Transformer-Based Phishing URL Detection Under Adversarial Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing URL filtering systems struggle with accurately identifying phishing URLs due to rapidly evolving malicious content, class imbalance, and adversarial attacks, leading to high false positives and negatives, and require real-time detection without significant latency.
Innovation Solution
A transformer-based model, URLTran, uses fine-tuned BERT and RoBERTa models for phishing URL detection, incorporating sub-word tokenization and adversarial training to enhance robustness against homoglyph and compound word attacks, improving performance with joint analysis of URL text and metadata.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If traditional filtering systems use black lists of malicious characteristics, then implementation is simple, but they miss large amounts of newly added malicious content
Solution Approach 1:
The system transforms URL detection from static blacklisting to dynamic machine learning classification by changing the parameters from predefined malicious patterns to learned features from training data, enabling adaptation to new phishing URLs without manual updates
Solution Approach 2:
The patent replaces the mechanical blacklisting approach with a neural network-based machine learning system that automatically learns and adapts to phishing patterns, substituting manual rule-based filtering with automated intelligent detection
2Reliability
If real-time filters are used during browsing, then malicious content can be detected before access, but significant latency is added to browsing experience
Solution Approach 1:
The system performs preliminary training offline to create optimized detection models, then uses these pre-trained models for rapid real-time inference, separating the computationally intensive training phase from the fast detection phase to minimize browsing latency
Solution Approach 2:
The system dynamically adjusts detection thresholds and confidence levels based on the specific URL and context, allowing flexible real-time decision-making that balances detection accuracy with response speed for different browsing scenarios
3Adaptability or versatility
If filtering systems classify content based on constantly changing characteristics, then detection can adapt to new threats, but false positives and false negatives increase
Solution Approach 1:
The system incorporates feedback mechanisms where detection results and user reports are used to continuously retrain and refine the machine learning models, creating a closed-loop system that improves accuracy while adapting to new phishing techniques
Solution Approach 2:
The patent uses multiple diverse features and data sources (URL text, metadata, historical patterns, certificate information) combined in an ensemble machine learning approach, creating a composite detection system that reduces false positives by cross-validating multiple indicators
Data Source
AI summary
The technology described herein can identify phishing URLs using transformers. The technology tokenizes useful features from the subject URL. The useful features can include the text of the URL and other data associated with the URL, such as certificate data for the subject URL, a referrer URL, an IP address, etc. The technology may build a joint Byte Pair Encoding for the features. The token encoding may be processed through a transformer, resulting in a transformer output. The transformer output, which may be described as a token embedding, may be input to a classifier to determine whether the URL is a phishing URL. Additional or improved URL training data may be generated by permuting token order, by simulating a homoglyph attack, and by simulating a compound word attack.