PhishVision: A Deep Learning Based Visual Brand Impersonation Detector for Identifying Phishing Attacks

With the rapid growth of online space and the rising number of interconnected devices, security threats related to both personal and corporate data have increased considerably. Phishing attacks are commonly used to target corporate networks and gain initial access into security perimeters. The campaigns associated to these attacks span different propagation media and, in the case of web pages, attackers mimic real pages to trick users into downloading malicious software or sharing their credentials. In this paper we propose PhishVision, a framework for visually detecting phishing websites by identifying the main logo that characterizes them and comparing it with a set of logos which PhishVision protects. In case of presence of multiple logos, the framework is able to reconstruct which logo identifies the page while ignoring the others. The framework has been designed to have a lower false positive rate, fast detection times, and works in near-real-time fashion to provide a phishing detection service to Security Operation Centers. Its operators can use it make informed decisions about potential phishing activities by offering a comprehensible grey box explanation about how the framework has reached its conclusions. PhishVision achieves 0.997 ROC AUC on a test set of 404 screenshots, including both benign and malicious samples.