IdP and capturing the screen image of that page. A relatively large number of variations of that captured screen image can then be generated by varying selected attributes of the page, such as colors, fonts, logos, dimensions, etc. The neural network can then be trained to recognize the IdP sign-in page based on the training images using any desired training technique in light of the present disclosure. The process can be repeated for other IdPs to develop training images for each IdP of interest to the organization, and the neural network can be trained to recognize these additional IdP sign-in pages. An administrator can create and maintain a datastore of such IdPs to include the uniform resource locators (URLs) and domain names of the IdPs.

These systems and methods overcome a number of security problems. For example, a user may navigate to a website that is unknown to the user, and the website may ask the user to enter their password. This request may provide a plausible reason for this request and appear to be legitimate. The disclosed techniques will warn or prevent the user from entering a password and divulging credentials.

As yet another example, a user may attempt to navigate to a legitimate website but get redirected to a phishing website that closely resembles the legitimate website. Here again, the phishing website may ask the user to enter their password in a compellingly plausible matter, and the disclosed techniques will prevent or discourage the user from doing so.

Thus, and in accordance with at least some examples disclosed herein, systems and methods for securing user passwords from detection by a phishing attack are provided. These systems and methods provide for detection and blocking of attempts by a user to enter their password to a phishing website.

As will be understood in view of this disclosure, the systems and methods for providing protection against theft of user credentials by phishing websites provided herein have several advantages over existing methods which rely on user vigilance, which is subject to lapse, or blacklisted websites, which require constant updates and can never be complete. For instance, the systems and methods described herein provide automated protection and do not rely on user action.

Examples of the methods and systems discussed herein are not limited in application to the details of construction and the arrangement of components set forth in the following description or illustrated in the accompanying drawings. The methods and systems are capable of implementation in other examples and of being practiced or of being carried out in various ways. Examples of specific implementations are provided herein for illustrative purposes only and are not intended to be limiting. In particular, acts, components, elements, and features discussed in connection with any one or more examples are not intended to be excluded from a similar role in any other examples.

Password Protection System

FIG.1is a top-level block diagram100of an implementation of a system170for providing protection against phishing attacks, in accordance with an example of the present disclosure. As shown inFIG.1, the system comprises a web browser120, which may include browser extensions130, and a phishing protection system170.

The web browser120is configured to enable the user110to navigate to servers140and the websites and web applications160hosted on those servers. The operation of phishing protection system170will be explained in greater detail below, but at a high-level, the system170is configured to monitor user browsing activity to detect that the user has navigated to a web page that resembles a known IdP sign-in web page and then verify that the domain name of the web page is legitimate (e.g., matches the known domain name for that IdP). If the domain name does not match, then an attempted phishing attack is detected, and appropriate security measures can be taken. These measures may include alerting the user, obtaining confirmation of trust from the user, and alerting IT security/administration.

FIG.2illustrates an identity provider sign-in (or logon) web page200, in accordance with an example of the present disclosure. The sign-in page is for a company named XYZ Corporation, in this example. The domain name210for the IdP provider for this company is “XYZ.idpco.com” which is associated with an IdP company called “IdPCo,” in this example. Username and password entry fields220are also shown, along with a text block230, a sign-in button250, and a company logo240. The domain name “XYZ.idpco.com,” in this example is the genuine domain name for the IdP. A malicious phishing web page can present the same image (or a slight variation) to fool the user into believing the page is genuine, but the phishing web page would necessarily have a different domain name. For example, the phishing web page may use the domain name “XYZ.idpcco.com” (with an extra ‘c’) instead of “XYZ.idpco.com,” which would be easy for the user to overlook.

FIG.3is a block diagram of a phishing attack protection system170, ofFIG.1, in accordance with an example of the present disclosure. The phishing attack protection system170is shown to include a screenshot imaging system310, a CV neural network image analyzer330, a CV neural network training system335, a domain name identifier350, a domain name matcher370, an IdP domain name datastore395, and a phishing detector390.

The screenshot imaging system310is configured to capture an image320of a browser web page300, for example a web page to which the user has navigated. The image can then be used by the CV neural network image analyzer330for matching/classification purposes, as described below. The screenshot imaging system310may also be used to capture images of administrator added IdP web pages for training of the CV neural network image analyzer330, as described below.

The CV neural network image analyzer330is configured to determine that the captured image320matches an image of an IdP web page. The determination of a match340may be based on a selected degree of similarity which involves a tradeoff between match detection probability and false alarm rate. For example, requiring an exact match may result in missed match detections, while allowing more flexible similarity may result in false alarms. In some examples this can be determined during the neural network training process. In some examples, the determination of a match340can be classifying a web page image320to be of a specific IdP domain or to be undefined/unclassified. Any suitable CV analyzer or machine learning technique may be used, in light of the present disclosure. Some examples include TensorFlow and PyTorch which employ machine learning models based on deep neural networks.

The domain name identifier350is configured to identify a domain name360associated with the browser web page300. In some examples, the domain name can be obtained through optical character recognition of the URL address bar of the browser window which contains the domain name. In some examples, the domain name can be obtained using a javascript (e.g., document.URL) executing within the browser, for example through a browser extension or plugin.

The domain name matcher370is configured to determine that the identified domain name associated with the browser web page matches380the domain name associated with the IdP web page. The domain name associated with the IdP web page may be obtained, for example, from the IdP domain name datastore395which is configured by a system administrator to store information (including domain names) related to known IdPs (e.g., IdPs of interest to the enterprise seeking protection from phishing attacks).

The phishing detector390is configured to detect a phishing attempt in response to the determination of an image match340in conjunction with the determination that the domain name associated with the browser web page360differs from the domain name associated with the IdP web page (i.e., that the IdP domain match380is false). In some examples, the phishing detector390is configured to perform a security action in response to the detected phishing attempt. The security action may include warning a user that navigated to the browser web page, logging the detection, and/or generating an alert to an administrator.

In some examples, the browser web page is first analyzed to determine if the page is a sign-in or logon page, for example by detection of a username and/or password entry field, and if the page is not a sign-in page, the phishing detection process is bypassed.

The CV neural network training system335is configured to train the CV neural network image analyzer330, as described below in greater detail in connection withFIG.4.

Password Protection Process

As described above, some examples of the system170ofFIG.1are configured to perform a process for providing protection against phishing attacks. The processes may be executed on a processor of any suitable type (e.g., processor610ofFIG.6). The processes may further be implemented through execution of a web browser plug-in or extension.

FIG.4is a flow diagram of a process400for training the CV neural network image analyzer330, for example by CV neural network training system335, ofFIG.3, in accordance with an example of the present disclosure.

The process400starts at operation410, with the creation (or update and maintenance) of an IdP domain name datastore395, ofFIG.3. In some examples, the IDP domain names are provided by an administrator of the system.

Next, at operation420, the web browser120, ofFIG.1, navigates to the web page specified by a URL associated with the IdP domain name. At operation430, screenshot imaging system310, ofFIG.3, captures a screenshot of the IdP web page.

At operation440, the training system335generates variations of the screenshot by modifying attributes of the image to create data that will be used to train, test, and validate the neural network330. In some examples, the attributes include one or more of background colors, logos (e.g.,240ofFIG.2), fonts, dimensions, words and phrases (e.g.,230ofFIG.2), as well as the language in which those words are presented (e.g., English, Spanish, etc.), although many other attribute variations are possible. K-fold cross validation method can be employed to estimate the skill of machine learning models.

At operation450, the training system335trains the CV neural network image analyzer on the training data set using any suitable training procedure in light of the present disclosure. In some examples, the training may utilize Azur Cognitive Services.

In some examples, the CV neural network may be implemented using available architectures such as LeNet, AlexNetm GoogLeNet, VGGNet, or ResNet. In some examples, CV neural network may be implemented as a custom neural network comprising various convolutional layers and hidden layers.

In some examples, the trained CV neural network may be validated using K-fold cross validation to estimate the performance of the machine learning model. Additionally, the network may be tested using various hyper parameters to optimize the model.

After training, the CV neural network is made available to be downloaded by the client (e.g., the user device running the Web browser120) for deployment in the phishing protection system170.

FIG.5is a flow diagram of another process500for providing protection against phishing attacks, executed by phishing protection system170, ofFIG.1, or the sub-components thereof, in accordance with an example of the present disclosure.

The process500starts at operation510, with the screenshot imaging system310, ofFIG.3, capturing an image of a browser web page to which the user has navigated.

Next, at operation520, the domain name identifier350, ofFIG.3, identifies the domain name of the web page.

At operation530, the CV neural network image analyzer330, ofFIG.3, determines whether or not the captured web page image matches the image of an IdP web page.

At operation540, the domain name matcher of370, ofFIG.3, detects a phishing attempt if the captured web page image matches the image of the IdP web page but the domain name associated with the browser web page differs from the domain name associated with the IdP web page.

In some examples, an initial determination is made that the browser web page is a sign-in page (e.g., though detection of a user ID and/or password field). If the web page is not a sign-in page, then the process for protection against phishing attacks is not necessary and can be bypassed.

In some examples, a security action is performed in response to the detected phishing attempt. Security actions may include one or more of warning the user, logging the detected phishing attempt, and generating an alert to an administrator.

The processes disclosed herein each depict one particular sequence of acts in a particular example. Some acts are optional and, as such, can be omitted in accord with one or more examples. Additionally, the order of acts can be altered, or other acts can be added, without departing from the scope of the apparatus and methods discussed herein.

Computing Platform for Protection Against Theft of User Credentials

FIG.6is a block diagram of a computing platform600configured to perform a process for providing protection against phishing attacks, in accordance with an example of the present disclosure. In some cases, the platform600may be a workstation, server, laptop, mobile device, or smartphone.

The computing platform or device600includes one or more processors610, volatile memory620(e.g., random access memory (RAM)), non-volatile memory630, one or more network or communication interfaces640, user interface (UI)660, display element (e.g., screen)670, and a communications bus650. The computing platform600may also be referred to as a computer or a computer system.

The non-volatile (non-transitory) memory630can include: one or more hard disk drives (HDDs) or other magnetic or optical storage media; one or more solid state drives (SSDs), such as a flash drive or other solid-state storage media; one or more hybrid magnetic and solid-state drives; and/or one or more virtual storage volumes, such as a cloud storage, or a combination of such physical storage volumes and virtual storage volumes or arrays thereof.

The user interface660can include one or more input/output (I/O) devices (e.g., a mouse, a keyboard, a microphone, one or more speakers, one or more biometric scanners, one or more environmental sensors, and one or more accelerometers, etc.).

The display element670, can provide a graphical user interface (GUI) and in some cases, may be a touchscreen or any other suitable display device.

The non-volatile memory630stores an operating system632, one or more applications634(including web browsers), data636, and elements of phishing protection system170ofFIG.1, such that, for example, computer instructions of the operating system632, the applications634, and the elements of phishing protection system170, are executed by processor(s)610out of the volatile memory620. In some examples, the volatile memory620can include one or more types of RAM and/or a cache memory that can offer a faster response time than a main memory. Data can be entered through the user interface660. Various elements of the computer600can communicate via the communications bus650.

The illustrated computing platform600is shown merely as an example client device or server and can be implemented by any computing or processing environment with any type of machine or set of machines that can have suitable hardware and/or software capable of operating as described herein.

The processor(s)610can be implemented by one or more programmable processors to execute one or more executable instructions, such as a computer program, to perform the functions of the system. As used herein, the term “processor” describes circuitry that performs a function, an operation, or a sequence of operations. The function, operation, or sequence of operations can be hard coded into the circuitry or soft coded by way of instructions held in a memory device and executed by the circuitry. A processor can perform the function, operation, or sequence of operations using digital values and/or using analog signals.

In some examples, the processor can be embodied in one or more application specific integrated circuits (ASICs), microprocessors, digital signal processors (DSPs), graphics processing units (GPUs), microcontrollers, field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), multicore processors, or general-purpose computers with associated memory.

The processor610can be analog, digital, or mixed. In some examples, the processor610can be one or more physical processors, or one or more virtual (e.g., remotely located or cloud) processors. A processor including multiple processor cores and/or multiple processors can provide functionality for parallel, simultaneous execution of instructions or for parallel, simultaneous execution of one instruction on more than one piece of data.

The network interfaces640can include one or more interfaces to enable the computing platform600to access a computer network680such as a Local Area Network (LAN), a Wide Area Network (WAN), a Personal Area Network (PAN), or the Internet through a variety of wired and/or wireless connections, including cellular connections. In some examples, the network680may allow for communication with other computing platforms690, to enable distributed computing.

In described examples, the computing platform600can execute an application on behalf of a user of a client device. For example, the computing platform600can execute one or more virtual machines managed by a hypervisor. Each virtual machine can provide an execution session within which applications execute on behalf of a user or a client device, such as a hosted desktop session. The computing platform600can also execute a terminal services session to provide a hosted desktop environment. The computing platform600can provide access to a remote computing environment including one or more applications, one or more desktop applications, and one or more desktop sessions in which one or more applications can execute.

Having thus described several aspects of at least one example, it is to be appreciated that various alterations, modifications, and improvements will readily occur to those skilled in the art. For instance, examples disclosed herein can also be used in other contexts. Such alterations, modifications, and improvements are intended to be part of this disclosure and are intended to be within the scope of the examples discussed herein. Accordingly, the foregoing description and drawings are by way of example only.

Also, the phraseology and terminology used herein is for the purpose of description and should not be regarded as limiting. Any references to examples, components, elements or acts of the systems and methods herein referred to in the singular can also embrace examples including a plurality, and any references in plural to any example, component, element or act herein can also embrace examples including only a singularity. References in the singular or plural form are not intended to limit the presently disclosed systems or methods, their components, acts, or elements. The use herein of “including,” “comprising,” “having,” “containing,” “involving,” and variations thereof is meant to encompass the items listed thereafter and equivalents thereof as well as additional items. References to “or” can be construed as inclusive so that any terms described using “or” can indicate any of a single, more than one, and all of the described terms. In addition, in the event of inconsistent usages of terms between this document and documents incorporated herein by reference, the term usage in the incorporated references is supplementary to that of this document; for irreconcilable inconsistencies, the term usage in this document controls.