Inline Phishing Detection Using Parallel Multi-Signal Neural Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing phishing detection models are inefficient in detecting zero-day phishing exploits and URL redirects due to lack of breadth in inputs and inefficiency in classifications, leading to rigidity and delayed intervention.
Innovation Solution
A neural network phishing detection model that operates on multiple signals of user-presented content, including JavaScript code, text, URLs, HTTP headers, and DOM trees, using convolutional neural networks (CNNs) that can run in parallel, with an input importance analyzer to determine which inputs are most critical for classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If traditional phishing detection models use a specific subset of input signals, then the model complexity is reduced, but the detection accuracy for zero-day phishing exploits deteriorates
Solution Approach 1:
The patent implements a multi-signal detection model that universally processes multiple input signals including JavaScript code, text content, URLs, HTTP headers, and DOM trees simultaneously. This multi-functional approach enables the single model to detect various types of phishing attacks including zero-day exploits by analyzing complementary information across all signal types rather than relying on a limited subset.
2Ease of operation
If handcrafted features are used in phishing detection models, then the interpretability is improved, but the classification efficiency and model update speed deteriorate
Solution Approach 1:
The patent replaces the mechanical process of handcrafting features with an automated neural network-based feature extraction system. The model automatically learns relevant features from raw multi-signal inputs through deep learning, eliminating the manual feature engineering process while maintaining interpretability through attention mechanisms that highlight which features contribute most to detections.
3Reliability
If comprehensive multi-signal inputs are processed, then the detection capability for zero-day exploits is improved, but the processing latency increases
Solution Approach 1:
The patent segments the processing of multiple input signals into parallel independent streams, where each signal type (JavaScript, text, URLs, headers, DOM trees) is processed separately through dedicated neural network components. This segmentation allows simultaneous processing without sequential bottlenecks, reducing overall latency while maintaining comprehensive analysis capability for zero-day exploit detection.
4Adaptability or versatility
If the detection model is updated frequently, then the adaptability to new phishing techniques is improved, but the computational overhead and resource consumption increase
Solution Approach 1:
The patent implements preliminary action through continuous background training and incremental learning mechanisms that prepare the model for new phishing techniques without requiring full retraining. The system pre-loads training data and performs offline model updates, so when new phishing methods emerge, the model can quickly adapt using pre-computed features and previously learned patterns, reducing real-time computational overhead.
Data Source
AI summary
An inline and offline machine learning pipeline for detection of phishing attacks with a holistic, easily upgradeable framework is presented herein. A packet analyzer records capture logs of network traffic between an endpoint device and a firewall. A parser extracts inputs from the capture logs inline that it communicates to one of an inline model and an offline model for phishing detection. The inline model and offline model are neural networks with parallelizable network architectures that do not depend on handcrafted inputs. The inline model operates inline with the packet analyzer and parser and makes fast phishing attack classifications based on inputs generated from capture logs. The offline model uses additional inputs such as inputs generated from network logs to make phishing attack classifications.