Phishing detection enhanced through machine learning techniques

A non-transitory computer-readable storage medium comprising instructions that, when executed by a processing device, cause the processing device to:

• identify a set of phishing threat actors, wherein each actor of the phishing threat actors is identified by identifying uniform resource locations (URLs) with certain path patterns on certain compromised domains;
• determine an effectiveness rate of each actor of the set of phishing threat actors, wherein the effectiveness rate is a percentage of URLs produced by the actor that avoid detection as phishing threats by a phishing detection system;
• select effective URLs from at least one effective phishing threat actor of the set of actors,
• wherein the effective URLs are URLs that avoid detection as phishing threats by the phishing detection system, and
• wherein the at least one effective phishing threat actor has an effectiveness rate exceeding a selected threshold;
• generate, using a machine learning process, a phishing system using a long short-term memory (LSTM) network to identify patterns in the selected effective URLs that enable the selected effective URLs to avoid detection as phishing threats by the phishing detection system;
• generate, by the machine learning process, a set of first artificial intelligence (AI) functions comprising a set of neurons that connect the machine learning process to a second machine learning process;
• and
• generate, by the second machine learning process, a second AI function that classifies the effective URLs, wherein the second AI function is a sigmoid neuron;
• generate synthetic phishing URLs using the generated phishing system and the identified patterns;
• and
• train the phishing detection system according to the synthetic phishing URLs such that the phishing detection system is enhanced by the generated phishing system.

A computer system, comprising:

• a processing device;
• and
• memory in communication with the processing device and storing instructions that, when executed by the processing device, cause the processing device to:
• generate, by a first machine learning process, a set of first artificial intelligence (AI) functions comprising a set of neurons that connect the machine learning process to a second machine learning process;
• and
• generate, by the second machine learning process, a second AI function that classifies effective URLs, wherein the second AI function is a sigmoid neuron;
• generate synthetic phishing uniform resource locations (URLs) based on the effective phishing URLs, by:
• defining a seed sentence using identified patterns in the effective URLs that enable the effective URLs to avoid detection as phishing threats by a phishing detection system, wherein the patterns are identified by the machine learning process using a long short-term memory (LSTM) network;
• predicting and adding a next character iteratively to the seed sentence according to the effective URLs;
• producing a list of pseudo URLs from the sentence;
• and
• for each pseudo URL, combining a synthetic path of the pseudo URL with a domain compromised by the at least one effective phishing threat actor to produce a synthetic URL;
• and
• train the computer system according to the synthetic phishing URLs such that the computer system is enhanced by the training in that it can produce synthetic phishing URLs with increased effectiveness at avoiding detection as phishing threats by the phishing detection system.