Phishing Site Detection via ML Triage and Human Grading
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for preventing phishing are overwhelmed by the sheer volume of reports, as hundreds of millions of users submit complaints resulting in tens of thousands of reports daily, and phishing sites often operate for only a few hours before changing or shutting down, making quick and efficient blocking challenging.
Innovation Solution
A predictive model using machine learning is developed to determine the likelihood of a site being a phishing site by aggregating data from multiple sources, including email and internet access services, and applying it to generate reports that can block access or warn users, thereby assisting human graders in prioritizing evaluations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If human graders manually evaluate phishing reports, then accuracy and reliability of phishing site identification is improved, but productivity decreases due to overwhelming volume of reports
Solution Approach 1:
The system segments the report evaluation process into two stages: automated machine learning triage to filter and prioritize reports, and manual human grading for final verification. This segmentation allows human graders to focus only on the most suspicious reports while automated systems handle the bulk processing, resolving the contradiction between accuracy and productivity.
Solution Approach 2:
A machine learning-based automated system serves as an intermediary between user report submission and human grader evaluation. This intermediary layer processes the overwhelming volume of reports, applies predictive models to identify likely phishing sites, and presents prioritized candidates to human graders, thereby maintaining both high accuracy and productivity.
2Measurement precision
If manual grading of phishing sites is performed, then measurement precision of phishing site characteristics is improved, but loss of time increases due to slow processing speed
Solution Approach 1:
The system performs preliminary automated analysis using machine learning models to pre-identify and prioritize likely phishing sites before human graders review them. This preliminary action filters out clearly legitimate sites and organizes suspicious reports by risk level, enabling human graders to work more efficiently and reduce the time delay in blocking phishing sites while maintaining measurement precision.
Solution Approach 2:
The automated machine learning system performs self-service by independently analyzing report characteristics, extracting features, and generating preliminary classifications without human intervention. This self-service capability handles the time-sensitive initial assessment, while human graders provide the precision verification only when needed, resolving the contradiction between speed and precision.
3Productivity
If automated systems process phishing reports, then productivity increases, but reliability decreases due to potential false positives and false negatives
Solution Approach 1:
The system implements feedback loops where human grader evaluations are used to train and refine the machine learning models. Verified phishing sites and false positives from manual grading feed back into the training data, continuously improving the automated system's accuracy. This feedback mechanism allows the system to maintain high productivity through automation while improving reliability over time through learned corrections.
Solution Approach 2:
The machine learning system dynamically adjusts its classification parameters and decision thresholds based on incoming report patterns and training data. By adapting its internal parameters to reflect evolving phishing tactics and user behavior patterns, the system maintains high productivity through automated processing while improving reliability through continuous parameter optimization based on feedback from human graders.
Data Source
AI summary
Described is a technology by which phishing-related data sources are processed into aggregated data and a given site evaluated the aggregated data using a predictive model to automatically determine whether the given site is likely to be a phishing site. The predictive model may be built using machine learning based on training data, e.g., including known phishing sites and/or known non-phishing sites. To determine whether an object corresponding to a site is likely a phishing-related object are described, various criteria are evaluated, including one or more features of the object when evaluated. The determination is output in some way, e.g., made available to a reputation service, used to block access to a site or warn a user before allowing access, and/or used to assist a hand grader in being more efficient in evaluating sites.