System and method for identifying phishing cyber-attacks through deep machine learning via a convolutional neural network (CNN) engine

A non-transitory computer-readable medium comprising code which, when executed by a processor, cause the processor to:

• collect a dataset with images associated with a set of uniform resource locators;
• produce a set of image clusters based on a content-based image retrieval process and the dataset, each image cluster from the set of image clusters including a subset of the images grouped together based on similarities of at least one feature included in the subset of the images;
• train a first convolutional neural network with a training set that includes at least one image cluster associated with a phishing cyber-attack and at least one image cluster associated with trusted sources, the at least one image cluster associated with the phishing cyber-attack and the at least one image cluster associated with the trusted sources selected from the set of image clusters;
• extract, via the first convolutional neural network, a set of features associated with the phishing cyber-attack;
• and
• train a second convolutional neural network based on the set of features associated with the phishing cyber-attack such that the second convolutional neural network is configured to predict when an image associated with a uniform resource locator not included in the training set is associated with the phishing cyber-attack.

A non-transitory computer-readable medium comprising code which, when executed by a processor, cause the processor to:

• train a first convolutional neural network with a first dataset including a set of images that are not associated with a phishing cyber-attack;
• remove a processing layer from the first convolutional neural network when the first convolutional neural network reaches a predetermined accuracy level;
• extract, via the first convolutional neural network, a set of features from a second dataset including a set of image clusters associated with the phishing cyber-attack;
• train, based on the extracted set of features, a second convolutional neural network to predict whether a received image is associated with the phishing cyber-attack;
• and
• produce a notification signal indicative of the phishing cyber-attack when the second convolutional neural network predicts that the received image is associated with the phishing cyber-attack.

A method, comprising:

• receiving an input with a uniform resource locator;
• producing an image of a webpage based on the uniform resource locator;
• determining a first correlation between the uniform resource locator and a phishing cyber-attack based on the image of the webpage and an output of a first convolutional neural network;
• determining a second correlation between the uniform resource locator and the phishing cyber-attack based on (1) an image of at least one of a logo, a logotype, or a logomark, and (2) the output of a second convolutional neural network when the first correlation does not indicate a positive correlation between the uniform resource locator and the phishing cyber-attack, the at least one of the logo, the logotype, or the logomark extracted from the image of the webpage;
• and
• producing a notification indicative of the phishing cyber-attack when at least one of the first correlation and the second correlation indicates a positive correlation between the uniform resource locator and the phishing cyber-attack.

A method, comprising:

• receiving a dataset with images associated with a set of uniform resource locators;
• generating a set of image clusters based on a content-based image retrieval process and the dataset, each image cluster from the set of image clusters including a subset of the images grouped together based on similarities of at least one feature included in the subset of the images;
• train a first convolutional neural network with a training set that includes at least one image cluster associated with a phishing cyber-attack and at least one image cluster associated with trusted sources, the at least one image cluster associated with the phishing cyber-attack and the at least one image cluster associated with the trusted sources selected from the set of image clusters;
• extract, via the first convolutional neural network, a set of features associated with the phishing cyber-attack;
• and
• train a second convolutional neural network based on the set of features associated with the phishing cyber-attack such that the second convolutional neural network is configured to predict when an image associated with a uniform resource locator not included in the training set is associated with the phishing cyber-attack.