# US 11,444,978 B1 · Machine learning-based system for detecting phishing websites using the URLS, word encodings and images of content pages

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,444,978 B1
- Document ID: US11444978B1
- Status: Granted
- Kind: B1
- Application number: 17/475,236
- Filed: 2021-09-14
- Granted: 2022-09-13
- Earliest claimed: 2021-09-14
- Assignees: Netskope, Inc.
- Applicants: Netskope, Inc.
- Inventors: Yihua Liao; Ari Azarafrooz; Najmeh Miramirkhani; Zhi Xu
- Web page: https://patentgrep.com/patent/US11444978B1

## CPC

- G06F 21/552: {involving long-term monitoring or reporting}
- H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)}
- G06F 40/126: Character encoding
- G06F 40/205: Parsing
- G06F 40/279: Recognition of textual entities
- G06F 40/30: Semantic analysis
- G06N 3/045: Combinations of networks
- G06N 3/0455: Auto-encoder networks; Encoder-decoder networks
- G06N 3/0464: Convolutional networks [CNN, ConvNet]
- G06N 3/047: Probabilistic or stochastic networks
- G06N 3/0475: Generative networks
- G06N 3/084: Backpropagation, e.g. using gradient descent
- G06N 3/088: Non-supervised learning, e.g. competitive learning
- G06N 3/0895: Weakly supervised learning, e.g. semi-supervised or self-supervised learning
- G06N 3/09: Supervised learning
- G06N 3/096: Transfer learning
- G06N 3/0985: Hyperparameter optimisation; Meta-learning; Learning-to-learn
- G06T 1/0021: {Image watermarking}
- H04L 63/0281: {Proxies}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06F 40/216: using statistical methods
- G06F 40/284: Lexical analysis, e.g. tokenisation or collocates
- G06N 3/0442: characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU]
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06T: IMAGE DATA PROCESSING OR GENERATION, IN GENERAL

## Abstract

Disclosed is classifying a URL and a page accessed via the URL as phishing or not. URL embedder extracts characters in a predetermined set from the URL to produce a character string trained using ground truth classification of the URL, producing a URL embedding. HTML parser accesses content at the URL and extracts HTML tokens from the page. Further, HTML encoder, trained on HTML tokens extracted from pages at example URLs, each example URL accompanied by a ground truth image captured from the page accessed via the example URL, produces an HTML encoding of the extracted tokens. Also, phishing classifier layers, trained on the URL embedding and the HTML encoding of example URLs, processes a concatenated input of the URL embedding and the HTML encoding to produce a score of a phishing risk.

## Claims

### Claim 1

A phishing classifier that classifies a URL and a content page accessed via the URL as phishing or not phishing, including:
a URL feature hasher that parses the URL into features and hashes the features to produce URL feature hashes;
a headless browser configured to
access a content page at the URL and internally render the content page;
extract words from the rendering of the content page; and
capture an image of at least part of the rendering of the content page;
a natural language encoder, pretrained on natural language, that produces a word encoding of the words extracted from the content page;
an image embedder, pretrained on images, that produces an image embedding of the image captured from the content page; and
phishing classifier layers that process a concatenated input of the URL feature hashes, the word encoding, and the image embedding of the URL to produce at least one score that the URL and the content accessed via the URL presents a phishing risk;
wherein the phishing classifier layers are trained on the URL feature hashes, the word encoding, and the image embedding of example URLs, each example URL accompanied by a ground truth classification as phishing or as not phishing.

### Claim 2 (depends on 1)

The phishing classifier of claim 1, wherein the natural language encoder is one of Bidirectional Encoder Representations from Transformers (abbreviated BERT) and Universal Sentence Encoder.

### Claim 3 (depends on 1)

The phishing classifier of claim 1, wherein the image embedder is one of residual neural network (abbreviated ResNet), Inception-v3 and VGG-16.

### Claim 4

A computer-implemented method of classifying a URL and a content page accessed via the URL as phishing or not phishing, including:
applying a URL feature hasher, extracting features from the URL and hashing the features to produce URL feature hashes;
applying a natural language encoder, pretrained on natural language, that produces a word encoding of words parsed from a rendering of the content page;
applying an image embedder, pretrained on images, that produces an image embedding of an image captured from at least part of the rendering; and
applying phishing classifier layers
trained on concatenations of the URL feature hashes, the word encoding, and the image embedding for example URLs accompanied by ground truth classifications as phishing or as not phishing, and
processing a concatenated input of the URL feature hashes, the word encoding, and the image embedding to produce at least one score that the URL and the content accessed via the URL presents a phishing risk.

### Claim 5 (depends on 4)

The computer-implemented method of claim 4, further including:
applying a headless browser,
accessing the content page via the URL and internally rendering the content page;
parsing words from the rendered the content page; and
capturing an image of at least part of the rendered content page.

### Claim 6 (depends on 4)

The computer-implemented method of claim 4, wherein the natural language encoder is one of Bidirectional Encoder Representations from Transformers (abbreviated BERT) and Universal Sentence Encoder.

### Claim 7 (depends on 4)

The computer-implemented method of claim 4, wherein the image embedder is one of residual neural network (abbreviated ResNet), Inception-v3 and VGG-16.

### Claim 8

A non-transitory computer readable storage medium impressed with computer program instructions for classifying a URL and a content page accessed via the URL as phishing or not phishing, the instructions, when executed on a processor, implement a method comprising:
applying a URL feature hasher, extracting features from the URL and hashing the features to produce URL feature hashes;
applying a natural language encoder, pretrained on natural language, that produces a word encoding of words parsed from a rendering of the content page;
applying an image embedder, pretrained on images, that produces an image embedding of an image captured from at least part of the rendering; and
applying phishing classifier layers
trained on concatenations of the URL feature hashes, the word encoding, and the image embedding for example URLs accompanied by ground truth classifications as phishing or as not phishing, and
processing a concatenated input of the URL feature hashes, the word encoding, and the image embedding to produce at least one score that the URL and the content accessed via the URL presents a phishing risk.

### Claim 9 (depends on 8)

The non-transitory computer readable storage medium of claim 8, further including:
applying a headless browser,
accessing the content page via the URL and internally rendering the content page;
parsing words from the rendered the content page; and
capturing an image of at least part of the rendered content page.

### Claim 10 (depends on 8)

The non-transitory computer readable storage medium of claim 8, wherein the natural language encoder is one of Bidirectional Encoder Representations from Transformers (abbreviated BERT) and Universal Sentence Encoder.

### Claim 11 (depends on 8)

The non-transitory computer readable storage medium of claim 8, wherein the image embedder is one of residual neural network (abbreviated ResNet), Inception-v3 and VGG-16.

### Claim 12

A computer-implemented method of training phishing classifier layers to classify a URL and a content page accessed via the URL as phishing or not phishing, including:
receiving and processing for example URLs,
a concatenated input of URL feature hashes, a word encoding of words extracted from the content page, and an image embedding of an image captured from rendering of the content page,
to produce at least one score that each example URL and the content page accessed via the URL presents a phishing risk;
calculating a difference between the score for each example URL and each corresponding ground truth that the example URL and the content page are phishing or not phishing;
using differences for the example URLs to train coefficients of the phishing classifier layers; and
saving the trained coefficients for use classifying a production URL and a content page accessed via the production URL as phishing or not phishing.

### Claim 13 (depends on 12)

The computer-implemented method of claim 12, further including not backpropagating the differences beyond the phishing classifier layers to encoding layers used to produce the word encoding.

### Claim 14 (depends on 12)

The computer-implemented method of claim 12, further including not backpropagating the differences beyond the phishing classifier layers to embedding layers used to produce the image embedding.

### Claim 15 (depends on 12)

The computer-implemented method of claim 12, further including producing the URL feature hashes for each of the example URLs, producing the word encoding of words extracted from a rendering of the content page, and producing the image embedding of the image captured from the rendering.

### Claim 16 (depends on 15)

The computer-implemented method of claim 15, further including producing the word encoding using a Bidirectional Encoder Representations from Transformers (abbreviated BERT) encoder or a variation on a BERT encoder.

### Claim 17 (depends on 15)

The computer-implemented method of claim 15, further including producing the image embedding using one of a residual neural network (abbreviated ResNet), Inception-v3 and VGG-16.