Machine learning-based system for detecting phishing websites using the URLS, word encodings and images of content pages

A computer-implemented method of classifying a URL and a content page accessed via the URL as phishing or not phishing, including:

• applying a URL feature hasher, extracting features from the URL and hashing the features to produce URL feature hashes;
• applying a natural language encoder, pretrained on natural language, that produces a word encoding of words parsed from a rendering of the content page;
• applying an image embedder, pretrained on images, that produces an image embedding of an image captured from at least part of the rendering;
• and
• applying phishing classifier layers
• trained on concatenations of the URL feature hashes, the word encoding, and the image embedding for example URLs accompanied by ground truth classifications as phishing or as not phishing, and
• processing a concatenated input of the URL feature hashes, the word encoding, and the image embedding to produce at least one score that the URL and the content accessed via the URL presents a phishing risk.

A non-transitory computer readable storage medium impressed with computer program instructions for classifying a URL and a content page accessed via the URL as phishing or not phishing, the instructions, when executed on a processor, implement a method comprising:

• applying a URL feature hasher, extracting features from the URL and hashing the features to produce URL feature hashes;
• applying a natural language encoder, pretrained on natural language, that produces a word encoding of words parsed from a rendering of the content page;
• applying an image embedder, pretrained on images, that produces an image embedding of an image captured from at least part of the rendering;
• and
• applying phishing classifier layers
• trained on concatenations of the URL feature hashes, the word encoding, and the image embedding for example URLs accompanied by ground truth classifications as phishing or as not phishing, and
• processing a concatenated input of the URL feature hashes, the word encoding, and the image embedding to produce at least one score that the URL and the content accessed via the URL presents a phishing risk.

A computer-implemented method of training phishing classifier layers to classify a URL and a content page accessed via the URL as phishing or not phishing, including:

• receiving and processing for example URLs,
• a concatenated input of URL feature hashes, a word encoding of words extracted from the content page, and an image embedding of an image captured from rendering of the content page,
• to produce at least one score that each example URL and the content page accessed via the URL presents a phishing risk;
• calculating a difference between the score for each example URL and each corresponding ground truth that the example URL and the content page are phishing or not phishing;
• using differences for the example URLs to train coefficients of the phishing classifier layers;
• and
• saving the trained coefficients for use classifying a production URL and a content page accessed via the production URL as phishing or not phishing.