Method for detecting vulnerability to a phishing-type attack in a computer system

Abstract

The present invention relates to a method for detecting vulnerability to a phishing-type attack in a computer system, the method being characterised in that it comprises carrying out, by data processing means (11) of a server (1) of the computer system, the steps of: (a) obtaining at least a first computer message relating to a phishing attempt, the first computer message comprising original personalisation data; (b) generating a second computer message corresponding to the first computer message, wherein the original personalisation data have been anonymised; (c) generating a third computer message corresponding to the second computer message to which new personalisation data have been added for at least one user of the computer system, referred to as the target user, according to targeting data of the computer system stored in data storage means (12) of the server (1); (d) transmitting the third computer message to the target user so as to simulate a phishing-type attack; (e) detecting at least one reaction to the third computer message carried out by the target user in the computer system.

Description

[0001] Description

[0002] Title of the invention: Method for detecting a vulnerability to a phishing attack in a computer system.

[0003] GENERAL TECHNICAL FIELD

[0004] The present invention relates to the field of computer security. More specifically, it concerns a method for detecting a vulnerability to a phishing attack in a computer system.

[0005] STATE OF THE ART

[0006] Phishing is a cyberattack technique used to obtain a user's personal data, such as a password, credit card number, etc. The idea is to trick the victim into believing they are communicating with a trusted third party—a bank, government agency, company, etc. Most often, a fake email (using the same format as an email from the trusted third party and a very similar email address) is sent to the victim, inviting them to click on a link or attachment that will take them to a copy of an official website (with a fake login page prompting them to enter their personal information), or even directly load a virus. The attack can also be carried out through other electronic means, such as a message on a mobile social network or an SMS, or even by creating an entirely fake website from scratch.

[0007] Protection against such attacks is very complicated, because they do not exploit specific computer vulnerabilities, they only deceive users.

[0008] One solution is to educate and raise user awareness about proactively detecting phishing emails. By practicing with concrete examples, users can learn to identify warning signs, such as errors in the domain name or inconsistencies in the sender's address. However, it only takes one inattentive user to compromise an entire company's IT system.

[0009] Furthermore, we now have advanced phishing attacks known as spear phishing, in which the email is highly personalized (for example, the email mentions the victim's real IBAN and impersonates their bank advisor), making it more convincing. Raising awareness about spear phishing is much more challenging.

[0010] We are familiar with alternative mechanisms for automatically detecting phishing emails, based on filters, but they are not entirely satisfactory. Indeed, these filters are often "too strict" and can unduly block legitimate and non-fraudulent emails, so the user must regularly check the blocked emails (and in some cases there is a risk that they might unblock a genuinely fraudulent email).

[0011] The present invention improves the situation.

[0012] PRESENTATION OF THE INVENTION

[0013] The present invention therefore relates, in a first aspect, to a method for detecting a vulnerability to a phishing attack in a computer system, characterized in that it comprises the implementation, by data processing means of a server of said computer system, of the following steps:

[0014] (a) Obtaining at least one initial computer message of a phishing attempt, said initial computer message including original personalization data;

[0015] (b) Generation of a second computer message corresponding to the first computer message in which the said original personalization data has been anonymized;

[0016] (c) Generation of a third computer message corresponding to the second computer message in which new personalization data has been introduced for at least one user of said computer system, referred to as the target user, based on targeting data of said computer system, stored in data storage means of said server;

[0017] (d) Sending said third computer message to said target user in such a way as to simulate a phishing attack;

[0018] (e) Detection of at least one response to said third computer message implemented by said target user in said computer system.

[0019] According to advantageous and non-limiting characteristics:

[0020] Step (b) includes identifying each original personalization data in said first computer message, and replacing it with generic data representative of the type of personalization data.

[0021] Step (c) involves replacing each generic data point with a new personalization data point of the same type.

[0022] The personalization data is chosen from an IBAN number, a bank card number, a name and / or a first name, an administrative number, an email address, a cryptocurrency wallet address, an IP address, a telephone number and a physical address.

[0023] Step (a) is implemented by a generative language model, in particular a large language model.

[0024] The said model presents a parameter representing the language of the first email message and / or a parameter representing a degree of anonymization to be applied.

[0025] Step (c) includes the prior determination of said target user based on said targeting data.

[0026] This new personalization data is associated with the target user or another individual determined based on the target user and the targeting data. Step (d) further includes sending a fourth computer message to the target user based on the detected reaction.

[0027] The aforementioned first, second and third computer messages are emails, in particular in .eml format.

[0028] According to a second aspect, the invention relates to a server of a computer system, characterized in that it comprises data processing means, configured to:

[0029] - Obtain at least one initial computer message from a phishing attempt, said initial computer message including original personalization data;

[0030] - generate a second computer message corresponding to the first computer message in which the said original personalization data has been anonymized;

[0031] - generate a third computer message corresponding to the second computer message in which new personalization data has been introduced for at least one user of said computer system, said target user, based on targeting data of said computer system, stored in data storage means of said server;

[0032] - to send said third computer message to said target user in order to simulate a phishing attack in said computer system;

[0033] - detect at least one reaction to said third computer message implemented by said target user in said computer system.

[0034] According to a third and a fourth aspect, the invention relates to a computer program product comprising code instructions for executing a method according to the first aspect for implementing a method for detecting a vulnerability to a phishing attack in a computer system; and a computer-readable storage means on which is stored a computer program product comprising code instructions for executing a method according to the first aspect for implementing a method for detecting a vulnerability to a phishing attack in a computer system.

[0035] PRESENTATION OF THE FIGURES

[0036] Other features and advantages of the present invention will become apparent from the following description of a preferred embodiment. This description will be given with reference to the accompanying drawings, in which:

[0037] [Fig. 1] Figure 1 is a diagram of a system for implementing the process according to the invention;

[0038] [Fig.2] Figure 2 is a flowchart illustrating the steps of an embodiment of the process according to the invention.

[0039] DETAILED DESCRIPTION

[0040] Architecture

[0041] With reference to Figure 1, a computer system for implementing the present method of detecting a vulnerability to a phishing attack in said computer system has been schematically represented.

[0042] Detecting a vulnerability to a phishing attack means testing the system, and in particular its users, to assess the risk of compromise in the event of a phishing attempt, and then taking appropriate action based on the result. The idea is to simulate an attack that is as realistic as possible (i.e., neither too obvious nor too perfect, but truly aligned with current phishing attempts), and to observe the potential damage without actually jeopardizing the system. It's worth noting that the phishing attempt may fail completely (due to vigilance and an appropriate response), and therefore no vulnerability may be detected. In that case, no action may be taken.

[0043] The term "computer system" refers to an IT infrastructure, typically that of a company, comprising multiple devices and two user accounts (particularly those of the company's employees) connected via a network, generally a local area network (or, if necessary, a wide area network such as the internet, for example, using a VPN). Users typically have individual accounts with the system, with varying access rights. It will be assumed, in particular, that they have an email account (see below).

[0044] The user equipment 2 may be desktop PCs, smartphones, etc. However, the present invention will not be limited to any type of computer system.

[0045] The system further includes at least one server 1, which may be remote and itself connected to other equipment via said wide area network such as the internet.

[0046] Server 1 and equipment 2 include data processing means 11, 21, i.e. a computer such as, for example, a processor, a microprocessor, a controller, a microcontroller, an FPGA, etc. These computers are adapted to execute code instructions to implement the process described below.

[0047] Server 1 and equipment 2 may also include means of data storage 12, 22 (memory, for example flash) possibly a user interface (typically a touch screen), etc.

[0048] Method With reference to Figure 2, the present method for detecting a vulnerability to a phishing attack in a computer system, implemented by the data processing means 11 of server 1, begins classically with a step (a) of obtaining at least one first computer message of a phishing attempt, said first computer message including original personal data.

[0049] By computer message, we mean preferably an email, ideally in .eml format (or directly in HTML, or even plain text), and we will use this example throughout this description. Alternatively, it could be an SMS, a notification from a messaging application (WhatsApp, Telegram, etc.), a message on a social network, etc. As explained, we assume that the users of the computer system have at least one email account, for example, a work email account.

[0050] The first email in question is advantageously a real message, i.e., one received as part of a phishing attempt. Indeed, as explained, the present method aims to simulate the most realistic attack possible, and therefore starting with real initial messages is optimal.

[0051] The first message can be obtained in any way possible: existing attack message databases can be used, or even messages received by users of said system during foiled phishing attempts can be taken.

[0052] It is further assumed that the first message includes original personalization data, i.e., user data that makes the message specific, or even personalized (as in the case of spear phishing mentioned). Preferably, this personalization data includes at least one piece of personal data from at least one individual (potentially external to the computer system), and in particular

[0053] • an IBAN number

[0054] • a bank card number

[0055] • a surname and / or first name • an administrative number, in particular an identification number for a public service (identity card number, driver's license number, health insurance card number, etc.)

[0056] • an email address

[0057] • a cryptocurrency wallet address

[0058] • an IP address

[0059] • a telephone number

[0060] • a physical address

[0061] It is also advantageous to have at least one other piece of personalization data in the first message, such as a URL or time information.

[0062] It is understood that the aforementioned initial email cannot be used, or at least presented to users for awareness-raising purposes, due to its personal nature. Indeed, this would raise privacy and data security concerns, and storing it as is on data storage devices 12 of server 1 would create regulatory constraints (GDPR). Furthermore, such a message would have little impact on anyone other than the individual whose personal data it contains.

[0063] Thus, in a step (b), the process includes the generation of a second computer message corresponding to the first computer message in which the said original personalization data has been anonymized.

[0064] In other words, this is a step in anonymizing the first email message.

[0065] Anonymization refers to depersonalization, i.e., the removal of the original personalization data, and advantageously, the transformation of this original personalization data into generic data, so that the email is no longer related to an individual. The second message can be seen as a model of a phishing email (unusable in its current state).

[0066] It is understood that simple anonymization has no impact on the form of the message and allows: • the maintenance of the typography: the typography, including the size of the characters, the style (bold, italic, etc.), and the spacing of lines and paragraphs, remains identical to that of the first message.

[0067] • Intact Fonts: The fonts used in the first message are retained. This ensures that the visual style and aesthetics are not altered.

[0068] • Adherence to the Graphic Charter: The graphic charter, including colors, logos, images, and all other graphic elements, is preserved. This is crucial for maintaining the visual identity and brand of the sender of the initial message.

[0069] Thus, step (b) is typically a step for generating the second email, corresponding to the first email, in which the personalization data is replaced by generic data. This generic data is typically "codes," i.e., fields that generally identify the type of personalization data.

[0070] In this respect, step (b) advantageously includes identifying each original personalization data item and replacing it with a generic data item. Preferably, each personalization data item is classified (to identify its type), and the generic data item used is based on its class; that is, each generic data item is representative of the type of personalization data it replaces.

[0071] For example, personalization data can be processed in the following way:

[0072] • URLs are transformed into <url>

[0073] • temporal data are transformed into<DATE_TIME>

[0074] • IBANs are converted into<IBAN_CODE>

[0075] • the card numbers are converted into<CREDIT_NUMBER>

[0076] • Administrative numbers are transformed according to the type into<MEDICAL_NUMBER> ,<LICENSE_NUMBER> ,<ID_NUMBER> etc. • Email addresses are transformed into<EMAIL_ADDRESS>

[0077] • Cryptocurrency wallet addresses are transformed into <crypto>

[0078] • IP addresses are transformed into<IP_ADDRESS>

[0079] • The phone numbers are converted into<PHONE_NUMBER>

[0080] • Names / surnames are transformed into <person>

[0081] • Physical addresses are transformed into <location>

[0082] Preferably, if we have several personalization data points of the same type (i.e., relating to several individuals), we can number these generic data points to distinguish them. Step (b) advantageously includes identifying each personalization data point, or at least those of the same type, and adding a unique identifier to the corresponding generic data point. It is understood that this identifier does not allow tracing back to the original data point.

[0083] As an example, the first message might be: Hello Mr. Dupont,

[0084] We have retrieved the incident tickets of Mrs. Turpin and Mr. Lesot between 01 / 01 / 24 and 01 / 03 / 24.

[0085] Their information is below:

[0086] Ms. Turpin

[0087] Phone number: 06 64 378798

[0088] IP address: 192.67.28.10

[0089] Mr. Lesot

[0090] Phone number: 06 64 378798

[0091] IP address: 192.15.28.26

[0092] Link to the tickets. Sincerely,

[0093] Benoit Lasalle 06 18 67 67 87

[0094] So the second message generated would be

[0095] Good morning<PERSON_1> ,

[0096] We have escalated the incident tickets from<PERSON_3> and<PERSON_2> between the<DATE_TIME_2> and the<DATE_TIME_1> .

[0097] Their information is below:

[0098] <PERSON_3>

[0099] Telephone number:<PHONE_NUMBER_1>

[0100] IP address:<IP_ADDRESS_1>

[0101] <PERSON_2>

[0102] Telephone number:<PHONE_NUMBER_1>

[0103] IP address:<IP_ADDRESS_2>

[0104] <url>

[0105] Yours sincerely,

[0106] <PERSON_4>

[0107] <PHONE_NUMBER_4>

[0108] It is understood that the second generated email no longer poses any privacy issues and can be stored on storage devices and / or shared without any problems. It remains representative of a realistic and current situation.

[0109] The implementation of an anonymization step is well known to those skilled in the art, and any known technique can be used. It should be noted that computer messages remain written in natural language, even if they may be markuped (in the case of a structured format such as HTML). Therefore, generative language models are particularly well-suited.

[0110] A generative language model is an artificial intelligence model capable of generating output text from a prompt. Generative language models are typically large language models (LLMs), specifically pre-trained generative transformer (GPT) models, such as GPT-4, LaMDA, LLaMA, BLOOM, etc.

[0111] Note that a dedicated model can be used, trained in particular on a basis of first and second reference computer message pairs (not necessarily related to phishing).

[0112] We can have a standalone module accessible via standard REST APIs to simplify integration into existing systems.

[0113] Preferably, the module can take as parameters the language of the first email message and / or an anonymization threshold and apply a language model best suited to apply anonymization.

[0114] The "anonymization threshold," as is well known, is a parameter, preferably between 0 and 1, representing the degree of anonymization applied to a dataset. It is used in data processing, particularly in the context of privacy protection and data security.

[0115] This threshold measures the level of anonymity guaranteed in a dataset. The higher the threshold, the more anonymous the data is considered to be.

[0116] • An anonymization threshold close to 0 indicates a low level of anonymization. This means that the data retains many of its original characteristics and is therefore potentially more easily identifiable or linked to specific individuals. In this case, there is a higher risk that the data could be re-associated or "de-anonymized" to real people, which raises privacy concerns. • A threshold close to 1 suggests a high level of anonymization. This means that the data has been significantly modified to prevent the identification of individuals. With a high threshold, the risks of re-identification are minimized, thus offering better privacy protection.

[0117] Preferably, anonymization is applied, in the case of a structured message, to each text segment of the first message between tags. The content inside the tags is ignored to avoid disrupting the formatting.

[0118] Next, the process includes a step (c) of generating a third computer message corresponding to the second computer message in which new personalization data has been introduced for at least one user of said computer system, based on targeting data of said computer system.

[0119] This is a step in repersonalizing the second message, which, as a reminder, now only contains generic data.

[0120] The first email contained original personalization data, meaning it was the data initially present and therefore unsuitable for the computer system in which we are trying to detect vulnerabilities. In step (c), we aim to obtain an email containing new personalization data, this time relating (among other things) to a user of that computer system, referred to as the target user. This email may well contain personalization data relating to other individuals, such as the target user's banker, but as we will see, this will not pose a privacy issue because the distribution of this third email will be limited to the target user.Note that there may be several target users in the context of a larger phishing attempt (for example, targeting all members of a service), and in this case there will generally be as many third messages generated from the second message, even if the same third message could be sent at the same time to several target users.

[0121] The third message corresponds in other words to the first message in which the original personalization data has been replaced by new personalization data.

[0122] The idea is to obtain a third message that retains the structure, typography, fonts, and graphic design of the first message. This protects confidentiality while preserving the document's original and professional appearance. It ensures that the email can still be used effectively for a phishing campaign without risking the compromise of personal information.

[0123] And using the second, anonymized message makes this easy. Furthermore, it's very easy to generate multiple third messages when targeting several users.

[0124] Indeed, as explained, "targeting data" is used, defining, among other things, the aforementioned new personalization data. This step (c) can also be implemented using a generative language model, but it can simply be implemented using rules determining which personalization data to introduce for each generic data point, with the targeting data defining these rules.

[0125] Targeting data includes, for example, sets of personal data of users of the computer system (data that they themselves have provided, for example HR data or registration data), and it is sufficient to take the personal data of the type defined by the generic data.

[0126] Note that some new personalization data may be that of other individuals other than the said target user, including reference individuals potentially themselves users of the computer system (for example a hierarchical superior, in the case of a phishing attempt of the type "CEO fraud", colleagues, or any users of the computer system), or even fictitious individuals.

[0127] Step (c) may further include adding predefined URLs and / or attachments based on further targeting data.

[0128] Preferably, step (c) includes the prior determination of said target user, again based on said targeting data, as well as any other individuals involved.

[0129] In this respect, targeting data can define:

[0130] - Phishing attempt scenarios, particularly those associated with lists of users likely to be targeted by this type of attack (for example, a "fake wire transfer order" attack targets users in the compatibility department), and the reference individuals associated with these users, defining any URLs / attachments to be added. The following types of attacks are possible: o "Credentials" if a login page is attached to the template, o "Click-Only" otherwise, o "Ransomware" if an attachment is included in the email to track user opens.

[0131] - the results of previous implementations of this process, and in particular of user processes that have not been tested for a long time and / or had previously failed;

[0132] - predefined parameters, such as a difficulty level for the attempted attack.

[0133] If we take the previous example, we can have a scenario aimed at testing an advanced spear phishing attack on a person in the IT department (the target user), who will therefore be PERSON_1.

[0134] In PERSON_2 and PERSON_3, we put any two users of the IT system who might have opened an incident ticket. In PERSON_4, we put the hierarchical superior of the target user.

[0135] The URL contains a link to a fake ticket access page that asks the user to enter their credentials.

[0136] At the end of step (c) we have an email message ready.

[0137] Then, in a step (d), the process includes sending the third computer message(s) to the target user(s) in order to simulate a phishing attack.

[0138] This simply involves sending it automatically, for example using an email marketing module, among the target user's other regular emails. The user's email address is known since they have an account in the system. Note that a subject line can be added, or the sender's address can be changed (depending on the scenario).

[0139] Note that the sending process can be configured immediately or scheduled, according to training objectives and a predefined calendar:

[0140] • Immediate sending: users receive third messages in real time.

[0141] • Scheduled sending: an administrator selects the date and time for sending third messages to maximize impact and user engagement.

[0142] This method allows for highly effective training of users to identify phishing emails, as it targets them with scenarios that reflect the types of messages they might actually receive. Using data relevant to their specific role or department increases the likelihood that they will apply this training in real-world situations.

[0143] Then, in step (e), means 11 detect at least one reaction to said third computer message implemented by said target user in said computer system. More precisely, the target user receives the third message following step (d), for example in their email inbox, and the idea is to determine what action is implemented on this received message.

[0144] For example, the user can:

[0145] - receive the third message and ignore it

[0146] - receive the third message and report it to the IT department

[0147] - Click on the third message and delete it

[0148] - click on a URL in the third message

[0149] - Click on the URL and enter your credentials

[0150] - open an attachment from the third message.

[0151] This detection can be implemented in any known way, for example with acknowledgments, read acknowledgments, routines, or simply by monitoring traffic on said URL.

[0152] Step (d) thus allows us to determine the outcome of the phishing attempt. For example, if the target user clicks on the URL and enters their credentials, then the simulated attempt is (unfortunately) successful and a vulnerability has been identified.

[0153] If, on the other hand, all target users have appropriate reactions (deletion of the message and / or reporting to the IT department), then the simulated attempt is a failure and no vulnerability is detected.

[0154] Preferably, step (d) further includes sending a fourth computer message to the target user based on the detected reaction. This fourth message compares the target user's reaction with an expected reaction. The idea is to congratulate the user if they reacted correctly, or conversely, to inform them that they failed to detect the phishing attempt and that they could have compromised the security of the computer system if it had been a real, malicious attempt instead of a simulation.

[0155] For example, if a user clicks on a link or attachment, they may receive explanations as to why they should not have clicked, to prevent repeating the same mistake in the future. Step (d) may further include collecting and storing the response data on storage media, analyzing it, and drawing conclusions about the risks of vulnerability across the IT system, identifying strengths and areas for improvement for future campaigns.

[0156] Server

[0157] According to a second aspect, the invention relates to server 1 for the implementation of the method according to the first aspect.

[0158] This is a computer system server that detects a vulnerability to a phishing attack in said computer system.

[0159] Server 1 includes respectively data processing means 11 and data storage means 12.

[0160] The data processing means 11 of the first piece of equipment 1 are configured to:

[0161] - Obtain at least one initial computer message from a phishing attempt, said initial computer message including original personalization data;

[0162] - generate a second computer message corresponding to the first computer message in which the said original personalization data has been anonymized;

[0163] - generate a third computer message corresponding to the second computer message in which new personalization data has been introduced for at least one user of said computer system, said target user, based on targeting data of said computer system, stored in data storage means 12 of said server 1; - send said third computer message to said target user so as to simulate a phishing attack in said computer system;

[0164] - detect at least one reaction to said third computer message implemented by said target user in said computer system.

[0165] The invention may further relate to the computer system, comprising said server 1 and at least one device 2 of a user of said computer system, connected via a network 20.

[0166] computer program product

[0167] According to a third and a fourth aspect, the invention relates to a computer program product comprising code instructions for the execution (on the data processing means 11 of the server 1) of a method according to the first aspect for the implementation of detection of a vulnerability to a phishing attack in a computer system; and a storage means (for example the data storage means 12 of the server 1) on which this computer program product is located.< / url> < / location> < / person> < / crypto> < / url>

Claims

DEMANDS 1. A method for detecting a vulnerability to a phishing attack in a computer system, characterized in that it comprises the implementation, by data processing means (11) of a server (1) of said computer system, of the following steps: (a) Obtaining at least one initial computer message of a phishing attempt, said initial computer message including original personalization data; (b) Generation of a second computer message corresponding to the first computer message in which the said original personalization data has been anonymized; (c) Generation of a third computer message corresponding to the second computer message in which new personalization data has been introduced for at least one user of said computer system, referred to as the target user, based on targeting data of said computer system, stored in data storage means (12) of said server (1); (d) Sending said third computer message to said target user in such a way as to simulate a phishing attack; (e) Detection of at least one response to said third computer message implemented by said target user in said computer system.

2. A method according to claim 1, wherein step (b) comprises identifying each original personalization data of said first computer message, and replacing it with a generic data representative of the type of personalization data.

3. A method according to claim 2, wherein step (c) comprises replacing each generic data point with a new personalization data point of the same type.

4. A method according to any one of claims 1 to 3, wherein the personalization data is chosen from an IBAN number, a bank card number, a name and / or a first name, an administrative number, an email address, a cryptocurrency wallet address, an IP address, a telephone number and a physical address.

5. A method according to any one of claims 1 to 4, wherein step (a) is implemented by a generative language model, in particular a large language model.

6. Method according to claim 5, wherein said model has a parameter representing the language of the first electronic message and / or a parameter representing a degree of anonymization to be applied.

7. A method according to any one of claims 1 to 6, wherein step (c) comprises the prior determination of said target user based on said targeting data.

8. A method according to claim 7, wherein said new personalization data is associated with the target user or with another individual determined based on said target user and said targeting data.

9. A method according to any one of claims 1 to 8, wherein step (d) further comprises sending a fourth computer message to said target user based on the detected reaction.

10. A method according to any one of claims 1 to 9, wherein said first, second and third computer messages are electronic mail, in particular in .eml format.

11. Server (1) of a computer system, characterized in that it comprises data processing means (11), configured to: - Obtain at least one initial computer message from a phishing attempt, said initial computer message including original personalization data; - generate a second computer message corresponding to the first computer message in which the said original personalization data has been anonymized; - generate a third computer message corresponding to the second computer message in which new personalization data have been introduced for at least one user of said computer system, said target user, based on targeting data of said computer system, stored in data storage means (12) of said server (1); - to send said third computer message to said target user in order to simulate a phishing attack in said computer system; - detect at least one reaction to said third computer message implemented by said target user in said computer system.

12. Product computer program comprising code instructions for the execution of a method according to any one of claims 1 to 10 for the implementation of a method for detecting a vulnerability to a phishing attack in a computer system, when said program is executed on a computer.

13. A computer-readable storage medium on which a computer program product is recorded, comprising code instructions for executing a process according to one of the Claims 1 to 10 for the implementation of a method for detecting a vulnerability to a phishing attack in a computer system.

Images