Back to results
US 11,240,266 B1Granted
System, device and method for detecting social engineering attacks in digital communications
AssigneeSocial Safeguard, Inc.
InventorsOtavio R. Freire, Ruben Jimenez
Life of this patent
Estimating the term…
Abstract
Embodiments of the present disclosure use natural language processing, machine learning and relevant corpora to detect social engineering attacks with a high degree of accuracy. In various embodiments, lexical features, spelling features and topical features are automatically analyzed from a source text and a model is employed to assess the likelihood that the source message is a social engineering attack.
Claims21
A computer-implemented method, comprising:
- receiving, by a host, a source message;
- extracting, by the host, an initial attribute from the source message to present a pre-processed version of the source message;
- determining, by the host, whether the extracted initial attribute comprises a special feature so as to generate a lexical feature vector;
- detecting, by the host, a language of the source message or the pre-processed version of the source message;
- based on the detected language, tokenizing, by the host, the pre-processed version of the source message to generate a cleaned token list comprising a plurality of tokens;
- extracting, by the host, a number of misspelled words from the cleaned token list to generate a spelling feature vector;
- based on determining whether the cleaned token list includes one or more suspicious topics, generating, by the host, a topics vector and a correlation score for each token of the plurality of tokens in the cleaned token list;
- based on the lexical feature vector, the spelling vector and the topics vector, applying, by the host, a model to predict a risk score for the source message;
- and
- upon the risk score exceeding a risk threshold, classifying the source message as a social engineering attack.
7 more elements
A system for detecting a social engineering attack, comprising:
- a processor;
- and
- a memory device storing a plurality of instructions which, when executed by the processor, cause the processor to:
- receive a source message;
- extract an initial attribute from the source message to present a pre-processed version of the source message;
- determine whether the extracted initial attribute comprises a special feature so as to generate a lexical feature vector;
- detect a language of the source message or the pre-processed version of the source message;
- based on the detected language, tokenize the pre-processed version of the source message to generate a cleaned token list comprising a plurality of tokens;
- extract a number of misspelled words from the cleaned token list to generate a spelling feature vector;
- based on determining whether the cleaned token list includes a suspicious topic, generate a topics vector and a correlation score for each token of the plurality of tokens in the cleaned token list;
- based on the lexical feature vector, the spelling vector and the topics vector, apply a model to predict a risk score for the source message;
- and
- upon the risk score exceeding a risk threshold, classify the source message as a social engineering attack.
10 more elements
A system for detecting a social engineering attack, comprising:
- a processor;
- and
- a memory device storing a plurality of instructions which, when executed by the processor, cause the processor to:
- receive a source message from a computing device;
- extract initial attributes from the source message;
- prepare a cleaned token list comprising a plurality of tokens based upon the source message;
- extract a lexical feature, a spelling feature and a topic feature from the cleaned token list;
- based on the lexical feature, the spelling feature and the topic feature, apply a model to predict a risk score for the source message;
- and
- upon the risk score exceeding a risk threshold, classifying the source message as the social engineering attack.
7 more elements
A system for detecting a social engineering attack,
- comprising:
- a processor;
- and
- a memory device storing a plurality of instructions which, when executed by the processor, cause the processor to:
- receive a source message from a computing device;
- detect a language of the source message;
- apply a language specific processor to the source message to identify a potential social engineering attack:
- apply a model to predict a risk score for the source message based on the identified potential social engineering attack:
- and
- upon the risk score exceeding a risk threshold, classifying the source message as the social engineering attack.
7 more elements
Dependencies are inferred from the claim text.