238 results about "Phishing" patented technology

An AI-based Cybersecurity System and Method enable real-time detection, analysis, and mitigation of cyber threats within computing networks using adaptive artificial intelligence. The system continuously monitors network traffic, extracts behavioral and contextual attributes, and applies deep learning-based inference to identify anomalous activities indicating security breaches. The method integrates several computational units, including a network monitoring unit, feature extraction unit, artificial intelligence processor, contextual reasoning processor, and decision synthesis unit, to compute a composite risk index quantifying threat likelihood and severity. A classification processor categorizes detected threats into types such as ransomware, phishing, or unauthorized access, while a mitigation control processor initiates automated response actions to isolate compromised nodes and restore network integrity. An adaptive learning processor updates AI models using feedback from confirmed incidents. This provides a scalable, self-evolving cybersecurity framework that minimizes human intervention and enhances resilience against dynamic and zero-day threats.

Techniques for recognizing phishing URLs on Software as a Service (SaaS) platforms are disclosed. A candidate URL is received. A determination is made that the candidate URL is a SaaS hosted URL. In response to the determination, the URL is evaluated using a model trained on SaaS hosted content. A remedial action is performed in response to determining that the received URL is a phishing URL.

In some embodiments, a fraud prevention system uses a chatbot agent to provide input to a threat analyzer. The chatbot agent converses with a user to identify a security need, guide the user into providing relevant data (e.g., a content of an email, a screenshot of a social media conversation), identify a target object for analysis, and indicate the target object to the threat analyzer. In turn, the threat analyzer applies a battery of tests to determine whether the target object is indicative of online fraud, such as a phishing attempt. The threat analyzer returns a verdict of the analysis to the chatbot agent for communication to the user.

Embodiments describe herein relate to the automatic generation of personalised phishing communications for a target user within an organization. The content of a phishing communication is generated based on a generative artificial intelligence algorithm. In certain embodiments, data associated with the target user is as a part of a prompt to the generative artificial intelligence algorithm, enabling personalised content to be created. In further embodiments, we describe the use of templates associated with various parameters to be used as part of the prompt, which allows the content of the phishing communication to be customised according to the training requirements of a target user with minimal administrative input.

A cloud-based network security system (NSS) is described. The NSS uses a sandbox to safely detonate and extract information about a document and uses machine learning algorithms to analyze the information to predict whether the document contains malicious software. Specifically, during the detonation, static and dynamic information about the document is captured in the sandbox as well as character strings from images in the document. The dynamic information (and sometimes the static information) is input to an AI or machine learning model trained to provide an output indicating a prediction of whether the document contains malware. The character strings are compared with a batch of phishing keywords to generate a heuristic score. A validation engine combines the output from the AI or machine learning model and the heuristic score to classify the document as malicious or clean. Security policies can then be applied based on the classification.

The invention discloses a detection method and system for a phishing mail, and relates to the technical field of mail security communication. The detection method for the phishing mail comprises the following steps of dual-stage screening, feature extraction and fusion, confrontation sample verification and detection model test and evaluation. According to the method, the mail sample is input into the phishing mail detection model to obtain the mail sample to be tested, the phishing mail double-stage screening is carried out to judge whether the mail sample is the phishing mail, and if the fine-grained mail screening is carried out, the total feature vector is obtained to carry out dynamic scoring to judge whether deep behavior analysis is carried out or not. The method comprises the following steps of: firstly, carrying out confrontation sample verification to output a test result, judging whether to carry out model parameter optimization, and finally, carrying out detection model test evaluation to feed back the test condition of the phishing mail detection model, thereby improving the accuracy of identifying the phishing mail by the phishing mail detection model. The problem that in the prior art, a phishing mail detection model is low in phishing mail recognition accuracy is solved.

The invention discloses a network information security defense detection method and system, and relates to the technical field of network information security, and the system comprises a website security check module, a downloading security check module, an access security check module and a display execution module. In daily Internet surfing, net friends often encounter network security problems, for example, users may receive phishing mails disguised as banks or download malicious software in untrusted websites, resulting in data stealing. Identity embezzlement and data leakage increase privacy and financial risks, and man-in-the-middle attack may intercept sensitive information through an unencrypted Wi-Fi network. According to the method, security detection including domain name check, certificate verification, content scanning, integrity verification and the like is carried out on websites, downloading programs and external access equipment, so that security risks are found and processed in time; and meanwhile, by adopting a virtual machine isolation technology and behavior monitoring, the protection on malicious programs is enhanced, the security risk of external equipment is evaluated, and the security of a network environment and data is ensured.

Disclosed are systems and methods that monitor for malicious and unauthorized behaviors, determine categories for detected malicious behaviors, determine why a domain is determined to be malicious, and provide information to users that identifies the categories and reasons as to why a domain is determined to be malicious. In some implementations, the disclosed systems and methods may be utilized to provide monitoring security to customers of a cloud service. For example, customers of a cloud service may maintain an account with the cloud service and the disclosed implementations may be utilized to protect those accounts from malicious attacks and cybercrimes such as, but not limited to, spam, phishing, malware, botnets, etc.

Methods, systems, and devices for phishing-resistant authenticator enrollment are described. An authentication service may encrypt a token that is usable for an initial enrollment of a user in an authenticator application. The authentication service may transmit a first payload to the user. The first payload includes at least the encrypted token. An authenticator application may receive, from the user, a request to initiate the initial enrollment of the user on a device. The request may include the encrypted token. The authentication service may enroll the user in the authenticator application on the device based on decryption of the encrypted token using an encryption key on a near-field communication (NFC) device.

There is disclosed a method of providing passive phishing remediation for an enterprise, including: displaying, to a user of a mobile device, an email; receiving from the user a one-click request to perform additional analysis of the email; providing the email to a phishing mitigation service; assigning the email a reputation score, generating a human-readable reputation display for the email, wherein the human-readable reputation display includes at least three grades comprising safe, unknown or unreliable, and unsafe or malicious; and providing the human-readable reputation display as a push notification to the mobile device.

The present disclosure relates to the field of email security detection. Disclosed are an email security detection apparatus, method and device, and a storage medium. The method includes: an email feature extraction component, configured to collect and extract the behavior features of a sender and a recipient of an email, and the main body features of the email; a behavior feature analysis component, configured to comprehensively analyze the extracted behavior features of the sender and the receiver to identify a suspicious phishing email; a main body feature analysis component, configured to detect and analyze the extracted main body features of the email, and identify a suspicious phishing email; and an email filtering and alarming component, configured to perform filtering and real-time alarming and pushing on the suspicious phishing email identified by at least one of the behavior feature analysis component and the main body feature analysis component.

A method and a computing device for clustering phishing web resources based on images of visual content thereof are provided. The method comprises: receiving references to a plurality of phishing web resources; generating, for a given phishing web resource of the plurality of phishing web resources, at least one image of a visual content of the given phishing web resource; analyzing the at least one image associated with the given phishing web resource, the analyzing comprising identifying contours of elements of the visual content of the given phishing web resource within the at least one image; conducting pairwise comparison between the contours associated with the given phishing web resource and contours of stored clusters of visual content images; and storing, in a database, data indicative of an association between the given phishing web resource and a respective cluster of the at least one image.

Embodiments of the technology described herein identify and mitigate phishing attempts by analyzing user input using a client-side proxy component and a proxy server. Embodiments disclosed herein provide systems, methods, and computer-storage media for employing proxy server capabilities in conjunction with a snapshot capturing an image or video recording of a target action input by a user into a software application. Certain embodiments disclosed herein employ proxy server capabilities to capture a snapshot and / or screen recording based on a user authorization or approval. For example, the proxy server proactively captures the snapshot or screen recording prior to, during, and after the user performing a target action. From the snapshot, certain embodiments extract snapshot features or determine enriched-contextual event data that is used to perform a mitigation action, generate a security mitigation score, or update an administrator portal activity log for an authorized administrator.

Methods and systems for annotating and assessing content, including QR codes, using a web page investigator to avoid dangerous scans of such content are described herein. A security module executing on a client device may receive a request for web content. A computer vision model may then scan the requested web content to identify and annotate graphical features on the webpage prior to rendering the web content on a display of the client device. The computer vision model may identify a QR code and transmit information encoded within the QR code to a server executing a phishing and content protection (PCP) engine for analysis. When the identified QR code is indicated to be malicious, the client device may render a modified version of the requested web content to discourage the user from scanning the identified QR code.

Systems and methods for detecting phishing using image hashing include obtaining a plurality of images from different sources, generating a hash for each image, comparing at least one hash associated with a first image to one or more hashes associated with a second image, calculating a similarity score based on the comparing, and classifying the first image based on the similarity score.

The invention relates to the field of block chain security, and discloses a detection method for phishing nodes in an Ethereum network. The method comprises the following steps: firstly, acquiring transaction data of a target node from an Ethereum network, and constructing a first-order transaction graph and a second-order transaction graph; wherein the first-order transaction graph retains an original transaction structure and time sequence information; and the second-order transaction graph combines a plurality of repeated transaction edges appearing between the same node pair, and adds the sum as the sum of a new transaction edge, so that the graph structure is simplified. Aiming at the first-order transaction graph, extracting time sequence characteristics of a transaction sequence through a gating loop unit (GRU); for embedding of a second-order transaction graph, a graph attention network (GAT) is utilized to introduce amount features. And finally, fusing the first-order time sequence features and the second-order structure features, inputting the fused features into a classification model, and judging whether the target node is a phishing node or not. According to the method, the accuracy and robustness of phishing node detection in the Ethereum network can be improved.

The invention discloses a phishing mail detection method and system based on a large model, and relates to the technical field of network security, the system comprises a real-time detection system and an offline analysis system, and a mail content analysis module receives real-time mail data to form structured data; the detection rule center matches the structured data with a detection rule, directly intercepts a mail hitting a high-confidence blacklist rule, and transmits the structured data of a mail hitting a low-confidence blacklist rule into a phishing mail detection agent; the phishing mail detection agent sequentially performs mail header suspicious feature analysis, mail body semantic analysis, mail body structure analysis and attachment content analysis on the structured data to obtain a mail intention, a link and an attachment file; and performing corresponding analysis by combining a detection tool, and judging whether the mail is a phishing mail or not according to an analysis result. A large-model-driven phishing mail detection intelligent agent is utilized, and a detection path is dynamically planned to cope with endless phishing mail attack means.

The invention discloses an anti-phishing webpage detection system and method. The anti-phishing webpage detection system comprises a webpage data capture module, a risk analysis module, a malicious webpage judgment module and a response decision module, relates to the technical field of anti-phishing webpage detection. According to the method, multi-dimensional data, including URL information, domain name information and webpage content information, of a webpage are extracted through the webpage data capturing module, a comprehensive original data basis is provided, and accurate support is provided for follow-up risk analysis; according to the method, comprehensive risk analysis is carried out by utilizing various webpage features including URL features, domain name features and content features, and potential phishing webpages can be effectively identified by calculating risk scores of the URL, the domain name and the webpage content; according to the method, the web pages are classified according to the comprehensive risk scores, the high-risk web pages are intercepted, the emergency response logs are generated, the low-risk web pages are continuously monitored, and safe browsing of a user is ensured.

Disclosed is phishing classifier that classifies a URL and content page accessed via the URL as phishing or not is disclosed, with URL feature hasher that parses and hashes the URL to produce feature hashes, and headless browser to access and internally render a content page at the URL, extract HTML tokens, and capture an image of the rendering. Also disclosed are an HTML encoder, trained on HTML tokens extracted from pages at URLs, encoded, then decoded to reproduce images captured from rendering, that produces an HTML encoding of the tokens extracted, and an image embedder, pretrained on images, that produces an image embedding of the image captured. Further, phishing classifier layers, trained on the feature hashes, the HTML encoding, and the image embedding, process the URL feature hashes, HTML encoding and image embeddings to produce a likelihood score that the URL and the page accessed presents a phishing risk.

The present disclosure relates generally to computer security, and, more particularly, to systems and methods for assisting a user in avoiding the accidental disclosure of confidential or sensitive information, as well as avoiding potential security breaches, including phishing and impersonation, malware, and security issues, particularly with respect to websites and electronic communications.

The embodiment of the invention discloses a phishing website detection method and device, electronic equipment and a medium, and the method comprises the steps: extracting a structural information feature vector and a content information feature vector of a first HTML document of a target website, and splicing the structural information feature vector and the content information feature vector to obtain a first feature vector of the target website; extracting a structural information feature vector and a content information feature vector of a second HTML document of the suspicious website, and splicing the structural information feature vector and the content information feature vector to obtain a second feature vector of the suspicious website; and according to the first feature vector and the second feature vector, detecting the phishing website through a pre-trained prediction model. Compared with the detection of the phishing website only depending on the content displayed in the website page, the method provided by the invention has the advantages that the feature vectors of the structure information and the content information of the HMTL document are respectively extracted and calculated, so that the model can comprehensively capture the overall features of the website, and the accuracy of the detection of the phishing website is improved.

The invention relates to the technical field of computers, in particular to a phishing website detection method, device and equipment and a storage medium, and the method comprises the steps that a data set of a to-be-detected website is acquired, and the data set of the to-be-detected website comprises URL and HTML codes of the to-be-detected website; determining a feature vector of the URL based on the URL, and determining a first feature vector corresponding to the HTML code based on the HTML code; the feature vector of the URL and a first feature vector corresponding to the HTML code are input into a first model, a first website prediction result output by the first model is obtained, and the first model is deployed in a browser plug-in of a client; and when the first website prediction result indicates that the to-be-detected website is the phishing website, sending a data set and a webpage screenshot of the to-be-detected website to the server.

Aspects of the disclosure relate to dynamically generating simulated attack messages configured for annotation by users as part of cybersecurity training. A computing platform may generate a simulated attack message including a plurality of elements and send the simulated attack message to an enterprise user device. Subsequently, the computing platform may receive, from the enterprise user device, user selections annotating selected elements of the plurality of elements of the simulated attack message. The computing platform may thereafter identify one or more training areas for the user based on the user selections received from the enterprise user device, generate a customized training module specific to the identified one or more training areas, and send the customized training module to the enterprise user device. Sending the customized training module to the enterprise user device may cause the enterprise user device to display the customized training module.

Systems and methods include receiving a customer domain from a user via a user device; parsing a plurality of candidate look-alike domains based on the customer domain; executing at least one detection technique selected from a plurality of short URL detection techniques to determine whether one or more short URLs redirect to one of the plurality of candidate look-alike domains; and in response to determining, by the at least one detection technique, that the one or more short URLs redirect to one of the plurality of candidate look-alike domains, classifying that candidate look-alike domain as a phishing attempt.

Systems and methods are described for contextualizing a simulated phishing communication based at least on one of language and locale. Initially, a template for a simulated phishing communication is created with content in a source language. Then one or more contextual parameters for a user are identified. The one or more contextual parameters identify at least one of a target language and a target locale. The content of the simulated phishing communication is modified according to at least one of the target language and the target locale and the simulated phishing communication is communicated to one or more devices of the user with the content modified for at least one of the target language and the target locale.

The invention discloses a multi-modal phishing website detection method based on a large model, and the method comprises the steps: extracting a domain name text of a URL address of a target website and a webpage screenshot corresponding to the URL address through a server, and then carrying out the preprocessing of the obtained domain name text and webpage screenshot, and obtaining a text initial feature and a picture initial feature; text features and picture features are obtained through processing of a neural network deep learning model CLIP; calculating the similarity between the obtained text features and the picture features to obtain an image-text similarity matrix, and normalizing the image-text similarity matrix to obtain an image-text probability matrix; generating a decision set and an extension set from the image-text probability matrix through an analysis selector, and finally judging whether the target website belongs to the phishing website or not by analyzing the decision set and the extension set.

The systems and methods disclose an automated effective template generation and recommendation for selection. A semantic similarity of a plurality of messages may be identified that at least meets a similarity threshold, each of the plurality of messages reported by a plurality of users as a potentially malicious message. The plurality of messages may be indexed under a common template identifier. One or more messages of the plurality of messages indexed under the common template identifier may be determined to have a report-to-reach ratio less than a report-to-reach threshold. Responsive to the determination, the one or more messages may be identified to be used for generating one or more simulated phishing templates. A recommendation of the one or more templates may be provided to a system administrator and / or a security awareness and simulation training platform to create and deliver simulated phishing messages using the templates.

Emails or other communications are labeled with a category label such as “spam” or “good” without using confidential or Personally Identifiable Information (PII). The category label is based on features of the emails such as metadata that do not contain PII. Graphs of inferred relationships between email features and category labels are used to assign labels to emails and to features of the emails. The labeled emails are used as a training dataset for training a machine learning model (“MLM”). The MLM identifies unwanted emails such as spam, bulk email, phishing email, and emails that contain malware.

In some embodiments, a method includes receiving first audio data provided via a first device of a first user during a call session between the first device and a second device of a second user, receiving second audio data provided via the second device during the call session, providing the first audio data and / or the second audio data to a large language model (LLM) to determine an intent of the first user, and transmitting a control message in response to determining the intent of the first user is associated with soliciting sensitive information from the second user.

A computerized platform for implementing a positive reinforcement-based educational campaign to increase awareness of indications of signs of unsafe e-mails is configured to perform a method utilizing an assignment-based approach to provide an assignment to a user in which the user is presented with a simulated e-mail including one or more indicators the user is instructed to determine as being more likely associated with a social engineering-containing e-mail or a safe e-mail. This method of phish testing simulations eliminates the possibility of false positive metrics tied to a company's cyber resiliency and thus improves the overall accuracy of cyber program measures and reporting designed to prevent the most prevalent and successful cyber-attack methods in use today-social engineering delivered through phishing e-mails.