Method for detecting a vulnerability to a phishing attack in a computer system.

Abstract

The present invention relates to a method for detecting a vulnerability to a phishing attack in a computer system, characterized in that it comprises the implementation, by data processing means (11) of a server (1) of said computer system, of the steps of: Obtaining at least a first computer message of a phishing attempt, said first computer message comprising original personalization data; Generation of a second computer message corresponding to the first computer message in which said original personalization data has been anonymized;Generation of a third computer message corresponding to the second computer message in which new personalization data has been introduced for at least one user of said computer system, said target user, based on targeting data of said computer system, stored in data storage means (12) of said server (1); Issuance of said third computer message to said target user so as to simulate a phishing attack; Detection of at least one reaction to said third computer message implemented by said target user in said computer system [Fig. 1];

Description

Title of the invention: Method for detecting a vulnerability to a phishing attack in a computer system.

[0001] GENERAL TECHNICAL FIELD

[0002] The present invention relates to the field of computer security. More specifically, it concerns a method for detecting a vulnerability to a phishing attack in a computer system.

[0003] STATE OF THE ART

[0004] Phishing is a computer attack technique used to obtain a user's personal data, such as a password, bank card number, etc. The idea is to trick the victim into believing they are communicating with a trusted third party—a bank, government agency, company, etc. Most often, a fake email (using the same format as an email from the trusted third party and a very similar email address) is sent to the victim, inviting them to click on a link or attachment that will take them to a copy of an official website (with a fake login page prompting them to enter their personal information), or even directly load a virus. The attack can also be carried out through other electronic means, such as a message on a mobile social network or an SMS, or even by creating an entirely fake website from scratch.

[0005] Protection against such attacks is very complicated, because they do not exploit specific computer vulnerabilities, they only deceive users.

[0006] One solution is to educate and raise user awareness about proactively detecting phishing emails. By practicing with concrete examples, one can learn to identify warning signs, such as errors in the domain name or inconsistencies in the sender's address. However, it only takes a single inattentive user to compromise an entire company's IT system.

[0007] Furthermore, there are now advanced phishing attacks known as spear phishing, in which the email is highly personalized (for example, the email mentions the victim's real 1TBAN and impersonates their bank advisor), making it more convincing. Raising awareness of spear phishing is much more challenging.

[0008] Alternative mechanisms for automatically detecting phishing emails, based on filters, are known, but they are not entirely satisfactory. Indeed, these filters are often "too strict" and can unduly block legitimate and non-fraudulent emails, so the user must regularly check the emails blocked emails (and in some cases there is a risk that it will unblock a genuinely fraudulent email).

[0009] The present invention improves the situation. PRESENTATION OF THE INVENTION

[0010] The present invention therefore relates, in a first aspect, to a method for detecting a vulnerability to a phishing attack in a computer system, characterized in that it comprises the implementation, by data processing means of a server of said computer system, of the following steps: a. Obtaining at least one initial computer message of a phishing attempt, said initial computer message including original personalization data; b. Generation of a second computer message corresponding to the first computer message in which the said original personalization data has been anonymized; c. Generation of a third computer message corresponding to the second computer message in which new personalization data has been introduced for at least one user of said computer system, said target user, based on targeting data of said computer system, stored in data storage means of said server; d. Sending said third computer message to said target user in order to simulate a phishing attack; e. Detection of at least one reaction to said third computer message implemented by said target user in said computer system.

[0011] According to advantageous and non-limiting features:

[0012] Step (b) includes identifying each original personalization data in said first computer message, and replacing it with a generic data representative of the type of personalization data.

[0013] Step (c) includes replacing each generic data with new personalization data of the same type.

[0014] The personalization data is chosen from an IBAN number, a bank card number, a name and / or a first name, an administrative number, an email address, a cryptocurrency wallet address, an IP address, a telephone number and a physical address.

[0015] Step (a) is implemented by a generative language model, in particular a large language model.

[0016] Said model presents a parameter representing the language of the first electronic message and / or a parameter representing a degree of anonymization to be applied.

[0017] Step (c) includes the prior determination of said target user based on said targeting data.

[0018] Said new personalization data is associated with the target user or with another individual determined according to said target user and said targeting data.

[0019] Step (d) includes, in addition, the sending of a fourth computer message to said target user based on the detected reaction.

[0020] Said first, second and third computer messages are electronic mail, in particular in .eml format.

[0021] According to a second aspect, the invention relates to a server of a computer system, characterized in that it comprises data processing means, configured to: - Obtain at least one initial computer message from a phishing attempt, said initial computer message including original personalization data; - generate a second computer message corresponding to the first computer message in which the said original personalization data has been anonymized; - generate a third computer message corresponding to the second computer message in which new personalization data has been introduced for at least one user of said computer system, said target user, based on targeting data of said computer system, stored in data storage means of said server; - to send said third computer message to said target user in order to simulate a phishing attack in said computer system; - detect at least one reaction to said third computer message implemented by said target user in said computer system.

[0022] According to a third and a fourth aspect, the invention relates to a computer program product comprising code instructions for executing a method according to the first aspect for implementing a method for detecting a vulnerability to a phishing attack in a computer system; and a computer-readable storage means on which is stored a computer program product comprising code instructions for execution of a method according to the first aspect for implementing a method for detecting a vulnerability to a phishing attack in a computer system. PRESENTATION OF FIGURES

[0023] Other features and advantages of the present invention will become apparent from the following description of a preferred embodiment. This description will be given with reference to the accompanying drawings in which:

[0024] [Fig.1] [Fig.1] is a diagram of a system for implementing the method according to the invention;

[0025] [Fig.2] [Fig.2] is a flowchart illustrating the steps of an embodiment of the process according to the invention. DETAILED DESCRIPTION

[0026] Architecture

[0027] With reference to [Fig.1], a computer system for implementing the present method of detecting a vulnerability to a phishing attack in said computer system has been schematically represented.

[0028] Detecting a vulnerability to a phishing attack means testing the system, and in particular its users, to assess the risk of compromise in the event of a phishing attempt, and to take appropriate action based on the result. The idea is to simulate an attack that is as realistic as possible (i.e., neither too obvious nor too perfect, but truly aligned with current phishing attempts), and to be able to observe the "damage" without taking any risk to the computer system. It should be noted that it is entirely possible that the phishing attempt will fail completely (due to vigilance and an appropriate response), and therefore no vulnerability will be detected. In that case, no action may be taken.

[0029] The term "computer system" refers to an IT infrastructure, typically that of a company, comprising a plurality of user devices (in particular, employees of said company) connected by a network, generally a local area network (where applicable, via a wide area network such as the internet, for example using a VPN). Users typically have individual accounts with the system, with varying access rights. It will be assumed, in particular, that they have an email account; see below.

[0030] Said user equipment 2 may be desktop PCs, smartphones, etc. However, the present invention will not be limited to any type of computer system.

[0031] The system further comprises at least one server 1, which may be remote and itself connected to the other equipment via said extended network such as the internet.

[0032] The server 1 and the equipment 2 include data processing means 11, 21, i.e. a computer such as, for example, a processor, a microprocessor, a controller, a microcontroller, an FPGA, etc. These computers are adapted to execute code instructions to implement the process described below.

[0033] The server 1 and the equipment 2 may also include data storage means 12, 22 (a memory, for example flash) possibly a user interface (typically a touch screen), etc.

[0034] Process

[0035] With reference to [Fig.2], the present method for detecting a vulnerability to a phishing attack in a computer system, implemented by the data processing means 11 of server 1, classically begins with a step (a) of obtaining at least one first computer message of a phishing attempt, said first computer message including original personal data.

[0036] By computer message, we preferably mean an email, i.e., an email, preferably in .eml format (or directly in HTML, or even in plain text), and we will use this example in the remainder of this description. Alternatively, it could be an SMS, a notification from a messaging application (WhatsApp, Telegram, etc.), a message on a social network, etc. As explained, we assume that the users of the computer system have at least one email account, for example, a professional email account.

[0037] Said first electronic message is advantageously a real message, i.e., received as part of a phishing attempt that has taken place. Indeed, as explained, the present method aims to simulate the most realistic attack possible, and therefore starting with real initial messages is optimal.

[0038] The first message can be obtained in any way possible: existing attack message databases can be used, or even messages received by users of said system during foiled phishing attempts can be taken.

[0039] It is further assumed that the first message includes original personalization data, i.e., user data making the message specific, or even personalized (as in the case of spear phishing mentioned). Preferably, said personalization data includes at least one piece of personal data belonging to at least one individual (potentially external to said computer system), and in particular

[0040] • an IB AN number

[0041] • a bank card number

[0042] • a name and / or a first name

[0043] • an administrative number, in particular an identification number for a public service (identity card number, driver's license number, health insurance card number, etc.)

[0044] • an email address

[0045] • an address of a cryptocurrency wallet

[0046] • an IP address

[0047] • a telephone number

[0048] • a physical address

[0049] It is advantageous to have at least one other personalization data in the first message, such as a URL or time information.

[0050] It is understood that the first email cannot be used, or at least presented to users for awareness-raising purposes, due to its personal nature. Indeed, this would raise privacy and data security issues, and storing it as is on data storage devices 12 of server 1 would create regulatory constraints (GDPR). Moreover, such a message would have little impact on anyone other than the individual from whom it borrows personal data.

[0051] Thus, in a step (b), the process includes the generation of a second computer message corresponding to the first computer message in which said original personalization data have been anonymized.

[0052] In other words, this is a step in anonymizing the first electronic message.

[0053] Anonymization means depersonalization, i.e., the removal of said original personalization data, and advantageously the transformation of this original personalization data into generic data, so that the electronic message is no longer related to an individual. The second message can be seen as a model of a phishing email (unusable in its current state).

[0054] It is understood that simple anonymization has no impact on the form of the message and allows:

[0055] • Maintaining the typography: the typography, including the font size, the The style (bold, italics, etc.), and the line and paragraph spacing, remain identical to those of the first message.

[0056] • Unaltered Fonts: the fonts used in the first message are preserved. This ensures that the visual style and aesthetics are not altered.

[0057] • compliance with the Graphic Charter: the graphic charter, including the colours, the Logos, images, and all other graphic elements are preserved. This is crucial for maintaining the visual identity and brand of the sender of the initial message.

[0058] Thus, step (b) is typically a step for generating the second email message, corresponding to the first email message in which the personalization data is replaced by the generic data. The latter is typically "codes," i.e., fields that generally identify the type of personalization data.

[0059] In this respect, step (b) advantageously includes identifying each original personalization data item and replacing it with a generic data item. Preferably, each personalization data item is classified (to identify its type), and the generic data item used is based on its class, i.e., each generic data item is representative of the type of personalization data item it replaces.

[0060] For example, personalization data can be processed in the following way:

[0061] • URLs are transformed into <url>

[0062] • the temporal data are transformed into<DATE_TIME>

[0063] • the IB ANs are transformed into<IB AN_CODE>

[0064] • the card numbers are transformed into<CREDIT_NUMBER>

[0065] • Administrative numbers are transformed according to the type into <MEDICAL_NUMBER> ,<LICENSE_NUMBER> ,<ID_NUMBER> , etc.

[0066] • email addresses are transformed into <EMAIL_ADDRESS>

[0067] • the addresses of a cryptocurrency wallet are transformed into <crypto>

[0068] • IP addresses are transformed into<IP_ADDRESS>

[0069] • Telephone numbers are transformed into<PHONE_NUMBER>

[0070] • Names / surnames are transformed into <person>

[0071] • physical addresses are transformed into <location>

[0072] Preferably, if there are several personalization data of the same type (i.e., relating to several individuals), these generic data can be numbered to distinguish them. Step (b) advantageously includes identifying each personalization data, or at least those of the same type, and adding a unique identifier to the corresponding generic data. It is understood that this identifier does not allow tracing back to the original data.

[0073] As an example, the first message might be as follows:

[0074] Hello Mr. Dupont,

[0075] We have retrieved the incident tickets of Mrs. Turpin and Mr. Lesot between 01 / 01 / 24 and 01 / 03 / 24.

[0076] Their information is below:

[0077] Mrs. Turpin

[0078] Telephone number: 06 64 37 87 98

[0079] IP address: 192.67.28.10

[0080] Mr. Lesot

[0081] Telephone number: 06 64 37 87 98

[0082] IP address: 192.15.28.26 Link to tickets

[0083] Yours sincerely,

[0084] Benoit Lasalle

[0085] 0618 6767 87

[0086] So the second generated message would be

[0087] Hello<PERSON_1> ,

[0088] We have escalated the incident tickets from<PERSON_3> and<PERSON_2> between the<DATE_TIME_2> and the<DATE_TIME_1> .

[0089] Their information is below:

[0090] <PERSON_3>

[0091] Telephone number:<PHONE_NUMBER_1>

[0092] IP address:<IP_ADDRESS_1 >

[0093] <PERSON_2>

[0094] Telephone number:<PHONE_NUMBER_1 >

[0095] IP address: <1P_ADDRESS_2>

[0096] <ure>

[0097] Yours sincerely,

[0098] <PERSON_4>

[0099] <PHONE_NUMBER_4>

[0100] It is understood that the second generated email no longer poses any privacy issues and can be stored on storage devices 12 and / or shared without any problem. It remains representative of a realistic and current situation.

[0101] The implementation of an anonymization step is well known to those skilled in the art and any known technique may be used.

[0102] It should be noted that computer messages remain written in natural language, even if they can be marked up (in the case of a structured format such as HTML). Thus, generative language models are particularly well suited.

[0103] By generative language model, we mean an artificial intelligence model capable of generating output text from a prompt. The generative language model is generally typically a large language model (LLM), in particular a pre-trained generative transformer (GPT) type model, for example GPT-4, LaMDA, LLaMA, BLOOM, etc.

[0104] Note that a dedicated model can be used, trained in particular on a basis of first and second reference computer message pairs (not necessarily related to phishing).

[0105] We can have a standalone module accessible via standard REST APIs to simplify integration into existing systems.

[0106] Preferably, the module can take as parameters the language of the first email message and / or an anonymization threshold and apply a language model best suited to apply anonymization.

[0107] As is known, the "anonymization threshold" is a parameter preferably between 0 and 1, representing a degree of anonymization applied to a dataset. It is used in data processing, particularly in the context of privacy protection and data security.

[0108] This threshold measures the level of anonymity guaranteed in a dataset. The higher the threshold, the more anonymous the data is considered to be.

[0109] • An anonymization threshold close to 0 indicates a low level of anonymization. This means that the data retains many of its original characteristics and is therefore potentially more easily identifiable or linked to specific individuals. In this case, there is a higher risk that the data could be re-associated or "de-anonymized" to real people, which raises privacy concerns.

[0110] • A threshold close to 1 suggests a high level of anonymization. This means that The data has been significantly modified to prevent the identification of individuals. With a high threshold, the risks of re-identification are minimized, thus offering better privacy protection.

[0111] Preferably; anonymization is applied, in the case of a message Structured, for each text segment of the first message between tags. The inside of the tags is ignored in order to avoid degrading the layout.

[0112] Next, the process includes a step (c) of generating a third computer message corresponding to the second computer message in which new personalization data has been introduced for at least one user of said computer system, based on targeting data of said computer system.

[0113] This is a step in repersonalizing the second message, which, it should be noted, now only contains generic data.

[0114] The first email contained original personalization data, meaning it was the data initially present and therefore unsuitable for the computer system in which vulnerabilities are being detected. In step (c), we wish to obtain a computer message containing new Personalization data, this time relating (among other things) to a user of the aforementioned computer system, referred to as the target user. There may well be personalization data relating to other individuals, for example, the target user's banker, but as we will see, this will not pose a privacy issue because the distribution of this third message will be limited to the target user. It should be noted that there may be several target users in the context of a larger phishing attempt (for example, targeting all members of a service), and in this case, there will generally be as many third messages generated from the second message, even if the same third message could be sent simultaneously to several target users.

[0115] The third message corresponds in other words to the first message in which the original personalization data has been replaced by new personalization data.

[0116] The idea is to obtain a third message that retains the structure, typography, fonts, and graphic design of the first message, thus protecting confidentiality while preserving the original and professional appearance of the document. This ensures that the email can still be used effectively for a phishing campaign without risking the compromise of personal information.

[0117] And using the second anonymized message makes this easy. Furthermore, it is very easy to generate several third messages in the case of multiple target users.

[0118] Indeed, as explained, "targeting data" is used, defining among other things the said new personalization data. This step (c) can also be implemented using a generative language model, but it can simply be implemented using rules determining which personalization data to introduce for each generic data point, the said targeting data defining the said rules.

[0119] Targeting data includes, for example, sets of personal data of users of the computer system (data which they themselves have provided, for example HR data or registration data), and it is sufficient to take the personal data of the type defined by the generic data.

[0120] Note that some new personalization data may be that of other individuals other than the said target user, including reference individuals who may themselves be users of the computer system (for example, a hierarchical superior, in the case of a "CEO fraud" phishing attempt, colleagues, or any users of the computer system), or even fictitious individuals.

[0121] Step (c) may further include the addition of predefined URLs and / or attachments depending on the targeting data.

[0122] Preferably, step (c) includes the prior determination of said target user, again based on said targeting data, as well as any other individuals involved.

[0123] In this respect, targeting data can define: - Phishing attempt scenarios, particularly those associated with lists of users likely to be targeted by this type of attack (for example, a "fake transfer order" attack targets users of the compatibility service), and the reference individuals associated with these users, defining any URLs / attachments to be added. Examples of such attacks include: • “Credentials” in the case where a login page is attached to the template, • “Click-Only” otherwise, • “Ransomware” if you want to include an attachment in the email to track its openings by users - the results of previous implementations of this process, and in particular of user processes that have not been tested for a long time and / or had previously failed; - predefined parameters, such as a difficulty level for the attempted attack.

[0124] If we take the previous example, we can have a scenario aimed at testing an advanced spear phishing attack on a person in the IT department (the target user), who will therefore be PERSON_1.

[0125] In PERSON_2 and PERSON_3 we put any two users of the computer system, likely to have opened an incident ticket.

[0126] In PERSON_4, we put the hierarchical superior of the target user.

[0127] In URL a link to a fake ticket access page asking the user to enter their credentials.

[0128] At the end of step (c) we have an electronic message ready.

[0129] Then, in a step (d), the process includes the emission of the third (or third) computer message(s) intended for the target user(s) in order to simulate a phishing attack.

[0130] This simply involves sending it automatically, for example with an email module, among the other usual emails to the target user. The user's address is known since they have an account in said system. Note that it is possible to add an object, or to play with the sender's address (depending on the scenario).

[0131] Note that the sending process can be configured immediately or scheduled, according to training objectives and a predefined timetable:

[0132] • Immediate sending: users receive third messages in real time.

[0133] • Scheduled sending: an administrator selects the date and time for sending the third parties messages to maximize user impact and engagement.

[0134] The present method thus makes it possible to train users very effectively to identify a phishing email, since it targets users with scenarios that reflect the types of messages they might actually receive. The use of data relevant to their specific role or department increases the likelihood that they will apply this learning in real-world situations.

[0135] Then, in a step (e), the means 11 detect at least one reaction to said third computer message implemented by said target user in said computer system. More precisely, the target user receives the third message following step (d), for example in their email inbox, and the idea is to determine what action is implemented on this received message.

[0136] For example, the user can:

[0137] - receive the third message and ignore it

[0138] - receive the third message and report it to the IT department

[0139] - click on the third message and delete it

[0140] - click on a URL in the third message

[0141] - Click on the URL and enter your credentials

[0142] - open an attachment from the third message.

[0143] This detection can be implemented in any known way, for example with acknowledgments, read acknowledgments, routines, or simply by monitoring traffic on said URL.

[0144] Step (d) thus makes it possible to determine the result of the phishing attempt. For example, if the target user clicks on the URL and enters their credentials, then the simulated attempt is (unfortunately) successful and a vulnerability has been identified.

[0145] If, on the contrary, all target users have appropriate reactions (deletion of the message and / or reporting to the IT department), then the simulated attempt is a failure and no vulnerability is detected.

[0146] Preferably, step (d) further includes sending a fourth computer message to the target user based on the detected reaction. This fourth message compares the target user's reaction with an expected reaction. The idea is to congratulate the user if they reacted correctly. correctly, or on the contrary to inform him that he did not detect the phishing attempt and that he could have compromised the security of the computer system if it had been a real and malicious attempt, instead of a simulation.

[0147] For example, if a link or attachment is clicked, the user may receive explanations as to why they should not have clicked, to avoid repeating the same mistake in the future.

[0148] Step (d) may further include the collection of reaction data gathered for storage on storage means 12, analysis, and conclusion on the risks of vulnerability at the computer system level, with identification of strengths and areas for improvement for future campaigns.

[0149] Server

[0150] According to a second aspect, the invention relates to the server 1 for the implementation of the method according to the first aspect.

[0151] This is therefore a computer system server, for detecting a vulnerability to a phishing attack in said computer system.

[0152] Server 1 comprises respectively data processing means 11 and data storage means 12.

[0153] The data processing means 11 of the first equipment 1 are configured to: - Obtain at least one initial computer message from a phishing attempt, said initial computer message including original personalization data; - generate a second computer message corresponding to the first computer message in which the said original personalization data has been anonymized; - generate a third computer message corresponding to the second computer message in which new personalization data has been introduced for at least one user of said computer system, said target user, based on targeting data of said computer system, stored in data storage means 12 of said server 1; - to send said third computer message to said target user in order to simulate a phishing attack in said computer system; - detect at least one reaction to said third computer message implemented by said target user in said computer system.

[0154] The invention may further relate to the computer system, comprising said server 1 and at least one device 2 of a user of said computer system, connected via a network 20.

[0155] Computer program product

[0156] According to a third and a fourth aspect, the invention relates to a computer program product comprising code instructions for the execution (on the data processing means 11 of the server 1) of a method according to the first aspect for the implementation of detection of a vulnerability to a phishing attack in a computer system; and a storage means (for example the data storage means 12 of the server 1) on which this computer program product is located.< / ure> < / location> < / person> < / crypto> < / url>

Claims

1.

2.

3.

4. Demands A method for detecting a vulnerability to a phishing attack in a computer system, characterized in that it comprises the implementation, by data processing means (11) of a server (1) of said computer system, of the following steps: a. Obtaining at least one initial computer message of a phishing attempt, said initial computer message including original personalization data; b. Generation of a second computer message corresponding to the first computer message in which the said original personalization data has been anonymized; c. Generation of a third computer message corresponding to the second computer message in which new personalization data have been introduced for at least one user of said computer system, said target user, based on targeting data of said computer system, stored in data storage means (12) of said server (1); d. Sending said third computer message to said target user in order to simulate a phishing attack; e. Detection of at least one reaction to said third computer message implemented by said target user in said computer system. A method according to claim 1, wherein step (b) comprises identifying each original personalization data of said first computer message, and replacing it with a generic data representative of the type of personalization data. A method according to claim 2, wherein step (c) comprises replacing each generic data point with a new personalization data point of the same type. A method according to any one of claims 1 to 3, wherein the personalization data is chosen from an IB / AN number, a bank card number, a surname and / or first name, an administrative number, an email address, a cryptocurrency wallet address, an IP address, a phone number and a physical address.

5. A method according to any one of claims 1 to 4, wherein step (a) is implemented by a generative language model, in particular a large language model.

6. A method according to claim 5, wherein said model has a parameter representing the language of the first electronic message and / or a parameter representing a degree of anonymization to be applied.

7. A method according to any one of claims 1 to 6, wherein step (c) comprises the prior determination of said target user based on said targeting data.

8. A method according to claim 7, wherein said new personalization data is associated with the target user or with another individual determined based on said target user and said targeting data.

9. A method according to any one of claims 1 to 8, wherein step (d) further comprises sending a fourth computer message to said target user based on the detected reaction.

10. A method according to any one of claims 1 to 9, wherein said first, second and third computer messages are electronic mail, in particular in .eml format.

11. Server (1) of a computer system, characterized in that it comprises data processing means (11), configured to: - Obtain at least a first computer message from a phishing attempt, said first computer message comprising original personalization data; - generate a second computer message corresponding to the first computer message in which said original personalization data has been anonymized; - generate a third computer message corresponding to the second computer message in which new personalization data has been introduced for at least one user of said computer system, said target user, based on targeting data of said computer system, stored in data storage means (12) of said server (1); - send said third computer message to said target user so as to simulate a phishing attack in said computer system; - detect at least one reaction to said third computer message implemented by said target user in said computer system.

12. Product computer program comprising code instructions for the execution of a method according to any one of claims 1 to 10 for the implementation of a method for detecting a vulnerability to a phishing attack in a computer system, when said program is executed on a computer.

13. Computer-readable storage means on which is recorded a computer program product comprising code instructions for executing a method according to any one of claims 1 to 10 for implementing a method for detecting a vulnerability to a phishing attack in a computer system.

Images