International Business Machines Corporation

Crowdstrike, Inc.

Qian Cui

Iosif Viorel Onut

Guy-Vincent Jourdan

Aviv Ron

Gregor Von Bochmann

Russell L Couturier

Avishay Bartik

Mechanisms are provided to detect content generated from phishing attacks. The mechanisms process an electronic communication, received from a data network, to produce a structure token. The structure token represents a content structure of the electronic communication. The structure token is processed by a machine learning model, which is trained to identify content that is generated in response to one or more phishing attacks. The machine learning model produces a classification output that indicates whether the electronic communication includes content that was generated in response to the one or more phishing attacks.

Detection of content generated from phishing attacks

Mechanisms are provided to detect phishing exfiltration communications. The mechanisms receive an input electronic communication from a data network and process the input electronic communication to extract a structure token that represents the content structure of the input electronic communication. The structure token is input to a machine learning model that is trained to identify phishing exfiltration communication grammars, and relationships between phishing exfiltration communication grammars, in structure tokens. The machine learning model processes the structure token to generate a vector output indicating computed values for processing by classification logic. The classification logic processes the vector output from the machine learning model to classify the input electronic communication as either a phishing exfiltration communication or a non-phishing exfiltration communication, and outputs a corresponding classification output.

Detection of phishing campaigns based on deep learning network detection of phishing exfiltration communications

Embodiments provide a computer implemented method for detecting a phishing internet link, wherein an internet link is a Uniform Resource Locator (URL) or a domain name, the method including: receiving the internet link; replacing one or more visually confusing characters with one or more original characters, wherein the one or more visually confusing characters are similar to the one or more original characters; removing a top-level domain from the internet link; removing a common subdomain from the internet link; splitting the remaining internet link into a list of words; converting the list of words into a list of word vectors; calculating an average word vector of the list of word vectors; and providing a phishing score for the average vector, indicating a probability of the internet link being a phishing internet link.

Detection of phishing internet link

An example operation may include one or more of identifying a page of a website for phishing testing, attempting each of a Hypertext Transfer Protocol (HTTP) GET request and a HTTP Secure (HTTPS) GET request via the identified page of the website, attempting each of a HTTP POST request and a HTTPS POST request via the identified page of the website, determining if the website is a phishing website based on server responses to the attempted HTTP and HTTPS GET requests and the attempted HTTP and HTTPS POST requests received from the website, and in response to determining the website is a phishing website, outputting an indication of the determination for display on a display device.

Growing community of inventors

Ottawa, Canada

Qian Cui