4 ms·
The proper solution to this problem is to render the message as the user will see it and then analyze it using computer vision, running OCR to extract the text
by ttul 3y ago
The proper solution to this problem is to render the message as the user will see it and then analyze it using computer vision, running OCR to extract the text and identifying deceptive elements like brands. We built a prototype to detect brand impersonations at scale in this manner and it worked, but the GPU cost was prohibitive (on a billion messages a month) and there were lots of false positives.
If anyone is keen to learn more, reach out to me at ksimpson at mailchannels.com. We would like to open source this but don’t have the time to do it properly. If anyone is interested, please reach out to me.
- ShowalkKama 3y agoor you could also render the extension separately allowing only ascii chars... (thus .eml would always show at the end, no matter what)
- rocqua 3y agoMight be cool to do this on domains found on certifacte transparency logs, rather than doing it on domains found on e-mail. Lets encrypt seems to issue about 3M certificates a day, so about 100 million a month. Which seems to be one order of magnitude better.
- masfuerte 3y agoIf I were a phisher I wouldn't put the phishing on the site home page.
- kccqzy 3y agoAh I have a friend at Google doing that. Except they downscale the image to a ridiculously low resolution to save compute costs. At that resolution OCR is no longer feasible but brand detection still works. Naturally being at Google they don't use GPUs but TPUs to do it, but the cost remains so prohibitive that they have to randomly sample messages to go through this process.
- deleted 3y ago[deleted]
- ttul 3y agoNot surprised that downscaling still works. Brands work very hard to make their messages visually distinctive, such that you’d recognize the brand even if you squint…