# US 10,313,352 B2 · Phishing detection with machine learning > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,352 B2 - Document ID: US10313352B2 - Status: Granted - Kind: B2 - Application number: 15/334,766 - Filed: 2016-10-26 - Published: 2018-04-26 - Granted: 2019-06-04 - Earliest claimed: 2016-10-26 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Jeff H. C. Kuo; Chien Pang Lee; John K. C. Lee - Web page: https://patentgrep.com/patent/US10313352B2 ## CPC - H04L 63/101: {Access control lists [ACL]} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method for identifying a phishing website is disclosed. Content associated with a website that a user is attempting to access is retrieved and translated into a format that a classifier can process. The classifier is trained to identify phishing attempts for a particular website or family of websites. The classifier processes the website to determine if the website is a phishing website. A scorer can determine the likelihood that the classifier classified the website correctly. If the website is determined to be a phishing website a protection component can deny access to the website. Otherwise the user can be permitted to access the website. ## Claims ### Claim 1 A system comprising: a processor; a memory; a classifier configured to classify a website as a target website or not according to a set of rules, the classifier trained against a set of training data, wherein the set of training data is specific to a single owner; a scorer configured to generate a score indicative of a likelihood that the classifier has correctly identified the website as either a phishing website or not a phishing website, wherein the score is determined by calculating a difference between a value required to classify a particular result from the classifier and an associated value output from the classifier; and a protection component configured to grant or deny access to the website based upon the generated score from the scorer. ### Claim 2 (depends on 1) The system of claim 1 further comprising: a whitelist, the whitelist including a plurality of websites known to belong to the single owner. ### Claim 3 (depends on 2) The system of claim 2 wherein the whitelist includes lexical features associated with the single owner. ### Claim 4 (depends on 2) The system of claim 2 wherein the whitelist includes logos associated with the single owner. ### Claim 5 (depends on 1) The system of claim 1 wherein the classifier is a support vector machine. ### Claim 6 (depends on 1) The system of claim 1 wherein the classifier is configured to preprocess the website prior to classifying the website. ### Claim 7 (depends on 6) The system of claim 6 wherein the classifier is configured to determine if an address associated with the website is in a whitelist of addresses and is further configured to process the website when the address is not found in the whitelist. ### Claim 8 A method comprising: retrieving content associated with a website: translating the content into a format for a classifier to process; processing the content through the classifier to determine if the website is a phishing website; generating a score indicative of a likelihood that the classifier has correctly identified the website as either a phishing website or not a phishing website, wherein the score is determined by calculating a difference between a value required to classify a particular result from the classifier and an associated value output from the classifier; granting, based on the score, access to the website when the website is determined not to be a phishing website; and blocking, based on the score access to the website when the website is determined to be a phishing website. ### Claim 9 (depends on 8) The method of claim 8 further comprising: training the classifier to identify phishing websites for only a single organization. ### Claim 10 (depends on 8) The method of claim 8 wherein translating further comprises: performing a pre-analysis on the website; extracting features from the website; and translating the extracted features into the format for the classifier. ### Claim 11 (depends on 10) The method of claim 10 wherein extracting features extracts lexical features from the website. ### Claim 12 (depends on 10) The method of claim 10 wherein performing a pre-analysis compares an address associated with the website to a whitelist of addresses associated with a single organization. ### Claim 13 (depends on 12) The method of claim 12 wherein when the address is found in the whitelist, granting access to the website without processing the content through the classifier. ### Claim 14 A computer program product stored on a computer readable storage device having computer executable instructions that when executed cause at least one processor to: retrieve content associated with a website: translate the content into a format for a classifier to process; process the content through the classifier to determine if the website is a phishing website; generate a score indicative of a likelihood that the classifier has correctly identified the website as either a phishing website or not a phishing website, wherein the score is determined by calculating a difference between a value required to classify a particular result from the classifier and an associated value output from the classifier; grant, based on the score, access to the website when the website is determined not to be a phishing website; and block, based on the score, access to the website when the website is determined to be a phishing website. ### Claim 15 (depends on 14) The computer program product of claim 14 further comprising instructions to: train the classifier to identify phishing websites for only a single organization. ### Claim 16 (depends on 14) The computer program product of claim 14 wherein translating further comprises instructions to: perform a pre-analysis on the website; extract features from the website; and translate the extracted features into the format for the classifier. ### Claim 17 (depends on 16) The computer program product of claim 16 wherein extracting features extracts lexical features from the website. ### Claim 18 (depends on 16) The computer program product of claim 16 wherein performing a pre-analysis compares an address associated with the website to a whitelist of addresses associated with a single organization. ### Claim 19 (depends on 18) The computer program product of claim 18 wherein when the address is found in the whitelist, granting access to the website without processing the content through the classifier.