Machine learning-based sensitive resource collection agent detection

Abstract

Obtaining one or more metrics associated with a network location. Determining, based on the one or more metrics and one or more prefatory check conditions, a prefatory status of the network location, the prefatory status indicating a benign status, malicious status, or a suspicious status. If the prefatory status of the network location indicates the benign status or the malicious status, providing a notification of the prefatory status in response to the prefatory status being determined. If the prefatory status of the network location indicates a suspicious status, obtaining a document object model of the network location. Obtaining a screenshot of an entire page of content at the network location. Generating a null hypothesis based on the document object model, the null hypothesis including a potential brand list, the potential brand list including one or more potential brands. Obtaining a set of reference images for each of the one or more potential brands of the potential brand list. Extracting one or more globally invariant visual features from the screenshot of the entire page of the content. Generating, based on a machine learning model using the one or more globally invariant visual features, an alternate hypothesis, the alternate hypothesis indicating a list of potentially malicious content brands. Determining, based on the null hypothesis and the alternate hypothesis and the machine learning model, a classification result. Performing one or more responsive actions in response to determining the classification result.