Identifying malicious digital content

Abstract

A computer-implemented method for identifying malicious digital content. The method comprises: determining a set of features based on an item of digital content, wherein the set of features comprises a plurality of indicators each indicating whether the item of digital content exhibits a malicious characteristic; combining the item of digital content with the set of features to generate a modified representation of the item of digital content; forming at least one image based on the modified representation of the item of digital content; and identifying whether the item of digital content is malicious by inputting the at least one image to a classifier configured to classify whether input images are indicative of malicious content.

Description

[0001] IDENTIFYING MALICIOUS DIGITAL CONTENT

[0002] Field

[0003] The present disclosure concerns methods, computing systems, computer programs and computer readable media for identifying malicious digital content.

[0004] Background

[0005] Malicious digital content can refer to any kind of data or information that is designed to harm, deceive, or compromise the security or integrity of a user, device, network, or system. Some examples of malicious digital content are phishing emails, phishing websites, malware, ransomware, spyware, adware, and botnets. These types of content can cause various damages, such as stealing personal or financial information, locking or encrypting files, spying on user activities, displaying unwanted ads, or taking over computing resources.

[0006] One of the challenges of identifying malicious digital content is that it is often disguised or hidden in seemingly legitimate or benign content, such as emails from trusted sources, websites with similar domain names, or files with common extensions. Moreover, malicious digital content can evolve and adapt to avoid detection by conventional methods, such as signature-based or rule-based systems. Therefore, there is a need for more advanced and robust methods for identifying malicious digital content.

[0007] Machine learning is a branch of artificial intelligence that allows computers to learn from data and make predictions or decisions without explicit programming of rules. Machine learning can be used to identify malicious digital content by analysing various features or characteristics of the content, such as text, images, links, attachments, metadata, or network traffic. Machine learning can also learn from previous examples of malicious or benign content and update its models accordingly. Adaptive artificial intelligence (Al) is a recent form of artificial intelligence that learns, adapts and improves as it encounters changes, both in data and the environment. There are different types of machine learning techniques that can be applied to identify malicious digital content, such as supervised learning, unsupervised learning, semi-supervised learning, or reinforcement learning. Supervised learning is a technique where the machine learning model is trained on labelled data, i.e., data that has been annotated as malicious or benign by human experts or other sources. Supervised learning can use various algorithms, such as logistic regression, decision trees, neural networks, or support vector machines, to classify or score the content based on its features. For example, supervised learning can be used to detect phishing emails by analysing the email headers, body, subject, sender, or recipient.

[0008] Unsupervised learning is a technique where the machine learning model is trained on unlabelled data, i.e., data that has not been annotated as malicious or benign. Unsupervised learning can use various algorithms, such as clustering, anomaly detection, or dimensionality reduction, to discover patterns or outliers in the data. Semi-supervised learning is a technique that combines supervised and unsupervised learning, where the machine learning model is trained on a small amount of labelled data and a large amount of unlabelled data. Semi-supervised learning can use various algorithms, such as self-training, co-training, or generative models, to use the information from both types of data and improve the performance of the model. Reinforcement learning is a technique where the machine learning model learns from its own actions and feedback from the environment. Reinforcement learning can use various algorithms, such as Q- learning, policy gradient, or deep reinforcement learning, to optimise a reward function that reflects the goal of the task.

[0009] Based on a data survey conducted by Barracuda, spear phishing attacks have demonstrated a notably high success rate in comparison to other email attack types. In 2022, 50% of the surveyed organisations fell victim to spear phishing, and on average, a typical organisation received five highly personalised spearphishing emails daily. Additionally, the survey highlighted that organisations with over 50% of their workforce operating remotely experience prolonged timelines for both detecting and responding to email security incidents. These companies took 55 hours, on average, to detect such incidents and 63 hours to respond and mitigate them. This is in contrast to organisations with a lower percentage of remote workers, which reported an average of 36 hours for detection and 51 hours for response and mitigation. Therefore, spear phishing is a particular risk for organisations, in addition to other types of spam / phishing.

[0010] It is an object of the present disclosure to address various shortcomings in known methods for identifying malicious digital content. For example, it is an object of the disclosure to improve the reliability with which malicious digital content can be identified.

[0011] Summary

[0012] The present disclosure relates to methods for determining whether content is malicious (e.g., phishing) or not. Other cyber threats can also be identified.

[0013] Some embodiments of the disclosure use machine learning, Boolean logic operations, and image visualisation. For example, machine learning can be used to analyse various features or characteristics of image-based representations of digital content, such as text, images, links, attachments, metadata, or network traffic, and to learn from previous examples of malicious or benign content.

[0014] Some embodiments of the present disclosure perform binary visualisation of modified representations of potentially malicious content. For example, various types of logic gates, such as XOR, OR, AND, NOR, NOT, and XNOR, can be used to combine a set of features with an item of content. Other ways of combining features with content can also be used, such as convolution.

[0015] Images can be generated from the resulting modified representations and such images can be used to classify the underlying content used to generate the modified representations.

[0016] Also provided is a method for training a classifier to be used in the methods described herein.

[0017] Accordingly, against this background and in accordance with aspects of the present disclosure, there are provided a computer-implemented method according to claim 1, a computer-implemented method according to claim 20, a computing system according to claim 21, a computer program product according to claim 22, a computer readable medium according to claim 23, a training data set according to claim 24 and a computer readable medium according to claim 25.

[0018] Specifically, the present disclosure provides a computer-implemented method for identifying malicious digital content, the method comprising: determining a set of features based on an item of digital content, wherein the set of features comprises a plurality of indicators each indicating whether the item of digital content exhibits a malicious characteristic; combining the item of digital content with the set of features to generate a modified representation of the item of digital content; forming at least one image based on the modified representation of the item of digital content; and identifying whether the item of digital content is malicious by inputting the at least one image to a classifier configured to classify whether input images are indicative of malicious content. By combining the item of digital content with the set of features, malicious characteristics in the content can be amplified, since malicious and non-malicious content will exhibit slightly different behaviour when combined with the set of features. Thus, the methods described herein can emphasise the malicious characteristics of content, which can improve the accuracy of classification when the augmented images are fed into a classifier. Thus, the disclosure provides an advantageous way of pre-processing data for uses in classification.

[0019] In another aspect, the disclosure provides a computer-implemented method for training a classifier to identify malicious digital content, the method comprising: for each of a plurality of items of digital content, determining a set of features based on the respective item of digital content, wherein each set of features comprises a plurality of indicators each indicating whether the respective item of digital content exhibits a malicious characteristic; combining each item of digital content with the respective set of features to generate respective modified representations of the plurality of items of digital content; for each item of digital content, forming at least one image based on the respective modified representation; and training a classifier to classify whether input images are indicative of malicious content using the modified representations of the items of digital content and classification data for the plurality of items of digital content, the classification date indicating whether each item of digital content is malicious. Thus, this provides a trained classifier that can be used to advantageous effect in the classification methods described herein.

[0020] A computing system comprising one or more processor(s) adapted to perform the methods described herein is provided. This can execute a local or a software-as- a-service implementation. A computer program product comprising instructions that, when the program is executed by a computing system, cause the computing system to carry out the methods described herein is provided. A computer readable medium having stored thereon the computer program product is provided.

[0021] A training data set comprising a plurality of items of digital content and classification data for the plurality of items of digital content, the classification data indicating whether each item of digital content is malicious, the plurality of items of digital content each being combined with a respective set of features, each set of features comprising a plurality of indicators each indicating whether the respective item of digital content exhibits a malicious characteristic. A computer readable medium having stored thereon the training data set is also provided.

[0022] The advantages above-noted and other advantages of the present disclosure will be apparent from the following detailed description.

[0023] Listing of Figures

[0024] Embodiments of the present disclosure will now be described by way of example and with reference to the following figures, in which :

[0025] Figure 1 illustrates a method 100 according to an embodiment of the present disclosure;

[0026] Figure 2 illustrates a method 200 according to an embodiment of the present disclosure;

[0027] Figure 3 illustrates how a modified representation of digital content can be formed using embodiments of the present disclosure;

[0028] Figure 4 shows an example computing system 400 according to an embodiment of the present disclosure, for implementing the methods described herein; Figures 5A and 5B show how different types of digital content can be classified using embodiments of the present disclosure;

[0029] Figure 6 shows a legitimate website and a phishing website that can be distinguished using embodiments of the present disclosure;

[0030] Figure 7 shows how input features and websites can be used to form modified representations of digital content;

[0031] Figure 8 shows a confusion matrix for evaluating performance of embodiments of the present disclosure;

[0032] Figure 9 shows how modified representations of legitimate and malicious content can be formed using embodiments of the present disclosure using an AND operation;

[0033] Figure 10 shows how modified representations of legitimate and malicious content can be formed using embodiments of the present disclosure using a NAND operation;

[0034] Figure 11 shows how modified representations of legitimate and malicious content can be formed using embodiments of the present disclosure using a NOR. operation;

[0035] Figure 12 shows how modified representations of legitimate and malicious content can be formed using embodiments of the present disclosure using a NOT operation;

[0036] Figure 13 shows how modified representations of legitimate and malicious content can be formed using embodiments of the present disclosure using an OR operation;

[0037] Figure 14 shows how modified representations of legitimate and malicious content can be formed using embodiments of the present disclosure using an XNOR operation;

[0038] Figure 15 shows how modified representations of legitimate and malicious content can be formed using embodiments of the present disclosure using an XOR operation;

[0039] Figure 16 shows a continuous function (e.g., a point spread function) that can be used to represent a set of features instead of a binary string, which can be combined with (e.g., convolved with) an item of digital content to generate a modified representation of the item of digital content; and Figure 17 shows a database resulting from applying different functions to website source code and training a model for (A) legitimate content (i.e., not spam) and (B) spam content.

[0040] Detailed Description

[0041] Embodiments of the disclosure relates to systems and methods for detecting phishing (e.g., spear-phishing) in emails, or for identifying other types of malicious content.

[0042] Attackers often craft email messages (or other content) to deceive the recipient into believing that the received message is legitimate. Embodiments of this disclosure employ advanced algorithms (e.g., machine learning), logic gates (e.g., data XOR-ing), and ways of representing content as images (e.g., binary visualisation) to effectively counteract spear phishing threats and other malicious content. By utilising a visual representation of the content and extracting features from email objects, some embodiments allow for faster and more accurate detection and mitigation of spear phishing attempts. In simpler terms, some embodiments described herein meticulously analyse various elements within emails (e.g., sender information, message content, embedded links, hidden text, and email size), to identify patterns indicative of deceptive practices. Subsequently, the source of the email message is converted to binary content representing the email (or, in some embodiments that apply similar techniques to websites, HTML source code of a website may be provided in binary form) can be combined with feature values to create distinctive string values that can be easily examined for anomalies. This unique approach facilitates the generation of a distinct 2D image (or a 3D image can also be produced in some embodiments, but this requires more intensive computations) that can be fed into machine learning models for final classification using selected learning (e.g., deep learning) algorithms. To accomplish this, some embodiments convert the binary content of the created string into its two-dimensional visual representation using the RGB plot and space-filling curves.

[0043] In the present digital environment, this approach is advantageous due to the escalating sophistication of malware and phishing attacks. These attacks present substantial risks to both individuals and organisations, employing targeted and advanced methods to deceive specific individuals or groups. Therefore, one aim of the present disclosure is to identify these malicious activities in their early stages, aiming to prevent unauthorised access, data breaches, and other cyber threats linked to spear phishing. What distinguishes this disclosure is its proactive and adaptive character, continuously evolving to stay ahead of emerging spear phishing techniques. This quality ensures a robust defence against targeted emailbased cyber threats. Unlike most existing solutions that are available today (which typically use databases, such as PhishTank, which has human interaction, which the present disclosure seeks to avoid or at least reduce), the result of this innovation is an automated and faster process of detecting phishing (including, for example, spear phishing) attacks, which can deal with the challengeable nature and the short life cycle of these attacks. The automated process does not require further user interaction, which allows faster and more accurate detection process. In addition, it is cost-effective, scalable, and can be customised as per user requirements. It further helps organisations to save resources, expenses, and efforts. Some embodiments of the present disclosure introduce an approach to countering malicious threats through the utilisation of advanced algorithms (e.g., ML), data XOR-ing (or other logic gates), and binary visualisation.

[0044] Moreover, the integration of Boolean functions, such as data XOR-ing techniques, introduces an additional level of utility and security. The inclusion of data XOR-ing or other convolutional and / or Boolean techniques is particularly advantageous in elevating the performance of the model, specifically within the domain of feature engineering. XOR-ing various features and variables generates a distinctive binary representation, unveiling concealed patterns and relationships in the data. This can advantageously improve the identification of intricate feature combinations that serve as indicators of spear phishing attempts. The incorporation of XOR in this manner therefore helps to augment the overall effectiveness and performance of the methods disclosed herein.

[0045] In summary, therefore, some embodiments of this disclosure provide a distinctive combination of advanced deep learning algorithms, data XOR-ing, and binary visualisation techniques. Together, these can provide an effective approach to counteracting malicious content and spear phishing threats. Figure 1 shows a method 100 according to an embodiment of the present disclosure. The method 100 is a computer-implemented method 100 for identifying malicious digital content. For example, the method 100 can identify spam, phishing, malicious code and the like.

[0046] The method comprises determining 101 a set of features based on an item of digital content. The set of features comprises a plurality of indicators each indicating whether the item of digital content exhibits a malicious characteristic. The indicators could comprise indications of any one or more of: whether the item of digital content has a Uniform Resource Locator (URL) length exceeding a threshold value; whether the indication of the item of digital content is an Internet Protocol (IP) address; whether the item of digital content performs redirection; whether the item of digital content uses Hypertext Transfer Protocol Secure (HTTPS); whether the item of digital content has been indexed by a search engine (e.g., Google index, meaning that if a user searches a search engine using the title in the code, it will list the specific URL); and whether the item of digital content is a subdomain. In some cases, the indicators could indicate whether any one or more of the features in the Table titled "Email Features Adopted from the Literature and Some Phishing Words Use by Attackers" is present. The set of features could be a binary string and each indicator could be at least one bit of the binary string. Examples of binary strings showing different sets of features are shown in the cubes in Figures 5A and 5B.

[0047] The method 100 further comprises combining 102 the item of digital content with the set of features to generate a modified representation (e.g., modified code, such as modified binary code) of the item of digital content. The method 100 can comprise a step of representing the item of digital content in binary form (e.g., by converting its source code into binary) and in such a case, the step of combining 102 the item of digital content with the set of features may comprise combining the binary form with the set of features.

[0048] Combining 102 the item of digital content with the set of features may comprise applying a Boolean function to the item of digital content and the set of features. For example, the Boolean function may comprise any one or more of: AND; NAND; XNOR; XOR; OR; and NOR. The method 100 may comprise dividing the item of digital content into a plurality of portions, each portion of the plurality of portions being combined with the set of features. The modified representation of the item of digital content may be a concatenation of the combination of each portion of the plurality of portions with the set of features. Combining each portion of the plurality of portions with the set of features may comprise applying a Boolean function to each portion of the plurality of portions and the set of features.

[0049] In some examples described herein, five / six features are combined with an item of content. For example as discussed in more detail below, an HTML source is combined with six features using XOR to produce a new XOR HTML file with these six features. However, this process could be modified: for example, XOR could be used to combine the first two features, AND could be used to combine the next two features, and NOT could be used to combine the last two features, or any other combination of functions could be used. Thus, in generalised terms, combining the item of digital content with the set of features could comprise applying a plurality of different Boolean functions to the item of digital content and the set of features. For example, a first subset of the set of features could be combined using a first Boolean function and a second subset of the features could be combined using a second, different, Boolean function.

[0050] The method 100 further comprises forming 103 at least one image based on the modified representation of the item of digital content. This could be performed by performing a binary visualisation representation method, for example. Therefore, in a general sense, when a website is being assessed, the initial URL source code may be converted to binary, which may be combined using a logic gate (e.g., using XOR) with the features and a new binary can be created. This new binary can be used to produce one or more images. In some cases, this could be 3 images: an XOR image; an XOR magnitude; and an XOR entropy image. These can be determined based on the mathematical methods described in: https: / / corte.si / posts / visualisation / entropy / (https: / / web.archive.Org / web / 20240512164301 / https: / / corte.si / posts / visualisati on / entropy / ) and https: / / www.omnicalculator.com / math / vector-magnitude (https: / / web.archive.Org / web / 20240404064443 / https: / / www.omnicalculator.com / math / vector-magnitude).

[0051] In some cases, the modified representation of the item of digital content could be used to form at least one image in different ways. For example, either during binary visualisation, or after binary visualisation, a Fourier transform image manipulation method (e.g., a Fourier transform, or an inverse Fourier transform) could be performed, or some other image manipulation method could be used. An example of such an approach can be found in https: / / web.archive.Org / web / 20231216033716 / https: / / homepages.inf.ed.ac.uk / r bf / HIPR2 / fourier.htm, which is incorporated herein by reference.

[0052] Finally, the method 100 comprises identifying 104 whether the item of digital content is malicious by inputting the at least one image to a classifier configured to classify whether input images are indicative of malicious content. As mentioned previously, identifying 104 whether the item of digital content is malicious could comprise identifying whether the item of digital content is any one or more of: phishing; spam; and / or malicious code. The classifier may provide an output indicative of whether the content is malicious. This could be a binary indication of whether the content is malicious, or this could be a probability of whether the content is malicious. This indication of the classification result could be received and provided to a user, or action (e.g., quarantining, or deleting) could be taken automatically based on the result. The methods described herein could be implemented on an email server to allow incoming emails to be analysed, classified, and dealt with (e.g., quarantined) before they are ever provided to a user's device.

[0053] The step of combining 102 the item of digital content can be performed in other ways. The approach of XOR-ing (or using other logic gates) is similar in some respects to convolving two signals. Therefore, the step of combining 102 the item of digital content with the set of features may comprise convolving a set of features with the item of digital content to generate the modified representation of the item of digital content. For instance, the set of features could be represented as a waveform, where the amplitude of the wave at a certain position represents whether a certain malicious characteristic is present. For example, instead of a binary string 0101 representing the presence of two malicious characteristics, an equivalent waveform (which could be represented as a piecewise function) defining the set of features could have an amplitude of 0 between 0% to 25% along the x- axis, a Gaussian function (or any other curve having a peak) between 25% to 50% along the x-axis, an amplitude of 0 from 50% to 75% along the x-axis and another Gaussian function (or any other distribution having a peak) from 75% to 100% along the x-axis. Therefore, a smooth curve having two peaks can be defined, and such a function could be convolved with an image representation of the digital content to thereby produce a modified representation of the digital content. An example of such a function (representing the binary string 0101) is shown in Figure 16. Various other techniques from image processing (e.g., using point spread functions) could be used to effectively scatter the information from the set of features throughout the item of digital content when creating the modified representation of the digital content.

[0054] Figure 2 shows a method 200 according to an embodiment of the present disclosure. The method 200 is a computer-implemented method for training a classifier to identify malicious digital content. The digital content could be, for example, any one or more of: an email; a website; a file; and an executable file.

[0055] The classifier can be used in the method 100 of Figure 1 and so all discussion in relation to Figure 1 applies equally to Figure 2, and vice versa. The method 200 may in effect comprise repeating the determining 101, combining 102 and forming 103 steps of the method 100 of Figure 1 on digital content for which classification data is known, and using this to train a classifier.

[0056] The method 200 comprises, for each of a plurality of items of digital content, determining 201 a set of features based on the respective item of digital content, wherein each set of features comprises a plurality of indicators each indicating whether the respective item of digital content exhibits a malicious characteristic.

[0057] The method comprises combining 202 each item of digital content with the respective set of features to generate respective modified representations of the plurality of items of digital content. The method comprises, for each item of digital content, forming 203 at least one image based on the respective modified representation. The at least one image may comprise an image depicting a binary representation of the item of digital content. The at least one image may comprise any one or more of: an entropy image depicting the modified representation of the item of digital content; a detail image depicting the modified representation of the item of digital content; and / or a magnitude image depicting the modified representation of the item of digital content.

[0058] Finally, the method comprises training 204 a classifier to classify whether input images are indicative of malicious content using the modified representations of the items of digital content and classification data for the plurality of items of digital content, the classification date indicating whether each item of digital content is malicious.

[0059] Figures 1 and 2 show how an item of content can be classified and how a classifier can be trained, respectively. In some cases, the content provided as an input in these methods may be the digital content itself, but in some cases, the input could be, for example, a link or URL allowing the content to be retrieved. Thus, in some embodiments, the methods 100 and 200 may comprise receiving an indication of the item of digital content and retrieving the item of digital content based on the indication of the item of digital content prior to combining the item of digital content with the set of features. The indication of the item of digital content may comprise any one or more of: a Uniform Resource Locator (URL) of the item of digital content; an Internet Protocol (IP) address of the item of digital content; and a filepath of the item of digital content.

[0060] Figure 3 shows a process of combining an item of digital content with a set of features. An item of content (e.g., a URL) is represented in binary by a binary string of length L. In this example the binary representation comprises 20 bits and so L is 20. The bits are indexed from 1 to 20 in Figure 3 for ease of illustration. In reality, most items of content will be represented by far more than 20 bits, but the method can be applied to content of any length. A set of N features is determined based on the content. In the example of Figure 3, the set of features is [1,1, 0,1,0] and so N is 5. The set of features may be determined by inspecting the content for potentially malicious characteristics and forming a binary string where each bit indicates the presence (or absence) of a respective characteristic. For example, the 5 characteristics could be: whether the URL of the content is only an IP address; whether the URL of the content is very long; whether the URL is a subdomain (e.g., http: / / microsoft.xyz.com); whether the URL performs redirecting (e.g., domain is http: / / microsoft.xyz.com and is redirecting to http: / / microsoft.com); and whether the URL uses HTTPS. Since the first 4 characteristics in this list are potentially suspicious while using HTTPS is not suspicious, a website that has the set of features [1,1, 1,1,0] would be highly suspicious. This set of features can be described as comprising a plurality of indicators, each indicator indicating whether the item of digital content exhibits a malicious characteristic.

[0061] In Figure 3, there are two different types of possible output, as shown in the tablet of Figure 3. To obtain the "XOR Result" (the fifth column in the table), the L bits of the content are divided into M portions, each of length N. The number of portions is M = b N. Therefore, since L is 20 and N is 5, the number of portions is M=4. Each of the portions is combined with the set of features using, in this example, an XOR function (although other logic gates could be used). The outcome of this process is an M-bit string (i.e., a 4-bit string in this worked example). This generates a resultant Binary output, [0,1, 0,1], which acts as a modified representation of the item of digital content. Effectively, a plurality of portions (e.g., 4-bit portions in this example) of the content are combined with the features and the result is concatenated into the binary output 0101, as shown in the fifth column of Figure 3. The modified representation of the item of digital content can be used to form an image, which can then be classified using the methods described herein (e.g., as in Figure 1) or used to train a classifier (e.g., as in Figure 2).

[0062] An alternative method to provide a modified representation of the item of digital content is to obtain the "Content XOR Binary", which is the fourth column in the table. In this case, the modified representation that is output is the result of X0R- ing each individual bit in the Content Binary with the Feature Binary (which is repeated, as shown in the third column). Therefore, in this case, the modified representation (Content XOR Binary) is a binary string having the same length as the Content Binary. In Figure 3, fourth column, the modified representation of the item of content is a 20-bit string. In the worked examples described below, the Content XOR. Binary is used. However, depending on the particular website source, either the first method (i.e., using XOR Result column) or the second method (i.e., using the Content XOR Binary column) can provide good images. Thus, embodiments of the present disclosure are not limited to either approach. In this disclosure, the step of combining the item of digital content with the set of features could be performed by combining the entirety of a specific N-bit portion with an N- bit set of features (the XOR Result method), or each individual bit within the L-bit item of content could be combined with a respective bit representing a particular feature (the Content XOR Binary method).

[0063] The classifiers described herein may comprise any one or more of: a machine learning model; multiple machine learning models; a neural network; a Random Forest (RF); a Convolutional Neural Network (CNN); AlexNet, which is a CNN comprising three fully-connected layers and five convolutional layers, wherein one or more of the convolutional layers is followed by a max-pooling layer); a Naive Bayes (NB) classifier; a Support Vector Machine (SVM); a Backpropagation Neural Network (BPNN); an Adaptive Boosting algorithm; a Logistic Regression classifier; and a Decision Tree. BPNNs are particularly advantageous in the methods described herein. The classifier may be a trained image classifier. The methods described herein can be used with algorithms that do not need a large amount of training, such as MobileNet and EfficientNetBO. Using such algorithms, the methods described herein could work in light devices while still achieving 99% accuracy.

[0064] Additionally or alternatively, the classifiers described herein could combine multiple (e.g., at least two, or 3-4) algorithms together. For instance, 3-4 machine learning algorithms could be combined in an ensemble learning technique. Ensemble learning combines multiple learners to improve predictive performance and can address issues resulting from limited datasets. Ensemble learning techniques may aggregate two or more learners (e.g. regression models, neural networks) in order to produce better predictions. The ensemble learning techniques described herein can employ parallel (including homogenous and heterogenous methods) or sequential methods. Parallel methods train each base learner separately from the others. Sequential methods train a new base learner so that it minimizes errors made by a previous model trained in the preceding step; in other words, sequential methods construct base models sequentially in stages. Various ensemble learning techniques could be used, including bagging (a homogenous parallel method sometimes called bootstrap aggregating), stacking (sometimes referred to as stacked generalisation), or boosting algorithms.

[0065] Figure 4 shows an example computing system 400, according to another embodiment of this disclosure, for implementing the methods described in this disclosure. Specifically, Figure 4 is a block diagram illustrating an arrangement of a system 400 for implementing the present disclosure. Some embodiments of the present disclosure are designed to run on general-purpose desktop or laptop computers. Therefore, according to an embodiment, a computing system 400 is provided having a central processing unit (CPU) 402, and random access memory (RAM) 404 into which data, program instructions, and the like can be stored and accessed by the CPU 402.

[0066] The computing system 400 is provided with a display screen 406, and input peripherals in the form of a keyboard 408, and a mouse 410. The keyboard 408 and the mouse 410 communicate with the system 400 via a peripheral input interface 412. Similarly, a display controller 414 is provided to control display 416, so as to cause it to display images under the control of CPU 402. Data 418, for example digital content files in any format (e.g., .eml, .html, etc.) can be input and / or output (e.g., over a network) into the system 400 and stored via the communications interface 420. In this respect, the system 400 comprises a computer readable storage medium 422, such as a hard disk drive, writable CD or DVD drive, zip drive, solid state drive, USB drive or the like, upon which data 418 can be stored. Alternatively, the data 418 could be stored on a web-based platform, for example, a database, and accessed via an appropriate network. A computer readable storage medium 422 also stores various programs, which when executed by the CPU 402 cause the system 400 to operate in accordance with some embodiments of the present disclosure. The communications interface 420 is also connected to a cloud server 428, where various tasks can be performed in certain embodiments. For example, heavy machine learning computations and learning may be performed on the cloud server 428, with a local client program sending the data to the cloud server 428 and receiving responses from the cloud server. In some cases, a local detection process could also run locally on the computing system 400.

[0067] A control interface program 424 is provided, which when executed by the CPU 402 provides overall control of the computing apparatus, and in particular provides a graphical interface on the display 416, and accepts user inputs using the keyboard 408 and the mouse 410 by the peripheral interface 412. Such a control interface 424 can be used when classifying digital content and / or when training a classifier to classify digital content. The control interface program 424 may also call, when appropriate, other programs to perform specific processing actions. The user launches the control interface program 424. The control interface program 424 is loaded into RAM 404 and is executed by the CPU 402. The user then launches a program 426, which acts on the input data 418 as described above. The program instructions 426 executed by the CPU 402 relate to the method as described in any of the other embodiments of this disclosure.

[0068] It should be noted that a cloud-based ML architecture may be used with cloud computing resources used to develop, train, and deploy machine learning models. Such an architecture might involve the following functionality, elements and / or components:

[0069] Data storage and processing - cloud-based storage solutions may be used to store and process large volumes of data used to train machine learning models;

[0070] Model training - cloud-based computing resources, such as virtual machines and GPUs, may be used to train machine learning models;

[0071] Model deployment - trained models may be trained and / or deployed on the cloud, where they can be accessed by users and applications;

[0072] Model management - cloud-based tools may be used to manage the lifecycle of machine learning models, including versioning, monitoring, and updating.

[0073] In a cloud-based system, the computing system 400 may provide a user interface for a user to interact with embodiments of the present disclosure. For example, an embodiment of the present disclosure may be hosted remotely, i.e. in the cloud. That is, any classification systems described herein may be implemented in the cloud. The computing system 400 may communicate over a network (e.g., the internet) to a remote server storing such a cloud-based system.

[0074] It will be appreciated that the hardware shown in Figure 4 and described above are provided by way of example only and can be replaced by various computing arrangements configured to perform the processes described herein. For instance, Figure 4 shows a local implementation of a computing system. However, the architecture of Figure 4 could be replaced by a cloud-based system in which detection of malicious content is performed in the cloud.

[0075] For example, in some embodiments, detection of malicious content can be delivered as part of a cloud-hosted software-as-a-service (SaaS) platform. In this way, customers can access it remotely through the internet (or some other network) while the backend handles the infrastructure, maintenance, and updates. For instance, when an email reaches a mail server that uses the technology described herein, every embedded URL may be extracted and sent to a trained classifier (e.g., an ensemble-learning engine) that evaluates the link for malicious behaviour in real time. Because the engine can (in some embodiments) combine multiple ML models, it can achieve higher detection accuracy than any single model alone. If no threats are found, the message may be released to a user's device; otherwise, it may be quarantined. For webmail users, a lightweight browser extension may allow them to highlight any link and submit it to the same SaaS engine, which can return a verdict on whether the content is malicious. Agents can be provided on a browser and / or within Outlook as part of an SaaS Al detector.

[0076] To aid understanding of embodiments of the present disclosure, a worked example is provided.

[0077] Worked Example

[0078] This Worked Example relates to a method for detecting phishing utilising machine learning, binary visualisation, and various logic gates including, for example, XOR, OR, AND, NOR, NOT, and XNOR. An advanced phishing detection framework is presented, which integrates ML (Machine Learning) algorithms, logical operations (XOR, OR, AND, NOR, NOT, and XNOR), and image visualisation techniques. This approach achieves accuracy rates of 99.71% with Backpropagation Neural Network (BPNN) and 99.34% with convolutional neural network (CNN) when using XOR operations. By incorporating the logic gates operations, the method enhances data security by strengthening the dataset against decryption attempts and upholding overall data integrity. Furthermore, the integration of image visualisation enhances the precision of phishing detection by facilitating intuitive analysis. The lower accuracy of Decision Tree at 54.99% using the AND operation with 6 features and 30,000 images highlights how appropriate selection of classifiers can provide improved performance. This example establishes a new standard in phishing countermeasures, surpassing previous efforts, and underscores the advantages of logic gates in enhancing security. The approach of this example offers organisations a robust defence mechanism against sophisticated cyber threats.

[0079] In today's digital age, In the contemporary digital landscape, the exponential growth of online platforms has precipitated a corresponding surge in cyber threats, with phishing attacks emerging as a particularly pervasive menace. Phishing, characterised by malicious entities' endeavours to dupe individuals into divulging sensitive data such as passwords, financial credentials, or personal information, poses a substantial risk to individual users and organisational entities. Consequently, the imperative to develop robust and effective phishing detection mechanisms cannot be overstated.

[0080] This example presents a comprehensive approach to phishing detection, harnessing advanced ML techniques to bolster cybersecurity defences. The model provides an accuracy rate of 99.35%, underscoring its efficacy in identifying and neutralising phishing attempts. Through the integration of sophisticated algorithms and innovative methodologies, a dependable solution capable of effectively combatting phishing attacks can be provided across diverse digital environments.

[0081] An advantageous feature of the approach is the use of binary visualisation and the utilisation of logic gates such as XOR, OR, AND, XNOR, NOT, and NOR. By leveraging these tools and optimising the model for efficiency, swift and precise identification of potential threats can be provided, thereby enhancing cybersecurity posture across various digital platforms. A detailed account of the techniques employed, the results obtained, and the implications thereof is provided.

[0082] This Worked Example is organised as follows: Section 2 provides a review of related work in the field of phishing detection. In Section 3, the method is presented in detail. Section 4 discusses the optimisation of the model and its efficiency in the experiment. The evaluation of the results is outlined in Section 5. Section 6 presents the experiments conducted with various feature ratios and subsequent analysis. Critical examination and discussion of the contributions of this disclosure are provided in Section 7. Finally, Section 8 concludes the Worked Example.

[0083] 2. Related work

[0084] Throughout the years, numerous strategies have been proposed to address the menace of phishing attacks. These encompass the utilisation of ML methodologies and the deployment of dedicated software solutions to tackle the problem. A study by [1] introduces a fresh method to thwart spear phishing attacks by leveraging human intelligence to spot and flag suspicious emails. Researchers trained users to identify and report such emails and then utilised this data to devise an ML algorithm for automated detection and blocking. Results indicated users effectively flagged spear phishing emails, and the algorithm accurately identified and thwarted them. This approach complements existing technical defences against phishing attacks, suggesting a collaborative human-machine strategy for enhanced protection.

[0085] Another research conducted by [2] implements supervised deep learning, specifically a convolutional neural network (CNN) model optimised with the ADAM technique, to detect phishing web pages. They extract features from webpage screenshots using transfer learning with the VGG16 pre-trained model. Through evaluation metrics like accuracy, precision, recall, and Fl-score, the CNN model demonstrates robust performance in distinguishing phishing from legitimate web pages. However, some limitation of their findings includes the generalisability of findings to diverse phishing scenarios and the scalability of the approach to large datasets. Addressing these limitations could enhance the effectiveness of phishing detection systems in real-world applications. In addition, the authors of [3] in their study titled "Exploring Embedded Training and Awareness in Spear Phishing Mitigation" investigated the efficacy of embedded training and awareness in reducing the risk of spear phishing attacks. Through a study involving 83 participants, simulated spear phishing attacks were conducted, followed by various training and awareness interventions. The findings indicate that participants exposed to embedded training and awareness were notably better at recognising the simulated attacks compared to those without such interventions.

[0086] In [4] the researchers proposed a novel method called CCrFS to detect phishing websites. They utilised ML and a combined correlation features selection approach. Through their method, they achieved improved accuracy in identifying phishing websites compared to traditional techniques. However, a limitation of the research may include potential challenges in generalising the results to diverse datasets and the need for further validation across various web environments to ensure robust performance in real-world scenarios.

[0087] Similar research was conducted by [5], which discussed some common phishing techniques, such as social engineering and website spoofing. They then describe various technical solutions that could be used to detect and prevent phishing attacks, including email filters, website authentication, and browser extensions. The authors also highlight the importance of educating users about the risks of phishing and how to identify and avoid these attacks. The authors suggest that organisations should develop comprehensive security policies, train their employees on best practices for information security, and implement technical solutions that can help detect and prevent phishing attacks.

[0088] Another study by [6] presented a study on spear phishing email detection utilising machine learning. They employed a dataset containing both legitimate and phishing emails, employing ML algorithms for classification [7]. Results demonstrated a high accuracy rate in identifying spear phishing emails, achieving an accuracy of 95%. However, a limitation of the study lies in the potential bias introduced by the dataset used, which may not fully represent real-world spear phishing scenarios. Despite this limitation, their approach showcases the potential of ML in enhancing email security by effectively distinguishing between legitimate and phishing emails, thereby contributing to cybersecurity advancements.

[0089] According to another study by [8], existing anti-phishing methods struggle to combat spear phishing, which is personalised and highly targeted. The researchers suggest a strategy cantered on analysing email language to identify phishing cues. Evaluating this method on a real-world dataset of spear phishing emails yielded promising outcomes, boasting an accuracy rate of 90%.

[0090] Moreover, the authors of [9] utilised Signal Detection Theory (SDT) to model user behaviour towards phishing and spear-phishing attacks. Their study, published in Hum Factors, demonstrated SDT's effectiveness in analysing user responses to such attacks. By examining user detection and false alarm rates, the researchers achieved a comprehensive understanding of user behaviour. However, a limitation of their research is the focus on modelling user behaviour rather than implementing practical anti-phishing measures.

[0091] In their study

[0010] analyse a targeted phishing campaign to gain insights into spear phishing tactics and their effectiveness. By conducting a detailed examination of the phishing emails and recipients' responses, the study sheds light on the vulnerabilities exploited by attackers. However, the research's scope might be limited to the specific campaign analysed, and generalisations to broader phishing trends may not be straightforward.

[0092] In

[0011] the authors propose a new ML method for detecting phishing websites. The authors utilise ML algorithms to analyse various features of websites and classify them as either legitimate or phishing. The approach achieved high accuracy rates in identifying phishing websites, demonstrating its effectiveness in bolstering cybersecurity efforts.

[0093] Similar research conducted in

[0012] conducted a comprehensive review of various detection techniques for QR code phishing attacks. The authors analyse existing methodologies employed to identify and mitigate QR. code phishing threats. While the study provides valuable insights into the current landscape of QR code phishing detection, it primarily focuses on surveying existing approaches rather than proposing novel detection methods.

[0094] The authors of

[0013] proposed an intelligent phishing detection and protection scheme for online transactions. The method utilises a combination of ML algorithms and heuristic rules to identify and prevent phishing attacks targeting online transactions. The approach achieves high accuracy in detecting phishing attempts, significantly reducing the risk of financial losses and data breaches associated with such attacks. However, the research's limitation may lie in its dependence on historical data and predefined rules, which could potentially lead to false positives or missed phishing attempts in rapidly evolving attack scenarios.

[0095] Another research by

[0014] explored various ML techniques for email spam filtering. They review existing methodologies, propose new approaches, and identify open research problems in this domain. Through comprehensive analysis, they highlight the effectiveness of ML in enhancing email spam filtering systems. However, they also acknowledge challenges such as the need for large datasets, model interpretability, and evolving spamming techniques, which could affect the accuracy of spam detection algorithms. Overall, their work underscores the significance of ML in combating email spam while emphasising the need for continued research in this area.

[0096]

[0015] proposed a crowdsourced approach to automate response and containment against spear phishing attacks. They engage human intelligence to identify and report suspicious emails, then developed a machine-learning algorithm to automatically detect and block such emails. The study demonstrates the effectiveness of this approach, with participants successfully identifying and reporting spear phishing emails. However, the accuracy of the automated detection system may vary depending on the quality of the training data and the sophistication of phishing tactics. Nonetheless, their method presents a promising strategy to complement existing technical solutions for detecting and preventing phishing attacks.

[0097] Additionally,

[0016] , which is incorporated by reference, presents an approach to detecting phishing attacks using binary visualisation and machine learning, which can be used in embodiments of the present disclosure. By integrating binary visualisation techniques with ML algorithms, they aim to enhance the accuracy of phishing detection. Their method demonstrates promising results in accurately identifying phishing attempts, thereby improving cybersecurity measures. However, the effectiveness of the approach may be influenced by factors such as the quality of the training data and the adaptability of the ML models to evolving phishing tactics. Nonetheless, their approach offers a valuable contribution to the ongoing efforts to combat phishing attacks effectively.

[0098] In summary, these papers underscore the growing menace of phishing attack and the pressing need for effective countermeasures. To improve the existing methods, this Worked Example proposes employing a blend of classification (ML) methods, Binary Visualisation, and a spectrum of logic gates, encompassing XOR, OR, AND, NOR, NOT, and XNOR. This amalgamation forms a holistic approach that contributes to the model's final classification, as illustrated in Figure 5A. By leveraging these techniques, the research aims to enhance the detection and mitigation of phishing attacks, thereby fortifying cybersecurity protocols. The integration of diverse methodologies signifies a multifaceted strategy to combat the evolving tactics employed by cybercriminals in perpetrating phishing schemes. This synthesis of approaches reflects a concerted effort to stay ahead of the everevolving threat landscape and safeguard sensitive information from malicious exploitation.

[0099] 3. Methodology

[0100] Implementation of Machine Learning

[0101] Several studies advocate for utilising ML as the most efficient method to counter phishing attacks

[0017] . Here, an ML strategy is employed by amalgamating phishing and genuine websites with the attributes delineated in

[0018] to generate a distinct image for the model's final categorisation. Since the features used herein are similar to those in

[0018] ,

[0018] is incorporated herein by reference. In the training phase, one model underwent training with 30,000 legitimate images, while another was trained with 60,000 phishing images, each sized at 150 by 150 pixels and a learning rate set at 1.316. These images were iteratively utilised throughout the training process. Some of the attained outcomes are presented in Figures 9-15. 3.1. Binary Visualisation

[0102] Binary Visualisation (BV) is sometimes used in machine learning

[0019] , providing a clear and meaningful way to represent binary data. This aids in detecting patterns and anomalies, improving understanding of data relationships and patterns, thereby enhancing the efficiency and accuracy of ML models, which can be particularly advantageous for phishing detection.

[0103] The methods described herein involve a secondary model that collects both phishing and non-phishing data through supplied URLs

[0020] . This model then converts individual characters from strings into binary states and translates them into RGB values. These values are used for analysis and classification by the primary ML model, facilitating the identification and analysis of patterns and anomalies through image transformation.

[0104] This approach categorises distinct characters into specific colours, simplifying differentiation between various binary states

[0021] . For example, "0" may be depicted in black, while "1" in white, allowing the model to discern data patterns. Additionally, employing BV in this disclosure provides significant benefits in data analysis and model accuracy. By presenting binary data in an easily understandable format, the models achieved superior performance in phishing detection.

[0105] The model, as shown in Figure 5A, employs a two-stage process to enhance security and classification accuracy. In general terms, digital content (a website) and a set of features (UsinglP, LongURL, Subdomain, Redirection, HTTPS domain) are combined (by any of the Boolean functions) to form a modified representation of the digital content which is converted into an image and used for machine learning classification.

[0106] Initially, a primary model collects data from URLs of both phishing and legitimate websites

[0022] . This data is augmented with website features and forwarded to a second layer, where one or more logical gate operations are applied. The resulting output is converted into binary format, which may provide additional security through encryption. Subsequently, the binary data is transferred to a secondary primary model for conversion into images. These images serve as input for ML algorithms responsible for final classification. This comprehensive approach not only strengthens data security by encrypting

[0023] the dataset but also leverages image processing techniques to facilitate more accurate classification, enhancing the model's ability to distinguish between phishing and legitimate websites.

[0107] It will be appreciated that the methods described herein can also be used to classify whether emails are malicious. To do so, specific features

[0032] were utilised from existing literature, as detailed in the Table below, and concatenated with the phishing emails stored in the dataset that was used(https: / / github.com / JibrillaTanimu).

[0032] is incorporated herein by reference.

[0108] This resulted in the creation of a unique image using BinVis for RGB images, which was then fed into the model for final classification.

[0109] Furthermore, the use of binary visualisation in this disclosure offers significant benefits in terms of data analysis and model accuracy, by presenting the binary data in a format that is easily comprehensible and analysed, the models achieved better performance in phishing email detection.

[0110] (I) A control character is assigned a green colour.

[0111] (II) A printable ASCII character is assigned a blue colour.

[0112] (III) An extended ASCII character is assigned a red colour.

[0113] (IV) BinVis represent null and (non-breaking) spaces with black (0x00) and white (OxFF) colours, respectively.

[0114] Figure 5B shows the image production process. Digital content (emails) and a set of features (wordinbody, HiddenText, EmailSize, FreqEmails) are combined (by XOR-d) to form a modified representation of the digital content which is converted into an image. The process of combining emails with features is utilised to create distinctive string values that can be easily analysed for anomalies within the string collection. This string collection is then passed through another layer for RBG conversion using the Hilbert curve model. This approach allows for the creation of a unique image fed into the model for final classification using selected algorithms. Various other malicious characteristics could be indicated for websites or executable code, such as; "is the content calling external websites?"; "is the content making API calls?"; and "is the content using an encrypted channel?".

[0115] Sample pseudocode on how emails and features were combined is below:

[0116] # Define a function to perform XOR on input data def perform_xor(input_data) :

[0117] # Perform XOR operation xor_result = xor_operation(input_data) return xor_result

[0118] # Sample input data (emails and features) emails_data = [0, 1, 0, 1, 0] # Sample email data (Os and Is) features_data = [1, 0, 1, 1, 0] # Sample feature data (Os and Is)

[0119] # Perform XOR on input data xor_result = perform_xor(emails_data + features_data) as shown in Figure 4.

[0120] # Concatenate emails and features after XOR [N.B. for URL phishing detection, the fourth column in Figure 3 is used whereas for email, the last column in Figure 3 is used] concatenated_data = concatenate_emails_and_features(emails_data, features_data)

[0121] # Print results [N.B. this step is using only in email Figure 5B;.for Figure 5A we use a different approach, but this step could be applied in both] print("XOR Result: ", xor_result) print(”Concatenated Data:”, concatenated_data)

[0122] The remainder of this discussion focuses on how websites are categorised, using the method shown in Figure 5A, but it will be appreciated that these methods can be applied to emails (or indeed to other types of content, such as executable code, etc.).

[0123] 3.2. Spam vs Legitimate websites:

[0124] The simulation includes samples of both phishing and non-phishing websites to highlight their similarities, aiming to illustrate how individuals may be deceived into engaging with phishing sites. These examples underscore how phishing websites can closely resemble legitimate ones, potentially tricking users into performing actions that compromise their security. Figure 6 illustrates both a phishing website (left) and the legitimate website (right) of NAB Internet Banking, showcasing how remarkably similar a spam website can appear to the authentic site. However, examining the URL feature

[0015] , the distinction between the phishing and the genuine website can become evident, and these are among the parameters employed by the ML model to differentiate between the two.

[0125] 3.4 Integrating logic gates for phishing detection Integrating diverse logical operations like AND, NOT, NAND, XNOR, XOR, and OR as shown in Figure 7, into ML models for phishing detection represents a comprehensive strategy. Each operation can contribute unique insights into various aspects of website behaviour, thereby enhancing the accuracy and robustness of detection algorithms. By leveraging these operations, the system gains the ability to discern subtle patterns indicative of phishing activity, leading to more effective identification of malicious websites. This multifaceted approach ensures that the detection system is capable of accurately identifying and mitigating the risks posed by phishing attempts

[0016] , thereby strengthening cybersecurity defences against evolving threats in the digital landscape.

[0126] Figure 7 shows how an input dataset (websites and features) can be turned into an output using the logic operations. Website code is converted to binary in the first input (the same as for emails in Figure 5B) and the second step is the features being used to convert into a binary sequence.

[0127] 3.4.1 AND Operation:

[0128] The AND operation receives multiple indicators to simultaneously signal potential phishing activity. By considering multiple criteria, this operation reduces false positives and increases the confidence in identifying phishing attempts

[0016] . Implementing an AND in phishing detection involves combining multiple features or indicators and checking if all conditions are met.

[0129] Table 1. AND operation:

[0130] This operation returns 1 only if both a and b are 1, and returns 0 otherwise. In the context of phishing detection, applying the AND gate helps in identifying websites that meet all specified criteria or contain all specified suspicious elements. 3.4.2 NOT Operations:

[0131] Conversely, the NOT operation identifies situations where specific indicators are absent, such as missing SSL encryption or suspicious domain characteristics. The absence of critical features may raise suspicion and indicate potential phishing activity. Implementing the NOT gate logic in phishing detection involves negating the output of a feature or indicator that signals the presence of suspicious elements in a website

[0024] .

[0132] Table 2. NOT operation

[0133] This operation returns 1 if a is 0, and 0 if a is 1. In the context of phishing detection, it helps invert the signal of a feature indicating the presence of suspicious elements, aiding in distinguishing between phishing and legitimate websites.

[0134] 3.4.3 NAND Operations:

[0135] The NAND operation focuses on situations where at least one critical indicator is absent, highlighting websites with suspicious attributes that may indicate phishing. This operation provides a nuanced approach to identifying potential threats. Implementing the NAND in phishing detection involves combining multiple features or indicators and negating the result

[0136] Table 3. NAND operation Beyond merely improving accuracy, NAND adds a layer of complexity that is advantageous for enhancing security, particularly in encryption and cryptography.

[0137] 3.4.4 XNOR Operations:

[0138] The XNOR. operation evaluates the similarity between website features and known phishing patterns, allowing detection based on feature similarity. It helps identify websites that closely resemble known phishing sites, enhancing detection accuracy. Implementing XNOR gate logic in phishing detection involves comparing multiple features or indicators of a website to determine if it exhibits characteristics consistent with phishing.

[0139] Table 4. XNOR operation

[0140] This operation returns 1 if both a and b are equal (either both 0 or both 1), and 0 otherwise as shown in Table 4. In the context of phishing detection, it helps identify websites with similar or dissimilar feature patterns compared to known phishing sites.

[0141] 4.4.5 XOR (Exclusive OR) Operations:

[0142] The XOR

[0025] operation identifies websites that exhibit conflicting or contradictory features, signalling potential attempts to disguise phishing activity. By identifying inconsistencies in website behaviour, this operation enhances the ability to detect sophisticated phishing attempts.

[0143] Table 5. XOR operation

[0144] In Boolean algebra, the XOR (•) function yields an output of 1 solely when exactly one of its inputs is true (1); otherwise, it results in 0 as shown in Table 5.

[0145] 3.4.6 OR Operations:

[0146] The OR operation aggregates multiple indicators, allowing for flexible detection based on the presence of any suspicious attribute, regardless of others. This operation provides a robust defence against a wide range of phishing tactics by considering various indicators simultaneously.

[0147] Table 6. OR operation

[0148] This operation returns 1 if either a or b (or both) are 1, and returns 0 otherwise as shown in Table 6. In the context of phishing detection, applying the OR gate helps in identifying websites that contain at least one specified suspicious element. By integrating these logical operations into ML models, phishing detection systems can analyse diverse aspects of website behaviour and identify subtle patterns indicative of phishing activity. This comprehensive approach enhances detection accuracy, reduces false positives, and strengthens defences against evolving phishing threats in cybersecurity.

[0149] 3.5. Image Recognition Classifier

[0150] The classifier employs sophisticated mathematical models and deep learning techniques to analyse image features and make precise predictions, enhancing model reliability and classification accuracy as discussed in

[0027] . This approach accelerates model performance, optimising both time and space utilisation. The dataset, accessible at (https: / / github.com / JibrillaTanimu), comprises coloured dots representing image features, each interpreted based on RGB values and associated image strings.

[0151] Legitimate websites, depicted in the first row, exhibit consistent image texture and graphics, with notable features such as entropy and magnitude more pronounced compared to phishing websites, as detailed in Figure 9 second row. Image recognition classifiers

[0019] are highly advantageous in phishing attack detection.

[0152] To construct one, a dataset containing legitimate and fraudulent websites, transformed into images, was employed for training an ML

[0028] ,

[0029] ,

[0030] algorithm to discern distinguishing features. By integrating image recognition classifiers, proactive identification and mitigation of fraudulent activities are facilitated, safeguarding individuals and businesses from potential financial and reputational harm resulting from phishing attacks. Entropy gauges data disorder and uncertainty, while magnitude measures data size and intensity. Some embodiments described herein use the methods described in

[0016] to detect phishing attacks. For example,

[0016] provides examples of ways image classifiers can be used to improve the accuracy of phishing detection, and the methods described herein provide a way to improve the accuracy by incorporating sets of features, as described previously.

[0153] As explained in

[0016] , in order to detect phishing pages, the machine-learning algorithm TensorFlow can be used to analyse and classify Binvis images against its in-depth training. TensorFlow is flexible and it has been used for deploying machine learning systems into production across several areas of computer science, including image recognition, computer vision, robotics, information retrieval, natural language processing and geographic information extraction. Its excellent image recognition ability makes it advantageous for the present disclosure. The trained classifiers described herein can sometimes detect differences between images that the human eye could not detect. TensorFlow takes as input the images produced in the previous steps to perform the classification. For speed of testing, the convolutional neural network MobileNet can be employed for the retraining element. This can greatly reduce the time and space for phishing websites classification. 3.6. Several characteristics utilised in the image recognition encompass: a. Colour Histograms: Representations of the distribution of colours within an image, often used for colour-based image retrieval and classification. b. Texture Descriptors: Methods that capture texture information, such as local binary patterns (LBP) or Gray-level co-occurrence matrices (GLCM), which are useful for distinguishing between different textures in images. c. Edge Detection: Techniques to identify abrupt changes in pixel intensity, commonly used for extracting object boundaries and shapes within images. d. Scale-Invariant Feature Transform (SIFT): A method for detecting and describing local features in images, robust to changes in scale, rotation, and illumination. e. Convolutional Neural Networks (CNNs): Deep learning architectures designed to automatically learn relevant features from images through multiple layers of convolutional and pooling operations. f. Histogram of Oriented Gradients (HOG): A feature descriptor that captures local intensity gradients or edge directions, commonly used in object detection and human detection tasks. g. Principal Component Analysis (PCA): A statistical technique used for dimensionality reduction by transforming image features into a lower-dimensional space while preserving the most important information. h. Local Binary Patterns (LBP): A method to describe the local texture patterns of an image by comparing each pixel with its neighbouring pixels, commonly used in facial recognition and texture classification.

[0154] 3.7. Image creation process:

[0155] The process of generating images for machine learning-based phishing detection begins with the primary model crawling website content, utilising both phishing and non-phishing URLs provided by the user. The model collects the HTML code of the URLs from the crawler before transferring them to the next stage of the process. In this stage, the content is combined with features using logical operations like NOR, XNOR, AND, NOT, XOR, and OR. For example, to achieve this, the following steps may be performed: 1. Crawling website code; 2. Convert html code to binary; 3. Get information for the website and create the features byte sequence; 4. XOR / AND / NAND / NOT / OR / XNOR N bits from the website binary file equal to features byte sequence until all the file has been XOR / AND / NAND / NOT / OR / XNOR; 5. the output file is converted to image either using Binvis or other binary visualisation methods (various visualisation methods, such as BinVis, GreyScale and the like, can be used to achieve the same advantageous results of the present disclosure).

[0156] Relevant features are initially extracted from the website content (to create a byte sequence), and logical gates are applied to create a binary representation. This logic gate converted file is then transformed into images, with each pixel capturing unique patterns

[0031] revealed during the operation. String values encode complex patterns and relationships identified during the logic operation, enhancing dataset security and facilitating nuanced feature interpretation. The machine learning techniques described herein can facilitate this improved detection and accuracy, using the following parameters:

[0157] Accuracy (A): It calculates the accuracy of detecting both phishing and legitimate websites among all received website.

[0158] Accuracy =

[0159] J JV^+ NL+JNVP P^100

[0032]

[0160] Precision (P): It quantifies the proportion of correctly identified phishing websites to the total number of phishing websites.

[0161] Prescision = — UP^P — 100

[0162] N p _ p +Ni —>P

[0033]

[0163] Recall (R): It evaluates the precision of labelling phishing websites in comparison to legitimate ones.

[0164] Recall

[0165] Fl Score (fl): The harmonic mean between accuracy and recall is determined by the following formula.

[0166] Figure 8 shows a confusion matrix for evaluating performance. The confusion matrix comprehensively evaluates the model's performance by juxtaposing the actual website labels (phishing or legitimate) with the predicted ones. It comprises four cells: true positive (TP)

[0036] , true negative (TN)

[0037] , false positive (FP)

[0038] , and false negative (FN)

[0039] as shown in Figure 8. TP denotes the count of phishing websites accurately identified as phishing, TN represents legitimate websites correctly classified as legitimate, FP indicates legitimate websites mistakenly classified as phishing, and FN signifies phishing websites erroneously classified as legitimate.

[0167] 4. Optimising the model for efficiency

[0168] Table 7. Time for phishing detection.

[0169] Table 7 presents a comparative analysis of the time taken to detect phishing or spam website, considering different optimisation and training methods. Each row in the table corresponds to a specific approach aimed at enhancing the detection process. The values in the "Time to Detect Phishing / Spam (seconds)" column represent the average duration taken by each method to identify and classify potentially malicious content. a) Baseline Model: This refers to the standard detection method employed without specific optimisations or advanced training techniques, resulting in an average detection time of 5.3 seconds. b) Feature Selection: In this scenario, a feature selection process was implemented to reduce data dimensionality, leading to a reduced detection time of 3.6 seconds. c) Hyperparameter Tuning: Through fine-tuning the hyperparameters of the detection model, the time taken to recognise phishing or spam content was further minimised, averaging only 2.2 seconds. d) Deep Learning: The adoption of deep learning techniques, including neural networks, facilitated quicker detection, with an average time of 4.9 seconds. This table highlights the impact of various optimisation and training methods on the efficiency of phishing and spam detection, ultimately reducing the time required for accurate identification.

[0170] 5. Evaluation of the model

[0171] Our approach has yielded noteworthy results in phishing attack detection, providing an accuracy rate of 99%. This achievement can enhance confidence and productivity by effectively thwarting phishing attacks in organisational and individual settings.

[0172] The phishing website dataset was obtained by crawling the HTML source code from a phishing site repository, such as Phish Tank, and merged (i.e., combined) with features listed in

[0018] . This amalgamation generated unique string values utilised by the logic gate operations mentioned above, producing distinctive images for each sample website. These images were then fed into another model for final classification by a neural network as shown in Figure 5A. The program was developed in Python (Version 3.12)

[0040] and executed on an Ubuntu 20.04 LTS Virtual Machine with 2 cores and 8 GB of RAM. Various libraries were utilised, including MySQL Connector, Pandas, TensorFlow, Torch, Scikit-learn, NumPy, and Pandas.

[0173] Multiple tests evaluated model performance and accuracy, with optimisation techniques like feature and dataset manipulation. The dataset was split, with 20% for testing and 80% for training. The approach achieved an impressive 99.71% accuracy in phishing detection, with BPNN and CNN exhibiting higher accuracy as shown in Table 21 while LG performed less well, particularly with the NOT operation.

[0174] This approach yielded noteworthy results, boasting a 99% accuracy rate in detecting phishing attacks, enhancing confidence and productivity in thwarting such attacks in organisations and individuals.

[0175] 6. Result and Analysis

[0176] Table 22 presents a comprehensive comparative analysis, contrasting the methods of this Worked Example with studies in the existing literature. The results distinctly demonstrate the superiority of the embodiments described herein, showcasing remarkable performance with a notably reduced feature set. Furthermore, embodiments of the present disclosure exhibit exceptional computational efficiency and robustness in its important task of classifying phishing attacks. This comparative evaluation validates the effectiveness and efficiency of the models described herein, offering a streamlined and potent approach to phishing detection. By leveraging an optimised feature set, the present disclosure not only enhances accuracy but also paves the way for resource-efficient computation, which can assist in tackling the escalating challenges posed by phishing attempts.

[0177] We selected the top-performing experiment from Figure 15, achieving an impressive accuracy of 99.71% and an Fl score of 99.13% using the XOR operation

[0031] and 60,000 images with four features. This highlights the significance of the approaches described herein, showcasing their potential to profoundly impact phishing detection through efficient and accurate classification. Figures 9 to 15 and Tables 8-22 illustrate various results obtained during different simulations using logic gate operations in combination with features.

[0178] The pictures in Figures 9-15 use the same spam, legitimate website code, but the applied method (XOR., AND, NAND, etc.) is different for each figure. Figure 9 displays the outcomes of the AND operation simulation. The first column showcases the images of legitimate websites generated through the simulation, incorporating website features and the AND logic operation. Conversely, the second column illustrates phishing images produced using identical entities as the legitimate ones. Notably, discernible disparities emerge between the two sets of images, highlighting the efficacy of the AND operation in distinguishing between legitimate and phishing websites.

[0179] Table 8. Experiment with 6 features and 30,000 image strings

[0180] Table 9. Experiment with 4 features and 60,000 image strings

[0181] Figure 10 presents the results of the NAND operation simulation. Legitimate website images, created with website features and the NAND logic operation, are shown in the first column. Conversely, the second column displays phishing images generated using the same entities. Clear differences between the two sets of images underscore the effectiveness of the NAND operation in distinguishing between legitimate and phishing websites. Moreover, employing the NAND simulation with 6 features and 30,000 images resulted in the highest accuracy of 86% using the RF classifier. Furthermore, utilising both BPNN and RF with 4 features and 60,000 images achieved an accuracy of 89%.

[0182] Table 1. Experiment with 6 features and 30,000 image strings

[0183] Table 2. Experiment with 4 features and 60,000 image strings

[0184] Figure 11 illustrates the outcomes of the NOR. operation simulation, showcasing the image results. The first column displays legitimate website images created through the NOR logic operation applied to website features. Conversely, the second column exhibits phishing images generated using the same approach. Noticeable disparities between the two sets of images highlight the NOR operation's efficacy in distinguishing legitimate from phishing websites. Moreover, employing the NOR simulation with 6 features and 30,000 images yielded a remarkable accuracy of 95% with the SVM classifier. Additionally, utilising AlexNet with 4 features and 60,000 images attained an accuracy of 97%, as demonstrated in both Tables 12 and 13, respectively. Table 3. Experiment with 6 features and 30,000 image strings.

[0185] Table 4. Experiment with 4 features and 60,000 image strings

[0186] Figure 12 presents the outcomes of the NOT operation simulation, depicting the image results. The first column showcases legitimate website images generated through the NOT logic operation applied to website features. Conversely, the second column displays phishing images produced using the same method. Observable differences between the two sets of images underscore the effectiveness of the NOT operation in distinguishing between legitimate and phishing websites. Moreover, employing the NOT simulation with 6 features and 30,000 images resulted in an accuracy of 56% with both the CNN classifier and AlexNet. Additionally, utilising CNN with 4 features and 60,000 images achieved an accuracy of 60%, as demonstrated in both Tables 14 and 15, respectively. The relatively lower performance of NOT compared to other logic operations may be attributed to its single input nature and the inverse relationship between input and output.

[0187] Table 5. Experiment with 6 features and 30,000 image strings

[0188] Table 15. Experiment with 4 features and 60,000 image strings Figure 13 depicts the results of the OR. operation simulation, showcasing the image outcomes. The first column illustrates legitimate website images generated through the OR logic operation applied to website features. In contrast, the second column displays phishing images produced using the same method. Clear differences between the two sets of images underscore the effectiveness of the OR. operation in distinguishing between legitimate and phishing websites. Furthermore, employing the OR simulation with 6 features and 30,000 images achieved an impressive accuracy of 98% with both CNN and RF classifiers.

[0189] Additionally, utilising CNN with 4 features and 60,000 images yielded a higher accuracy of 99%, as evidenced in both tables 16 and 17, respectively.

[0190] Table 16. Experiment with 6 features and 30,000 image strings

[0191] Table 17. Experiment with 4 features and 60,000 image strings Figure 14 showcases the outcomes of the XNOR operation simulation, presenting the image results. The first column demonstrates legitimate website images generated through the XNOR. logic operation applied to website features. Conversely, the second column exhibits phishing images produced using the same process. Noticeable disparities between the two sets of images underscore the effectiveness of the XNOR operation in distinguishing between legitimate and phishing websites. Moreover, employing the XNOR simulation with 6 features and 30,000 images achieved an impressive accuracy of 96% with DT classifiers. Additionally, utilising RF with 4 features and 60,000 images yielded a higher accuracy of 99%, as demonstrated in both tables 18 and 19, respectively.

[0192] Table 18. Experiment with 6 features and 30,000 image strings.

[0193] Table 19. Experiment with 4 features and 60,000 image strings.

[0194] Figure 15 presents the outcomes of the XOR operation simulation, showcasing the image results. The first column illustrates legitimate website images generated through the XOR. logic operation applied to website features. Conversely, the second column exhibits phishing images produced using the same process.

[0195] Noticeable disparities between the two sets of images underscore the effectiveness of the XOR operation in distinguishing between legitimate and phishing websites. Moreover, employing the XOR simulation with 6 features and 30,000 images achieved an impressive accuracy of 97% with CNN classifiers. Additionally, utilising both CNN and BPNN with 4 features and 60,000 images yielded a higher accuracy of 99%, as demonstrated in both Tables 20 and 21, respectively. Thus far, XOR has proven to be the most effective logic operation, exhibiting the highest accuracy and precision levels among the aforementioned logic operations. Table 20. Experiment with 6 features and 30,000 image strings

[0196] Table 21. Experiment with 4 features and 60,000 image strings

[0197] The majority of the results exhibited remarkable performance, highlighting the impact of data manipulation on a dataset of 60,000 images. This adjustment allowed the model to achieve balanced data, resulting in a notable enhancement in both classification accuracy and precision. Comparatively, the improvements in accuracy and precision were notably more pronounced in this experiment.

[0198] Table 22 offers a comprehensive comparison between the research findings related to the approach and those of prior studies in the field. It outlines the models and algorithms employed by each researcher, facilitating a thorough assessment of performance

[0031] . Significantly, the method outperforms across all measured metrics, surpassing the accomplishments documented in the result archives of other researchers, as depicted in Table 22. This comparative analysis underscores the effectiveness of the approach in phishing detection using logic operations and binary visualisation, positioning it as a superior solution in the current research landscape.

[0199] Table 22. Comparative analysis of related work with the present disclosure.

[0200] 7. Research contributions

[0201] This research introduces a comprehensive strategy to combat phishing attacks by integrating ML, image visualisation, and various logic gates like XOR, OR, AND, XNOR, NOT, and NOR

[0048] . By leveraging ML algorithms, the study scrutinises data attributes to identify patterns indicative of phishing, thereby strengthening detection and prevention mechanisms without the need for human interaction (e.g., like Phishtank) which is time consuming and may have errors due to the human factor.

[0202] Moreover, the incorporation of image visualisation facilitates intuitive analysis of phishing attempts and allows the utilisation of visual patterns for enhanced detection accuracy. The holistic integration of these components forms a comprehensive defence mechanism against phishing, providing a nuanced and effective solution. The achieved accuracy rate of 99.71% in detecting phishing, coupled with a precision rate of 99.40%, underscores the practical significance and efficacy of this approach.

[0203] Overall, this research contributes a pioneering framework that advances the state- of-the-art in phishing mitigation. By addressing the evolving sophistication of phishing threats, it sets a precedent for future developments in cybersecurity strategies. The novel approach significantly enhances cybersecurity by integrating ML, image visualisation

[0049] , and logic gates, providing a robust defence against increasingly complex phishing attacks.

[0204] 8. Conclusion

[0205] The phishing detection framework outlined in this Worked Example, integrating machine learning and various logic gates such as XOR, OR, AND, NOR, NOT, and XNOR, along with image visualisation, stands out as a highly effective and innovative solution in cybersecurity. With an accuracy rate of 99.74% and a precision rate of 99.40%, particularly notable with the CNN and BPNN implementations, the model demonstrates robustness and reliability. The superiority of BPNN as a classifier highlights its ability to discern subtle patterns indicative of phishing attacks. Additionally, image visualisation aids in intuitive analysis and leverages visual patterns, thereby improving the precision of phishing detection.

[0206] While logistic regression exhibited lower accuracy at 44.83% using the NOT operation with 6 features and 30,000 images, this discrepancy underscores the importance of selecting an appropriate classifier for phishing detection. Nonetheless, the overall success of the approach described herein represents a significant advancement in countering phishing threats, setting a benchmark for future cybersecurity efforts aimed at protecting sensitive information.

[0207] Some embodiments of the model may incorporate Spanish and / or Chinese and / or other languages and / or may implement unsupervised learning processes to further explore the functionality and efficacy of the approach described herein.

[0208] A number of publications are referenced above and the full details of these are provided below. Each reference is incorporated by reference in its entirety.

[0209] References

[0210] [1] N. Stembert, A. Padmos, M. S. Bargh, S. Choenni, and F. Jansen, "A Study of Preventing Email (Spear) Phishing by Enabling Human Intelligence," in Proceedings - 2015 European Intelligence and Security Informatics Conference, EISIC 2015, Institute of Electrical and Electronics Engineers Inc., Jan. 2016, pp. 113-120. doi: 10.1109 / EISIC.2015.38.

[0211] [2] L. Lakshmi, M. P. Reddy, C. Santhaiah, and U. J. Reddy, "Smart Phishing Detection in Web Pages using Supervised Deep Learning Classification and Optimization Technique ADAM," Wirel Pers Commun, vol. 118, no. 4, pp. 3549- 3564, Jun. 2021, doi: 10.1007 / S11277-021-08196-7. [3] D. D. Caputo, S. L. Pfleeger, J. D. Freeman, and M. E. Johnson, "Going spear phishing: Exploring embedded training and awareness," IEEE Secur Priv, vol. 12, no. 1, pp. 28-38, 2014, doi: 10.1109 / MSP.2013.106.

[0212] [4] J. Moedjahedy, A. Setyanto, F. K. Alarfaj, and M. Alreshoodi, "CCrFS: Combine Correlation Features Selection for Detecting Phishing Websites Using Machine Learning," Future Internet, vol. 14, no. 8, 2022, doi: 10.3390 / fil4080229.

[0213] [5] A. Sumner and X. Yuan, "Mitigating phishing attacks: An overview," in ACMSE 2019 - Proceedings of the 2019 ACM Southeast Conference, Association for Computing Machinery, Inc, Apr. 2019, pp. 72-77. doi: 10.1145 / 3299815.3314437.

[0214] [6] Y. Xu, Y. Zhou, P. Sekula, and L. Ding, "Machine learning in construction: From shallow to deep learning," Developments in the Built Environment, vol. 6, 2021, doi: 10.1016 / j.dibe.2021.100045.

[0215] [7] C. Thirumallai, M. S. Mekala, V. Perumal, P. Rizwan, and A. H. Gandomi, "Machine Learning Inspired Phishing Detection (PD) for Efficient Classification and Secure Storage Distribution (SSD) for Cloud-IoT Application," in 2020 IEEE Symposium Series on Computational Intelligence, SSCI 2020, Institute of Electrical and Electronics Engineers Inc., Dec. 2020, pp. 202-210. doi: 10.1109 / SSCI47803.2020.9308183.

[0216] [8] L. Allodi, T. Chotza, E. Panina, and N. Zannone, "The Need for New Antiphishing Measures against Spear-Phishing Attacks," IEEE Secur Priv, vol. 18, no. 2, pp. 23-34, Mar. 2020, doi : 10.1109 / MSEC.2019.2940952.

[0217] [9] J. Martin, C. Dube, and M. D. Coovert, "Signal Detection Theory (SDT) Is Effective for Modeling User Behavior Toward Phishing and Spear-Phishing Attacks," Hum Factors, vol. 60, no. 8, pp. 1179-1191, Dec. 2018, doi : 10.1177 / 0018720818789818.

[0218]

[0010] A. J. Burns, M. E. Johnson, and D. D. Caputo, "Spear phishing in a barrel : Insights from a targeted phishing campaign," Journal of Organizational Computing and Electronic Commerce, vol. 29, no. 1, pp. 24-39, Jan. 2019, doi: 10.1080 / 10919392.2019.1552745.

[0219]

[0011] I. Tyagi, J. Shad, S. Sharma, S. Gaur, and G. Kaur, "A Novel Machine Learning Approach to Detect Phishing Websites," in 2018 5th International Conference on Signal Processing and Integrated Networks, SPIN 2018, Institute of Electrical and Electronics Engineers Inc., Sep. 2018, pp. 425-430. doi: 10.1109 / SPIN.2018.8474040.

[0220]

[0012] S. Subairu, J. Alhassan, S. Abdulhamid, and J. Ojeniyi, "A review of detection methodologies for quick response code phishing attacks," in 2020 2nd International Conference on Computer and Information Sciences, ICCIS 2020, Institute of Electrical and Electronics Engineers Inc., Oct. 2020. doi: 10.1109 / ICCIS49240.2020.9257687.

[0221]

[0013] P. A. Barraclough, M. A. Hossain, M. A. Tahir, G. Sexton, and N. Aslam, "Intelligent phishing detection and protection scheme for online transactions," Expert Syst Appl, vol. 40, no. 11, pp. 4697-4706, Sep. 2013, doi: 10.1016 / j.eswa.2013.02.009.

[0222]

[0014] E. G. Dada, J. S. Bassi, H. Chiroma, S. M. Abdulhamid, A. O. Adetunmbi, and O. E. Ajibuwa, "Machine learning for email spam filtering: review, approaches and open research problems," Heliyon, vol. 5, no. 6, Jun. 2019, doi : 10.1016 / j.heliyon.2019.e01802.

[0223]

[0015] P. Burda, L. Allodi, and N. Zannone, "Don't Forget the Human: A Crowdsourced Approach to Automate Response and Containment against Spear Phishing Attacks," in Proceedings - 5th IEEE European Symposium on Security and Privacy Workshops, Euro S and PW 2020, Institute of Electrical and Electronics Engineers Inc., Sep. 2020, pp. 471-476. doi: 10.1109 / EuroSPW51379.2020.00069.

[0224]

[0016] L. Barlow, G. Bendiab, S. Shiaeles, and N. Savage, "A Novel Approach to Detect Phishing Attacks using Binary Visualisation and Machine Learning," in Proceedings - 2020 IEEE World Congress on Services, SERVICES 2020, Institute of Electrical and Electronics Engineers Inc., Oct. 2020, pp. 177-182. doi: 10.1109 / SERVICES48979.2020.00046.

[0225]

[0017] O. K. Sahingoz, E. Buber, O. Demir, and B. Diri, "Machine learning based phishing detection from URLs," Expert Syst Appl, vol. 117, pp. 345-357, Mar. 2019, doi: 10.1016 / j.eswa.2018.09.029.

[0226]

[0018] J. Tanimu, S. Shiaeles, and M. Adda, "A Comparative Analysis of Feature Eliminator Methods to Improve Machine Learning Phishing Detection," Journal of Data Science and Intelligent Systems, 2023, doi: 10.47852 / bonviewJDSIS32021736.

[0019] I. H. Sarker, "Machine Learning: Algorithms, Real-World Applications and Research Directions," SN Computer Science, vol. 2, no. 3. 2021. doi : 10.1007 / S42979-021-00592-X.

[0227]

[0020] P. Patil, R. Rane, and M. Bhalekar, "Detecting spam and phishing mails using SVM and obfuscation URL detection algorithm," in Proceedings of the International Conference on Inventive Systems and Control, ICISC 2017, 2017. doi: 10.1109 / ICISC.2017.8068633.

[0228]

[0021] R. Y. M. Nakamura, L. A. M. Pereira, D. Rodrigues, K. A. P. Costa, J. P. Papa, and X. S. Yang, "Binary Bat Algorithm for Feature Selection," Swarm Intelligence and Bio-Inspired Computation, pp. 225-237, 2013.

[0229]

[0022] E. S. Gualberto, R. T. De Sousa, T. P. B. De Vieira, J. P. C. L. Da Costa, and C. G. Duque, "From Feature Engineering and Topics Models to Enhanced Prediction Rates in Phishing Detection," IEEE Access, vol. 8, pp. 76368-76385, 2020, doi: 10.1109 / ACCESS.2020.2989126.

[0230]

[0023] D. A. Chaudhari and E. Umamaheswari, "A new adaptive XOR, hashing and encryption-based authentication protocol for secure transmission of the medical data in Internet of Things (IoT)," Biomedizinische Technik, vol. 66, no. 1, 2021, doi : 10.1515 / bmt-2019-0123.

[0231]

[0024] R. Alazaidah, "Website Phishing Detection Using Machine Learning Techniques," J Stat Appl Probab, vol. 13, no. 1, pp. 119-129, Jan. 2024, doi: 10.18576 / jsap / 130108.

[0232]

[0025] N. Kouaissah and A. Hocine, "XOR data envelopment analysis and its application to renewable energy sector," Expert Syst Appl, vol. 207, 2022, doi: 10.1016 / j.eswa.2022.118044.

[0233]

[0026] A. Abunadi, O. Akanbi, and A. Zainal, "Feature extraction process: A phishing detection approach," in International Conference on Intelligent Systems Design and Applications, ISDA, IEEE Computer Society, Oct. 2014, pp. 331-335. doi : 10.1109 / ISDA.2013.6920759.

[0234]

[0027] Y. Y. Chen, Y. C. Hu, T. K. Yang, and Y. A. Wang, "Data Hiding in AMBTC Images Using Selective XOR Hiding Scheme," Computers, Materials and Continua, vol. 71, no. 2, 2022, doi : 10.32604 / cmc.2022.023993.

[0235]

[0028] L. Patel, T. Shukla, X. Huang, D. W. Ussery, and S. Wang, "Machine Learning Methods in Drug Discovery," Molecules, vol. 25, no. 22, 2020, doi: 10.3390 / MOLECULES25225277.

[0029] I. Journal, A. Masood, and S. Tayyab, "A Review: Phishing Detection using URLs and Hyperlinks Information by Machine Learning Approach Cite this paper A Review on Malicious URL Det ect ion using Machine Learning Systems International Journal IJRIT International Journal of Computer Science and Mobile Computing A Review: Phishing Detection using URLs and Hyperlinks Information by Machine Learning Approach," 2019. [Online]. Available: www.ijcsmc.com

[0236]

[0030] E. G. Dada, J. S. Bassi, H. Chiroma, S. M. Abdulhamid, A. 0. Adetunmbi, and 0. E. Ajibuwa, "Machine learning for email spam filtering: review, approaches and open research problems," Heliyon, vol. 5, no. 6, Jun. 2019, doi : 10.1016 / j.heliyon.2019.e01802.

[0237]

[0031] T. Ji, P. Li, E. Yilmaz, E. Ayday, Y. F. Ye, and J. Sun, "Differentially private binary- and matrix-valued data query: An XOR mechanism," Proceedings of the VLDB Endowment, vol. 14, no. 5, 2021, doi : 10.14778 / 3446095.3446106.

[0238]

[0032] J. Tanimu and S. Shiaeles, "Phishing Detection Using Machine Learning Algorithm," in Proceedings of the 2022 IEEE International Conference on Cyber Security and Resilience, CSR 2022, 2022. doi: 10.1109 / CSR54599.2022.9850316.

[0239]

[0033] M. G. Sarwar Murshed, C. Murphy, D. Hou, N. Khan, G. Ananthanarayanan, and F. Hussain, "Machine Learning at the Network Edge: A Survey," ACM Computing Surveys, vol. 54, no. 8. 2022. doi: 10.1145 / 3469029.

[0240]

[0034] A. Kumar Jain and B. B. Gupta, "A machine learning based approach for phishing detection using hyperlinks information," J Ambient Intell Humaniz Comput, vol. 10, pp. 2015-2028, 2019, doi: 10.1007 / S12652-018-0798-Z.

[0241]

[0035] F. Yahva et al., "Detection of Phising Websites using Machine Learning Approaches," in 2021 International Conference on Data Science and Its Applications, ICoDSA 2021, 2021. doi : 10.1109 / ICoDSA53588.2021.9617482.

[0242]

[0036] M. Ihme, W. T. Chung, and A. A. Mishra, "Combustion machine learning: Principles, progress and prospects: Combustion machine learning," Progress in Energy and Combustion Science, vol. 91. 2022. doi : 10.1016 / j. pecs.2022.101010.

[0243]

[0037] L. Zhou, Y. Song, W. Ji, and H. Wei, "Machine learning for combustion," Energy and Al, vol. 7, 2022, doi : 10.1016 / j. egyai.2021.100128.

[0244]

[0038] X. Ding, B. Liu, Z. Jiang, Q. Wang, and L. Xin, "Spear Phishing Emails Detection Based on Machine Learning," in Proceedings of the 2021 IEEE 24th International Conference on Computer Supported Cooperative Work in Design, CSCWD 2021, Institute of Electrical and Electronics Engineers Inc., May 2021, pp. 354-359. doi: 10.1109 / CSCWD49262.2021.9437758.

[0039] S. Dadvandipour and A. G. Ganie, "Analyzing and predicting spear-phishing using machine learning methods," Multidiszciplinaris tudomanyok, vol. 10, no. 4, pp. 262-273, 2020, doi: 10.35925 / j.multi.2020.4.30.

[0245]

[0040] J. Guo, A. Ye, X. Wang, and Z. Guan, "OpenSeesPyView: Python programming-based visualization and post-processing tool for OpenSeesPy," SoftwareX, vol. 21, 2023, doi : 10.1016 / j.softx.2022.101278.

[0246]

[0041] A. Basit, M. Zafar, A. R. Javed, and Z. Jalil, "A Novel Ensemble Machine Learning Method to Detect Phishing Attack," in Proceedings - 2020 23rd IEEE International Multi-Topic Conference, INMIC 2020, Institute of Electrical and Electronics Engineers Inc., Nov. 2020. doi : 10.1109 / INMIC50486.2020.9318210.

[0247]

[0042] R. K. Shah, M. K. Hasan, S. Islam, A. Khan, T. M. Ghazal, and A. N. Khan, "Detect Phishing Website by Fuzzy Multi-Criteria Decision Making," in 2022 1st International Conference on Al in Cybersecurity, ICAIC 2022, Institute of Electrical and Electronics Engineers Inc., 2022. doi: 10.1109 / ICAIC53980.2022.9897036.

[0248]

[0043] N. Saidani, K. Adi, and M. S. Alli li, "A semantic-based classification approach for an enhanced spam detection," Comput Secur, vol. 94, 2020, doi: 10.1016 / j. cose.2020.101716.

[0249]

[0044] M. Hina, M. Ali, A. R. Javed, F. Ghabban, L. A. Khan, and Z. Jalil, "SeFACED: Semantic-Based Forensic Analysis and Classification of E-Mail Data Using Deep Learning," IEEE Access, vol. 9, 2021, doi: 10.1109 / ACCESS.2021.3095730.

[0250]

[0045] W. Ali, "Phishing Website Detection based on Supervised Machine Learning with Wrapper Features Selection," International Journal of Advanced Computer Science and Applications, vol. 8, no. 9, 2017, doi: 10.14569 / ijacsa.2017.080910.

[0251]

[0046] S. Shukla, M. Misra, and G. Varshney, "HTTP header based phishing attack detection using machine learning," Transactions on Emerging Telecommunications Technologies, vol. 35, no. 1, Jan. 2024, doi : 10.1002 / ett.4872.

[0252]

[0047] N. S. Zaini et al., "Phishing detection system using machine learning classifiers," Indonesian Journal of Electrical Engineering and Computer Science, vol. 17, no. 3, pp. 1165-1171, 2019, doi : 10.11591 / ijeecs.vl7.i3.ppll65-1171.

[0253]

[0048] H. A. Al Issa, M. H. Al-Jarah, A. Almomani, and A. Al-Nawasrah, "Encryption and Decryption Cloud Computing Data Based on XOR and Genetic Algorithm," International Journal of Cloud Applications and Computing, vol. 12, no. 1, 2022, doi : 10.4018 / IJCAC.297101.

[0254]

[0049] G. Agarwal, C. Goel, K. Jindal, and T. Subbulakshmi, "Visualisation and Classification of Phishing URL using Ensemble Learning Algorithms and Hyper- Parameter Tuning," in 2023 Third International Conference on Secure Cyber Computing and Communication (ICSCCC), IEEE, May 2023, pp. 13-18. doi : 10.1109 / ICSCCC58608.2023.10176642.

[0255]

[0050] M. Almseidin, A. M. Abu Zuraiq, M. Al-kasassbeh, and N. Alnidami, "Phishing detection based on machine learning and feature selection methods," International Journal of Interactive Mobile Technologies, vol. 13, no. 12, pp. 71-183, 2019, doi: 10.3991 / ijim.vl3il2.11411.

[0256]

[0051] Y. Yao, T. Sullivan, F. Yan, J. Gong, and L. Li, "Balancing data for generalizable machine learning to predict glass-forming ability of ternary alloys," Scr Mater, vol. 209, 2022, doi : 10.1016 / j.scriptamat.2021.114366.

[0257]

[0052] G. Golovko, A. Matiashenko, and N. Solopihin, "DATA ENCRYPTION USING XOR CIPHER," CMCT6MM ynpaBJiiHHJi, HaBirapiT Ta 3B'?i3Ky. 36ipHMK HayxoBMx npapb, vol. 1, no. 63, 2021, doi : 10.26906 / sunz.2021.1.081.

[0258] Figure 17 shows the results of applying different functions (XOR, AND) to different URLs. The results are similar to the results described previously. Figure 17 shows a database containing visualisations of the images that are produced and the results that can be attained using embodiments of the present disclosure. Figure 17(A) shows the database of images for websites that are not spam while Figure 17(B) shows the database of images for websites that are spam.

[0259] It will be understood that many variations may be made to the above apparatus, systems and methods whilst retaining the advantages noted previously. For example, where specific components have been described, alternative components can be provided that provide the same or similar functionality.

[0260] For example, as mentioned previously, various types of logic gates, such as XOR, OR, AND, NOR, NOT, and XNOR, can be used to combine a set of features with an item of content and images can be generated from the resulting modified representations; such images can be used to classify the underlying content used to generate the modified representations. This can be performed in different ways. For example, in some cases, a whole source code file may be subjected to a single operation (e.g., an XOR or a NOT and or an AND, etc.) and different images per operation can be produced, as in Figures 9 to 15. However, in some embodiments, different operations may be applied to different parts of the source file. That is, in the methods described herein, combining the item of digital content with the set of features may comprise applying a plurality of Boolean functions to the item of digital content. For example, the first 15 bytes could be subjected to an XOR. operation, then the next 5 bytes to an AND operation, etc. Thus, different logic gates can be applied to one item of content (and hence one image file might be derived from multiple Boolean functions). This may enhance the quality of classification of malicious content.

[0261] Moreover, the methods described herein can be implemented as software-as-a- service (SaaS), to allow them to work with any email provider. This is particularly advantageous as many email providers spam filters have false positives and negatives, the occurrence of which can be reduced using embodiments described herein.

[0262] Each feature disclosed in this specification, unless stated otherwise, may be replaced by alternative features serving the same, equivalent or similar purpose. Thus, unless stated otherwise, each feature disclosed is one example only of a generic series of equivalent or similar features.

[0263] As used herein, including in the claims, unless the context indicates otherwise, singular forms of the terms herein are to be construed as including the plural form and, where the context allows, vice versa. For instance, unless the context indicates otherwise, a singular reference herein including in the claims, such as "a" or "an" (such as a feature or an indicator) means "one or more" (for instance, one or more features, or one or more indicators). Throughout the description and claims of this disclosure, the words "comprise", "including", "having" and "contain" and variations of the words, for example "comprising" and "comprises" or similar, mean that the described feature includes the additional features that follow, and are not intended to (and do not) exclude the presence of other components.

[0264] The use of any and all examples, or exemplary language ("for instance", "such as", "for example" and like language) provided herein, is intended merely to better illustrate the disclosure and does not indicate a limitation on the scope of the disclosure unless otherwise claimed. No language in the specification should be construed as indicating any non-claimed element as essential to the practice of the disclosure.

[0265] Any steps described in this specification may be performed in any order or simultaneously unless stated or the context requires otherwise. Moreover, where a step is described as being performed after a step, this does not preclude intervening steps being performed.

[0266] All of the aspects and / or features disclosed in this specification may be combined in any combination, except combinations where at least some of such features and / or steps are mutually exclusive. In particular, the preferred features of the disclosure are applicable to all aspects and embodiments of the disclosure and may be used in any combination. Likewise, features described in non-essential combinations may be used separately (not in combination).

Claims

Claims:

1. A computer-implemented method for identifying malicious digital content, the method comprising: determining a set of features based on an item of digital content, wherein the set of features comprises a plurality of indicators each indicating whether the item of digital content exhibits a malicious characteristic; combining the item of digital content with the set of features to generate a modified representation of the item of digital content; forming at least one image based on the modified representation of the item of digital content; and identifying whether the item of digital content is malicious by inputting the at least one image to a classifier configured to classify whether input images are indicative of malicious content.

2. The method of claim 1, further comprising a step of representing the item of digital content in binary form, wherein the step of combining the item of digital content with the set of features comprises combining the binary form with the set of features.

3. The method of claim 1 or claim 2, wherein combining the item of digital content with the set of features comprises applying a Boolean function to the item of digital content and the set of features.

4. The method of claim 3, wherein the Boolean function comprises any one or more of: AND; NAND; XNOR; XOR; OR; and NOR.

5. The method of claim 3 or claim 4, wherein combining the item of digital content with the set of features comprises applying a plurality of different Boolean functions to the item of digital content and the set of features.

6. The method of any preceding claim, further comprising dividing the item of digital content into a plurality of portions, wherein the step of combining the item of digital content with the set of features comprises combining each portion of the plurality of portions with the set of features.

7. The method of claim 6, wherein the modified representation of the item of digital content is a concatenation of the combination of each portion of the plurality of portions with the set of features.

8. The method of any preceding claim, wherein combining the item of digital content with the set of features comprises convolving the set of features with the item of digital content to generate the modified representation of the item of digital content.

9. The method of any preceding claim, wherein identifying whether the item of digital content is malicious comprises identifying whether the item of digital content is any one or more of: phishing; spam; and / or malicious code.

10. The method of any preceding claim, wherein the indicators comprise indications of any one or more of: whether the item of digital content has a Uniform Resource Locator (URL) length exceeding a threshold value; whether the indication of the item of digital content is an Internet Protocol (IP) address; whether the item of digital content performs redirection; and whether the item of digital content uses Hypertext Transfer Protocol Secure (HTTPS).

11. The method of any preceding claim, wherein the set of features is a binary string and each indicator is at least one bit of the binary string.

12. The method of any preceding claim, wherein the at least one image comprises an image depicting a binary representation of the item of digital content.

13. The method of any preceding claim, wherein the at least one image comprises any one or more of: an entropy image depicting the modified representation of the item of digital content; a detail image depicting the modified representation of the item of digital content; and / or a magnitude image depicting the modified representation of the item of digital content.

14. The method of any preceding claim, wherein the at least one image comprises a plurality of images, optionally wherein the plurality of images comprises three images.

15. The method of any preceding claim, wherein the item of digital content comprises any one or more of: an email; a website; a file; and an executable file.

16. The method of any preceding claim, further comprising: receiving an indication of the item of digital content; and retrieving the item of digital content based on the indication of the item of digital content prior to combining the item of digital content with the set of features.

17. The method of claim 16, wherein the indication of the item of digital content comprises any one or more of: a Uniform Resource Locator (URL) of the item of digital content; an Internet Protocol (IP) address of the item of digital content; and a filepath of the item of digital content.

18. The method of any preceding claim, wherein the classifier comprises any one or more of: a machine learning model; multiple machine learning models; a neural network; a Random Forest (RF); a Convolutional Neural Network (CNN); a CNN comprising three fully-connected layers and five convolutional layers, wherein one or more of the convolutional layers is followed by a max-pooling layer); a Naive Bayes (NB) classifier; a Support Vector Machine (SVM); a Backpropagation Neural Network (BPNN); an Adaptive Boosting algorithm; a Logistic Regression classifier; and a Decision Tree.

19. The method of any preceding claim, wherein the classifier is a trained image classifier.

20. A computer-implemented method for training a classifier to identify malicious digital content, the method comprising: for each of a plurality of items of digital content, determining a set of features based on the respective item of digital content, wherein each set offeatures comprises a plurality of indicators each indicating whether the respective item of digital content exhibits a malicious characteristic; combining each item of digital content with the respective set of features to generate respective modified representations of the plurality of items of digital content; for each item of digital content, forming at least one image based on the respective modified representation; and training a classifier to classify whether input images are indicative of malicious content using the modified representations of the items of digital content and classification data for the plurality of items of digital content, the classification date indicating whether each item of digital content is malicious.

21. A computing system comprising one or more processors adapted to perform the method of any preceding claim.

22. A computer program product comprising instructions that, when the program is executed by a computing system, cause the computing system to carry out the method of any of claims 1 to 20.

23. A computer readable medium having stored thereon the computer program product of claim 22.

24. A training data set comprising a plurality of items of digital content and classification data for the plurality of items of digital content, the classification data indicating whether each item of digital content is malicious, the plurality of items of digital content each being combined with a respective set of features, each set of features comprising a plurality of indicators each indicating whether the respective item of digital content exhibits a malicious characteristic.

25. A computer readable medium having stored thereon the training data set of claim 24.

Images