Когнитивные технологии визуального распознавания фишинговых интерфейсов в цифровых коммуникационных системах

For Russian citation (Opticheskii Zhurnal):

Волокитина Т.С., Таныгин М.О. Когнитивные технологии визуального распознавания фишинговых интерфейсов в цифровых коммуникационных системах // Оптический журнал. 2026. Т. 93. № 6. С. 58–68. http://doi.org/10.17586/1023-5086-2026-93-06-58-68

Volokitina T.S., Tanygin M.O. Cognitive technologies for visual recognition of phishing interfaces in digital communication systems [in Russian] // Opticheskii Zhurnal. 2026. V. 93. № 6. P. 58–68. http://doi.org/10.17586/1023-5086-2026-93-06-58-68

For citation (Journal of Optical Technology):

Abstract:

Methods for automatic analysis of web interface screenshots for phishing attack detection in social networks using classical image descriptors (Histograms of Oriented Gradients, Local Binary Patterns, SIFT) and deep convolutional neural networks (VGG-16, ResNet-50, Inception-V3). The purpose of the work is to develop a visual recognition system for phishing interfaces based on screenshot analysis that provides high classification accuracy with acceptable computational costs for deployment on social network platforms. Methods are computer vision for extracting structural (HOG), textural (LBP), and scale-invariant (SIFT) features from 1920×1080 pixel web page screenshots; deep learning with transfer learning on ImageNet pretrained weights for three convolutional neural network architectures; model ensembling with weighted voting; experimental validation on a dataset of 5000 screenshots of Russian web services. Results are comparison of classical descriptors showed that SIFT provides 81% accuracy at 350 milliseconds processing time, HOG achieves 78% in 120 milliseconds, LBP demonstrates 72% in 80 milliseconds; among deep architectures ResNet-50 showed the best result of 90% accuracy at 187 milliseconds, VGG-16 reached 88% in 245 milliseconds, Inception-V3 provided 86% in 198 milliseconds; ensemble of three CNN architectures with weighted voting achieves 92% accuracy with 630 milliseconds processing time, corresponding to throughput of 95 images per minute on a single GPU; transfer learning increases accuracy by 2–4 percentage points with fivefold reduction in training time; cascaded architecture with heuristic filtering at first stage (87% accuracy, 50 milliseconds) and CNN ensemble at second stage provides total accuracy of 88.5% with average processing time of 239 milliseconds per publication. Practical significance. The system provides phishing interface detection independently of URL presence in blacklists, reducing critical vulnerability window from 12–14 hours to 2 hours; throughput of 250 publications per minute on single server enables scaling for platforms with millions of active users requiring 3 servers to process 1000000 publications per day; experimental validation on «Odnoklassniki» social network data over 9 months showed detection of 3000 threats with prevention of 44.5% of clicks on malicious links compared to traditional methods.

Keywords:

visual recognition, screenshot analysis, phishing attacks, computer vision, Histograms of Oriented Gradients, Local Binary Patterns, SIFT (Scale-Invariant Feature Transform), convolutional neural networks, model ensembling

Acknowledgements:

the authors express gratitude to the members of the editorial board of the “Optical Journal” for their comments and recommendations on improving this instruction.

OCIS codes: 100.4996, 330.4270, 3000.35010

References:

1. Селиверстов В.В., Корчагин С.А. Анализ актуальности и состояния современных фишинг-атак на объекты критической информационной инфраструктуры // Инженерный вестник Дона. 2024. № 6 (114). С. 17. https://www.ivdon.ru/ru/magazine/archive/n6y2024/9277

Seliverstov V.V., Korchagin S.A. Analysis of the relevance and state of modern phishing attacks on critical information infrastructure facilities // Engineering Bulletin of the Don. 2024. № 6 (114). P. 17. https://www.ivdon.ru/ru/magazine/archive/n6y2024/9277

2. Русских Е.И. Прошлое, настоящее и будущее фишинговых атак // Научный аспект. 2024. № 6. Самара: Изд-во «Аспект», 2024. Т. 47. С. 6015. Электронная копия доступна на сайте URL: https://na-journal.ru/pdf/nauchnyi_aspekt_6-2024_t47_web.pdf#page=99

Russkikh E.I. Past, present and future of phishing attacks // The scientific aspect. 2024. V. 47(6). P. 6015. Electronic copy available on the website URL: https://na-journal.ru/pdf/nauchnyi_aspekt_6-2024_t47_web.pdf#page=99

3. Назаров А.К. Некоторые современные средства защиты от киберугроз // Информационные и телекоммуникационные технологии в противодействии экстремизму и терроризму [Электронный ресурс]: Материалы Всерос. науч.-практ. конф. (24 мая 2024 г.) Электрон. дан. Краснодар: Краснодарский университет МВД России, 2024. 1 электрон. опт. Диск С. 76.

Nazarov A.K. Some modern means of protection against cyber threats // Information and telecommunication technologies in countering extremism and terrorism: Materials of the All-Russian Scientific and Practical Conference. Krasnodar: Krasnodar University of the Ministry of Internal Affairs of Russia, 2024. P. 76.

4. Токолов А.В. Социальная инженерия в вопросах обеспечения информационной безопасности // Криминологический журнал. 2024. № 4. С. 175–182. https://doi.org/10.24412/2687-0185-2024-4-175-182

Tokolov A.V. Social engineering in matters of ensuring information security // Criminological Journal. 2024. № 4. P. 175–182. https://doi.org/10.24412/2687-0185-2024-4-175-182

5. Брюханов В.А., Грызунов В.В., Шестаков А.В. Выявление проблем информационной безопасности методом систематического обзора литературы // Вестник Санкт-Петерб. ун-та ГПС МЧС России. 2024. № 1. С. 104. https://doi.org/10.61260/2218-130X-2024-1-104-122

Bryukhanov V.A., Gryuzunov V.V., Shestakov A.V. Identification of information security problems by the method of systematic literature review // Bulletin of the Saint Petersburg University of the State Fire Service of the Ministry of Emergency Situations of Russia. 2024. № 1. P. 104. https://doi.org/10.61260/2218-130X-2024-1-104-122

6. Dalal N., Triggs B. Histograms of oriented gradients for human detection // 2005 IEEE computer society conference on computer vision and pattern recognition (CVPR’05), San Diego, CA, USA. 2005. Т. 1. С. 886–893. https://doi.org/ 10.1109/CVPR.2005.177

7. Ojala T., Valkealahti K., Oja E., Pietikäinen M. Texture discrimination with multidimensional distributions of signed gray-level differences // Pattern Recognition. 2001. V. 34. № 3. P. 727–739. https://doi.org/ 10.1016/S0031-3203(00)00010-8

8. Lowe D.G. Distinctive image features from scale-invariant keypoints // International Journal of Computer Vision. 2004. V. 60. № 2. P. 91–110. https://doi.org/10.1023/B:VISI.0000029664.99615.94

9. Lo T.W.R., Siebert J.P. SIFT keypoint descriptors for range image analysis // Annals of the BMVA. 2008. V. 2008. № 3. P. 1–18. Electronic copy available on the website URL: https://www.researchgate.net/publication/40704815_SIFT_Keypoint_Descriptors_for_Range_Image_Analysis

10. Шнейдеров Е.Н., Крез К.С., Стадник С.Л., Ракова Е.А. Методы и технологии обнаружения плагиата в изображениях // Актуальные проблемы современного общества, науки и образования: сборник статей II Международной научно-практической конференции. Пенза: МЦНС «Наука и просвещение», 2025. 252 с. Электронная копия доступна на сайте URL: https://naukaip.ru/wp-content/uploads/2025/08/MK-2430.pdf#page=29

Shneyderov E.N., Krez K.S., Stadnik S.L., Rakova E.A. Methods and technologies for detecting plagiarism in images // Actual problems of modern society, science and education: collection of articles of the II International Scientific and Practical Conference. Penza: ICNS “Science and Education”, 2025. 29 p. Electronic copy available on the website URL: https://naukaip.ru/wp-content/uploads/2025/08/MK-2430.pdf#page=29

11. Сухобоков А.А. Анализ эффективности сверточных нейронных сетей в задачах классификации // Новые направления развития приборостроения. Материалы 17-й Международной научно-технической конференции молодых ученых и студентов. Минск, 17–19 апреля 2024 г. Минск: БНТУ, 2024. С. 136–137.

Sukhobokov A. A. Analysis of the effectiveness of convolutional neural networks in classification tasks. New directions in the development of instrument making: materials of the 17th International Scientific and Technical Conference. Minsk: BNTU, 2024.P. 136–137.

12. Орлов П.А., Лаптев В.В., Иванов В.М. К вопросу о применении систем ай-трекинга // Информатика, телекоммуникации и управление. 2014. № 5 (205). С. 82–92. Электронная копия доступна на сайте URL: https://www.mathnet.ru/php/archive.phtml?wshow=paper&jrnid=ntitu&paperid=61&option_lang=rus

Orlov P.A., Laptev V.V., Ivanov V.M. On the issue of using eye-tracking systems // Computer Science, telecommunications and management. 2014. № 5 (205). P. 82–92. Electronic copy available on the website URL: https://www.mathnet.ru/php/archive.phtml?wshow=paper&jrnid=ntitu&paperid=61&option_lang=rus

13. Кашапова Э.Р., Рыжкова М.В. Когнитивные искажения и их влияние на поведение индивида // Вестник Томского государственного университета. Экономика. 2015. № 2 (30). С. 15–26. https://doi.org/10.17223/19988648/30/2

Kashapova E.R., Ryzhkova M.V. Cognitive distortions and their influence on individual behavior // Bulletin of Tomsk State University. Economy. 2015. № 2(30). P. 15–26. https://doi.org/10.17223/19988648/30/2 14. Arnold V., Collier P.A., Leech S.A., Sutton S.G. The effect of experience and complexity on order and recency bias in decision making by professional accountants // Accounting & Finance. 2000. V. 40. № 2. P. 109–134. https://doi.org/10.1111/1467-629X.00039