HTML Graph Phishing Detection Using MPNN and BERT

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Phishing attacks have become increasingly sophisticated, mimicking legitimate websites to deceive users and bypass security measures, posing a significant challenge in detecting fraudulent sites in real-time.

Innovation Solution

A Message Passing Neural Network (MPNN) architecture is employed to analyze the HTML structure of websites, converting DOM trees into directed graphs and using BERT encoding for natural language processing to identify anomalous features, enabling real-time phishing detection and mitigation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If traditional phishing detection methods are used, then implementation simplicity is maintained, but detection accuracy deteriorates due to sophisticated phishing attacks

Engineering Contradiction:

Improvephishing detection accuracyVSAvoiddetection system complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The patent replaces traditional mechanical/Rule-based phishing detection systems with a neural network-based AI system. The neural network processes HTML DOM trees and graph representations to detect phishing patterns, substituting conventional rule-matching mechanisms with learned representations that can handle sophisticated phishing attacks.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent transforms the detection approach by changing the parameter representation from simple HTML parsing to graph neural network feature extraction. The system converts HTML DOM trees into graph structures with multiple feature dimensions (textual, structural, contextual) that are processed through neural network layers to produce detection predictions.

Inventive Principle:

Principle #35Parameter changes

2Speed

If real-time detection is implemented, then response speed is improved, but computational resources are consumed

Engineering Contradiction:

Improvedetection speedVSAvoidcomputational resource consumption

Core Design Contradiction:

SpeedVSUse of energy by moving object

Solution Approach 1:

The patent segments the HTML document into a directed graph structure where nodes represent HTML elements and edges represent relationships. This segmentation allows the neural network to process only the structural relationships and key features rather than the entire HTML content, reducing computational load while maintaining real-time detection capability.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent extracts essential features from the HTML DOM tree and converts them into graph representations that capture phishing characteristics. By extracting only the relevant structural and contextual information into graph form, the system reduces the amount of data that needs to be processed while maintaining detection accuracy.

Inventive Principle:

Principle #2Taking out (Extraction)

3Measurement precision

If HTML structure analysis is performed, then detection accuracy is improved, but processing time increases

Engineering Contradiction:

Improvedetection accuracyVSAvoidprocessing time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent performs preliminary conversion of the HTML DOM tree into a directed graph representation before neural network processing. This pre-processing step organizes the HTML structure into a format that is more efficient for neural network consumption, enabling faster processing while maintaining comprehensive structural analysis for accurate detection.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS20260075090A1Real-time detection of site phishing using Message Passing Neural Networks (MPNN) on directed graphs

Publication Date: 2026.03.12 AKAMAI TECHNOLOGIES INC

AI summary

Website phishing detection is enabled using a Message Passing Neural Network (MPNN) that scores requested HTML with a likelihood of being a phishing website. The technique leverages the assumption that the HTML in a phishing website often presents anomalous structure or features when compared with an analogous benign website. Once a phishing site is detected, a given mitigation action is then taken.