Systems and methods using computer vision and machine learning for detection of malicious actions

A method for detecting or classifying malicious activities, comprising:

• receiving request information related to a request for a user's credentialing information;
• obtaining one or more screenshots associated with the request;
• providing the one or more screenshots and the request information to a classifier including a machine learning model;
• using the machine learning model, computing or extracting one or more features from the request information, including domain reputation, IP analysis, keywords in an email, a domain registration age, a domain registrar, a domain's SSL certificate details, or combinations thereof;
• generating with the machine learning model a probability or confidence level that the request is malicious based at least in part on identified screenshot information from the one or more screenshots and the one or more features extracted from the request information;
• if the probability or confidence level that the request is malicious exceeds a prescribed threshold, determine, based on the probability and on a series of automated analytics, an adjustment to the probability thereby defining an adjusted probability;
• and
• if the adjusted probability that the request is malicious exceeds the prescribed threshold:
• classifying the request and/or an actor associated with the request as malicious,
• generating an alert, notification, or alarm and/or blocking further communication with the request and/or the actor associated therewith, and
• generating or compiling a blacklist of known malicious requests based on output of the machine learning model.

A non-transitory computer-readable medium including instructions for detecting or classifying malicious activities, which instructions, when executed by one or more processors, cause the one or more processors to perform a method comprising:

• receiving request information related to a request for a user's credentialing information;
• comparing the request information to information or data in a blacklist and/or a whitelist to determine whether the request is a known malicious or known safe request;
• if the request is not determined to be a known malicious or known safe request, obtaining one or more screenshots associated with the request, wherein the screenshot comprises an image of a web page obtained using a web automation framework configured to securely navigate to the webpage and obtain the screenshot of the webpage in isolation of a system or network of the user;
• providing the one or more screenshots and the request information to a classifier including a machine learning model;
• computing or extracting one or more features from the information related to the request, including domain reputation, IP analysis, keywords in an email, a domain registration age, a domain registrar, a domain's SSL certificate details, or combinations thereof, to determine whether the request is a known safe or known malicious request;
• generating with the machine learning model a probability or confidence level that the request is malicious based at least in part on identified screenshot information from the one or more screenshots and the request information;
• and
• if the probability or confidence level that the request is malicious exceeds a prescribed threshold:
• determine, based on the probability and on a series of automated analytics, an adjustment to the probability thereby defining an adjusted probability,
• if the adjusted probability that the request is malicious exceeds the prescribed threshold, classifying the request and/or an actor associated with the request as malicious, and
• generating an alert, notification, or alarm and/or blocking further communication with the request and/or the actor associated therewith.