87 results about "Phishing attack" patented technology

Improved email security and prevention of phishing attacks using a Large Language Model (LLM) engine. A computerized method includes evaluating whether a digital message received at a Protected Entity is malicious or legitimate, by performing: (a) obtaining extracted data from documents and data repositories of the Protected Entity; feeding the extracted data into an LLM engine; and constructing an Organizational Context Index having vectors of LLM-generated embeddings that describe relations and roles of members and objects of the Protected Entity; (b) prompting the LLM to evaluate whether the digital message is malicious or legitimate, based on LLM analysis of a query envelope that includes at least: (i) content of the digital message, and (ii) meta-data of the digital message, and (iii) a set of LLM-based embeddings from the Organizational Context Index that pertain to that digital message.

The invention discloses a bidirectional authentication secure mobile communication method and system based on a public key digital fingerprint, and belongs to the technical field of communication security. The method specifically comprises the following steps: S1, digital certificate application and issuing: a mobile terminal and a service server respectively use an encryption algorithm to generate an asymmetric key pair which comprises a public key and a private key, an entity submits a CSR file which comprises a public key, entity identity information and an extension field to a CA, and the CA strictly audits the entity identity and issues a digital certificate; and performing digital signature on the public key and the entity information by using a CA private key after the auditing is passed. Two-way identity authentication is achieved, communication safety is improved, a traditional scheme only supports one-way authentication of a client to a server and is prone to phishing attack and identity false use, digital certificates are exchanged before communication between a mobile terminal and a service server, the legality of the certificates is verified through a public key of a CA root certificate, and the authenticity of the identities of the two parties is ensured. A bidirectional authentication mechanism effectively prevents man-in-the-middle attack and identity counterfeiting problems, and the security risk is greatly reduced.

The invention discloses a phishing document de-obfuscation and feature extraction method and an application thereof in attack detection. The de-obfuscation comprises the steps of obtaining an obfuscation macro code of a phishing document, constructing a prompt engineering template by utilizing a pre-training language model, analyzing an obfuscation logic structure and generating a de-obfuscation rule and a reduction strategy; the method comprises the following steps: structuring a confused macro code into an abstract syntax tree through an analysis tool, matching a typical confusion mode based on a regular expression, and performing simulation and cell reference analysis in combination with a function to realize structure preliminary reduction, control flow semantic reduction and operation path construction; according to the unmixing rule and the abstract syntax tree, the confusion structure is converted into a readable macro statement, a macro code instruction sequence with confusion semantics removed is generated, and a semantic sequence obtained after unmixing is output. The feature extraction comprises word feature extraction, Token feature extraction, abstract syntax tree feature extraction and relation feature extraction. According to the method, the bottleneck that traditional phishing attack detection and confusion documents are difficult to recognize is broken through, and the detection accuracy of phishing document attacks is improved.

The invention discloses an efficient cascade multi-stage self-adaptive threshold fishing detection method, and provides a cascade multi-stage self-adaptive threshold fishing detection framework aiming at the problems of insufficient anti-robustness, insufficient multi-mode collaboration, unbalanced detection efficiency and precision and the like in the existing fishing detection technology. In the first stage, millisecond-level primary screening is achieved through a lightweight single-mode detection model, and 80% or above of low-level threats are intercepted; and in the second stage, a multi-modal fusion model with high anti-interference capability is adopted, the anti-robustness is improved by combining frequency domain feature enhancement and a dynamic noise injection technology, deep correlation features are mined through a cross-modal attention mechanism, and accurate recognition of complex phishing attacks is realized. And meanwhile, an online learning module is integrated, so that the system continuously adapts to a novel attack mode, and finally, the high-precision, low-delay and strong-anti-interference detection capability is achieved.

A computer-implemented method for identifying brands utilized in website phishing campaigns may include (i) capturing a website screenshot including visual elements representing a potential phishing vulnerability, (ii) transforming, utilizing a deep learning model, the website screenshot into an image representation including embeddings, (iii) determining whether the transformed website screenshot matches a dataset including reference transformed website screenshots representing previously identified brands utilized in phishing campaigns, (iv) clustering, upon determining a mismatch between the transformed website screenshot and the dataset, the transformed website screenshot with other transformed website screenshots sharing the visual elements representing the potential phishing vulnerability and one or more visual similarities, and (v) performing, based on the clustering, a security action that protects against potential phishing attacks by extracting brand information for adding to the dataset. Various other methods, systems, and computer-readable media are also disclosed.

A user behavior training model is generated, using machine learning, from tracking a plurality of trusted users for interactions with respect to a plurality of monitored phishing e-mails. When a unique phishing attack is detected from an incoming email, a new campaign is initiated. A unique phishing attack email that is modified by the user behavior model is generated for each user. In particular, a first test phishing e-mail for a first user is modified based on interactions tracked for the first user and a second test phishing e-mail for a second user is modified based on interactions tracked for the second user. Based on responses to the plurality of test phishing emails, a plurality of custom training videos is generated. A first training video is modified based on a response from the first user and a second training video is modified based on a response from the second user.

Systems and methods for detecting a phishing attack in an email message. The method includes intercepting and evaluating an email, and generating a reputation score based on the evaluation of the email message. If the malicious component is detected, the email is blocked, if not, a trust score is generated. A determination is made whether the email is generated by AI, based on LLM. A certainty score is generated which is indicative of intentions and context of the email message being malicious. When the certainty score is higher than a threshold, a combined score by combining the reputation score, the trust score, and the certainty score. When the combined reputation score is higher than a threshold, the email is blocked, and if lower, a summary is generated by a summary AI engine. Based on a comparison with known malware summaries, the email is flagged or blocked.

Provided herein are systems and methods for detecting a phishing attack. The method comprises: processing an original message to determine whether the original message is suspicious or benign, upon determining the original message is suspicious, generating multiple copies of the original message for detecting a phishing attack, where the multiple copies are varied from the original message in least one of tones, formats, and writing styles, and the multiple copies are generated to be similar to a training dataset that is utilized to train a phishing attack detection engine; and processing the multiple copies and the original message by the phishing attack detection engine to determine whether the original message is malicious or benign. One or more copies from the multiple copies that are not identified as malicious are utilized to further train the phishing attack detection engine automatically.

Provided are systems, software, and methods for phishing analysis and detection. The provided systems, software, and methods may comprise interfaces configured to capture and scan network session activity in real-time to detect a phishing attack using a set of trained machine learning classifiers, detect a phishing attach, classify the attack into one or more phishing classes, block the phishing attack and provide a safe preview of the blocked phishing attack. The machine learning classifiers may be deployed remotely. The systems, software, and methods may further comprise a web application programing interface configured to integrate the one or more analysis interfaces into at least one external software or application.

Obfuscation techniques used in phishing attacks that evade detection using current machine learning models can be identified and statistically characterized for use in generating adversarial training samples to improve the performance of a machine learning model phishing classifier. By using statistical information regarding the prevalence and effectiveness of various obfuscation techniques observed in real-world samples, adversarial samples that are effective and realistic examples of phishing content that evades phishing content classifier detection can be generated and used to augment the data set used for training or re-training the machine learning model classifier.

An apparatus, system, product and method comprising: obtaining a selection of page elements of a source page that are estimated to represent a visual appearance of the source page; generating respective representations of the page elements, wherein the representation is configured to be used for acquiring a page element in different pages; obtaining a target page, wherein a user is enabled to interact with the target page; determining a visual similarity measurement between the source page and the target page, wherein the visual similarity measurement is based on a successful acquisition in the target page, of the page elements, using the respective representations; classifying the target page as a phishing attack based on the visual similarity measurement, whereby detecting the phishing attack; and performing a responsive action in response to said detecting the phishing attack.

In an example, a method for detecting phishing attacks includes: receiving textual representation of a portion of a conversation between two or more parties; determining one or more dialog turns; classifying, using a first ML model, each of the one or more dialog turns into a plurality of conversational intent classes to generate a first classification; classifying, using a second ML model, each of the one or more dialog turns into a plurality of PII request classes to generate a second classification; generating, based on the first classification and the second classification, a corresponding risk score for each of the one or more dialog turns; generating, based on the corresponding risk score, an accumulated risk score for the portion of the conversation; and triggering, based on determining that the generated accumulated risk score satisfies a predefined threshold value, an indication of a potential disclosure of PII.

An apparatus, system, product and method comprising: obtaining a selection of page elements of a source page that are estimated to represent a visual appearance of the source page; generating respective representations of the page elements, wherein the representation is configured to be used for acquiring a page element in different pages; obtaining a target page, wherein a user is enabled to interact with the target page; determining a visual similarity measurement between the source page and the target page, wherein the visual similarity measurement is based on a successful acquisition in the target page, of the page elements, using the respective representations; classifying the target page as a phishing attack based on the visual similarity measurement, whereby detecting the phishing attack; and performing a responsive action in response to said detecting the phishing attack.

System and method for anti-phishing emails based on link domain name and user feedback The invention provides a system and a method for anti-phishing emails based on link domain name and user feedback. The system comprises an email receiving device, an email pre-processing device, an email property judging device, an outputting device and a feedback processing device. The method comprises the following steps: analyzing characteristics of the link domain name in the email, combining with a controlled network user feedback strategy, and identifying phishing emails and doubtful phishing emails. The Invention has advantages of high identification efficiency, low resource consumption and no error rate. The Invention can be configured to email servers, gateway servers and the like that require high real-time performance, protect the controlled network user against cheating by the phishing emails, resist the interference from the spiteful user in the controlled network, and can be widely applied to the application fields of network email filtering management, anti-phishing attack and the like.

Techniques are described for providing a threat analysis platform capable of automating actions performed to analyze security-related threats affecting IT environments. Users or applications can submit objects (e.g., URLs, files, etc.) for analysis by the threat analysis platform. Once submitted, the threat analysis platform routes the objects to dedicated engines that can perform static and dynamic analysis processes to determine a likelihood that an object is associated with malicious activity such as phishing attacks, malware, or other types of security threats. The automated actions performed by the threat analysis platform can include, for example, navigating to submitted URLs and recording activity related to accessing the corresponding resource, analyzing files and documents by extracting text and metadata, extracting and emulating execution of embedded macro source code, performing optical character recognition (OCR) and other types of image analysis, submitting objects to third-party security services for analysis, among many other possible actions.

Techniques are described for providing a threat analysis platform capable of automating actions performed to analyze security-related threats affecting IT environments. Users or applications can submit objects (e.g., URLs, files, etc.) for analysis by the threat analysis platform. Once submitted, the threat analysis platform routes the objects to dedicated engines that can perform static and dynamic analysis processes to determine a likelihood that an object is associated with malicious activity such as phishing attacks, malware, or other types of security threats. The automated actions performed by the threat analysis platform can include, for example, navigating to submitted URLs and recording activity related to accessing the corresponding resource, analyzing files and documents by extracting text and metadata, extracting and emulating execution of embedded macro source code, performing optical character recognition (OCR) and other types of image analysis, submitting objects to third-party security services for analysis, among many other possible actions.

The application discloses a kind of deep fake detection and tracing systems for network phishing attack, including the following steps: multi-source data acquisition module is used to form pre-processing multi-source data;Feature extraction module is used to form associated feature data;Association graph generation module is used to build fake content association layer and phishing propagation association layer, form unified attack association graph;Path screening construction module is used to identify effective relationship section, and build calculation path set;Similarity calculation backwrite module is used to perform PathSim similarity calculation, form the unified attack association graph after state update;Iterative calculation update module is used to re-execute PathSim similarity calculation, form candidate association result;Back-checking analysis output module is used to verify based on fake evidence and propagation evidence, and convert the candidate association result after verification into attack analysis result.The application improves the accuracy of deep fake content identification in network phishing attack scenario.

Disclosed in embodiments of the present application are a third-party payment method and system. In the method, a payment request generated by a third-party server contains user information parameters and is associated with current ordering user identity information; upon receiving the payment request, a payment platform writes payment user identity information into the user information parameters, so that the third-party server can verify the consistency of the payment user identity information and the ordering user identity information on the basis of the user information parameters; and the payment platform performs a payment operation only when the third-party server verifies that the payment user identity information is consistent with the ordering user identity information. On the basis of the mechanism, during third-party payment, potential attack risks can be automatically detected, potential external phishing attacks can be defended against, user fund loss can be avoided, and a personal data protection capability can be provided. The system of the embodiments of the present application also has the described beneficial effects.

A system, computer program product, and method for training users in phishing prevention may challenge a user with gamified user-specific phishing attacks for a user to encounter in a temporal pattern. Phishing data, including data relating to phishing techniques and actual and non-actual (fake) phishing attacks, may be generated or obtained and input to the training engine. User-related data, including user information, one or more social engineering vectors, or organization information relating to an organization, may be obtained and digitally manipulated. A sequential cross model training engine may process the phishing data and digitally manipulate the user-related data to generate training activities that include test phishing attacks. A gamification engine may generate gamified user-specific testing that includes two or more of the test phishing attacks in a sequence in real time. The test phishing attacks, which may be in a non-question format, may target the user in an XR environment.

The invention belongs to the technical field of network security, and particularly provides a method and device for identifying a phishing attack of a mailbox, and the method comprises the steps: S1, collecting mail data, carrying out the cleaning, labeling and multi-carrier mail preprocessing of the mail data, and obtaining a mail sample; s2, extracting a mail head feature, a text feature, a link feature, an attachment feature and a two-dimensional code feature from the mail sample; s3, performing risk assessment on the mails by utilizing a machine learning classification model, and judging whether the mails are phishing mails or not; s4, performing automatic isolation, early warning or prompting on the phishing mail; and S5, collecting user feedback and system false alarm / missing report conditions, and continuously optimizing and training the machine learning classification model. According to the method, data quality is guaranteed through multivariate data integration and fine processing, risks are accurately evaluated by combining multi-dimensional feature extraction with an advanced machine learning classification model, the recognition accuracy is effectively improved, false and missing reports are reduced, mails can be flexibly processed according to the risks, the model is continuously optimized to adapt to a new attack technique, and the efficiency is improved. And a lasting guarantee is provided for enterprise and user information security.

Systems and methods for internal email filtering are provided. Various embodiments of the present technology provide systems and methods for improved email filtering including a dedicated internal email filtering process designed to intercept all emails exchanged within the organization and detect whether the email is internal or external. The system scans each internal email to detect potential threats, such as viruses, malware, or phishing attempts, and immediately quarantines any identified threats, preventing the email from being delivered to the intended recipient. The system also targets harmful attachments, isolating them to ensure they do not reach users, and safeguards against malicious links by identifying and safeguarding them (e.g., blocking, wrapping, checking, etc.) before they can be clicked. If an email is deemed not to be a security threat, it is safely delivered to the intended recipient, ensuring seamless and secure internal communication.

The invention discloses a network security system driven by artificial intelligence. The network security system is designed to detect, analyze and relieve wide network threats in real time. The network security system comprises a data receiving module which is responsible for gathering diversified data types, including images from various sources, text content and URLs (Uniform Resource Locator). The AI analysis module processes the received data using image recognition, optical character recognition, and semantic analysis, and identifies potential threats, such as phishing attacks, fraud, and propagation of malicious content. And a link analysis module evaluates the security of the URL through the dynamic white list and black list, and performs AI-based evaluation on unknown links. The audio interface expands threat detection to audio-based communication, integrates voice-to-text and text-to-voice functions, and enables the system to analyze fraud or malicious intentions that may exist in a telephone call.

Presented are apparatus, systems and methods for more secure online interactions from computing devices, including protections of sensitive identity, personal, employer, membership, financial and payments information; from the increasing waves of hacking, and relentless bombardment of phishing attacks; with ever more sophisticated social-engineering, which are increasingly indistinguishable from interactions with a genuine online connection. In one example, the computing device can store a data structure in a first application, the data structure comprising a set of sensitive-attribute data, and an identification of a plurality of predefined or otherwise known hosts, from a list of known remote hosts. The computing-device / local-host can execute a second application to locally render a remote internet resource, such as a web page, which may additionally request the input of one or more sensitive-attribute data entry fields. Responsive to receiving a uniform resource identifier (URI) (from an eMail, Text, scanned QR code, Hyperlink, Browser App or other), the computing device executes a first application to identify and analyze the URI, generate a plurality of first features comprising an identity of a remote host of the web-site page, compare the identity of the remote host to the identification of the plurality of known remote hosts, execute a heuristic algorithm or machine learning model, on the local host, to generate a source and content risk-score, of the remote host and the web page it conveys. The execution therebefore described can thus aid the computing device to more intelligently decide to: permit, restrict, or modify data generation methods in an auto-population entry of the one or more sensitive-attribute data entry fields, including but not limited to: selecting a payment information generation method for such data fields, based on risk analysis of said uniform resource identifier. This embodiment of the present disclosure can improve the ability of said computing device and said device user to more-immediately and objectively: identify, avoid, or manage; phishing and hacking attacks, versus those from legitimate or reputationally-sound remote hosts.

Techniques are disclosed that relate to detecting and preventing phishing attacks (e.g., man-in-the-middle attacks) related to multi-factor authentication (MFA) or two-factor authentication (2FA) processes. A system is described that determines whether to allow or deny a subsequent authentication step based on a trust level determined between a computing device that made an initial authentication request to a service computer system and a computing device (e.g., a mobile device) that is required to perform the subsequent authentication step (e.g., a 2FA authentication step). The computing device associated with the subsequent authentication step evaluates the trust between the devices and determines whether to allow or deny the subsequent authentication step. The techniques of the present disclosure enhance the security of computer systems against phishing attacks while maintaining a satisfactory user experience for legitimate users.

The present invention relates to a method for detecting a vulnerability to a phishing attack in a computer system, characterized in that it comprises the implementation, by data processing means (11) of a server (1) of said computer system, of the steps of: Obtaining at least a first computer message of a phishing attempt, said first computer message comprising original personalization data; Generation of a second computer message corresponding to the first computer message in which said original personalization data has been anonymized;Generation of a third computer message corresponding to the second computer message in which new personalization data has been introduced for at least one user of said computer system, said target user, based on targeting data of said computer system, stored in data storage means (12) of said server (1); Issuance of said third computer message to said target user so as to simulate a phishing attack; Detection of at least one reaction to said third computer message implemented by said target user in said computer system [Fig. 1];

Techniques are described for providing a threat analysis platform capable of automating actions performed to analyze security-related threats affecting IT environments. Users or applications can submit objects (e.g., URLs, files, etc.) for analysis by the threat analysis platform. Once submitted, the threat analysis platform routes the objects to dedicated engines that can perform static and dynamic analysis processes to determine a likelihood that an object is associated with malicious activity such as phishing attacks, malware, or other types of security threats. The automated actions performed by the threat analysis platform can include, for example, navigating to submitted URLs and recording activity related to accessing the corresponding resource, analyzing files and documents by extracting text and metadata, extracting and emulating execution of embedded macro source code, performing optical character recognition (OCR) and other types of image analysis, submitting objects to third-party security services for analysis, among many other possible actions.

The invention discloses a two-dimensional code phishing detection method and device, relates to the technical field of network security, and mainly aims to reduce the hysteresis of two-dimensional code phishing detection. According to the main technical scheme, the method comprises the following steps: performing feature extraction processing on a data object carrying a two-dimensional code to obtain at least one type of intention feature data related to the intention of the data object; performing intention analysis based on the at least one intention feature data to obtain intention data of the data object, the intention data being related to an induction degree of the data object to induce a user to scan a two-dimensional code; feature extraction processing is carried out on a target object pointed by the two-dimensional code to obtain object feature data of the target object, and the object feature data is related to the malicious degree of the target object; and detecting whether the two-dimensional code is a phishing two-dimensional code for phishing attack based on the intention data and the object feature data.

Presented are apparatus, systems and methods for more secure online interactions from computing devices, including protections of sensitive identity, personal, employer, membership, financial and payments information; from the increasing waves of hacking, and relentless bombardment of phishing attacks; with ever more sophisticated social-engineering, which are increasingly indistinguishable from interactions with a genuine online connection.In one example, the computing device can store a data structure in a first application, the data structure comprising a set of sensitive-attribute data, and an identification of a plurality of predefined or otherwise known hosts, from a list of known remote hosts. The computing-device / local-host can execute a second application to locally render a remote internet resource, such as a web page, which may additionally request the input of one or more sensitive-attribute data entry fields.Responsive to receiving a uniform resource identifier (URI) (from an eMail, Text, scanned QR code, Hyperlink, Browser App or other), the computing device executes a first application to identify and analyze the URI, generate a plurality of first features comprising an identity of a remote host of the web-site page, compare the identity of the remote host to the identification of the plurality of known remote hosts, execute a heuristic algorithm or machine learning model, on the local host, to generate a source and content risk-score, of the remote host and the web page it conveys. The execution therebefore described can thus aid the computing device to more intelligently decide to: permit, restrict, or modify data generation methods in an auto-population entry of the one or more sensitive-attribute data entry fields, including but not limited to: selecting a payment information generation method for such data fields, based on risk analysis of said uniform resource identifier. This embodiment of the present disclosure can improve the ability of said computing device and said device user to more-immediately and objectively: identify, avoid, or manage; phishing and hacking attacks, versus those from legitimate or reputationally-sound remote hosts.

This document describes a system and method for detecting phishing domains used by cyber attackers to conduct phishing attacks in a Domain Name System (DNS) record set, the system including a homograph phishing domain detection module, a typosquatting phishing domain detection module, a general phishing domain detection module, and an alert module. These modules are configured to use a combination of homograph, typosquatting, and general phishing domain techniques to collaboratively detect and identify phishing domains from a DNS record set. Subsequently, the alert module can be used to correlate alerts from the various phishing detection modules to discover phishing activity occurring in DNS network data.

Disclosed herein is a technique for detecting potential phishing attacks by monitoring outbound web traffic from an endpoint, along with inbound electronic mail traffic addressed to a user of the endpoint. With this information, a search can be performed for possible sources in the web traffic of a request for a hyperlink located in the inbound mail traffic, and when no source is located, phishing remediation can be performed, including restrictions on access to the hyperlink at an endpoint operated by the user.