# US 12,010,142 B2 · Phishing mail generator with adaptive complexity using generative adversarial network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,010,142 B2 - Document ID: US12010142B2 - Status: Granted - Kind: B2 - Application number: 17/469,009 - Filed: 2021-09-08 - Published: 2023-03-09 - Granted: 2024-06-11 - Earliest claimed: 2021-09-08 - Assignees: Mastercard International Incorporated - Applicants: Mastercard International Incorporated - Inventors: Alok Singh; Nitish Kumar; Kanishka Kayathwal - Web page: https://patentgrep.com/patent/US12010142B2 ## CPC - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - G06N 3/044: Recurrent networks, e.g. Hopfield networks - G06N 3/0442: characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU] - G06N 3/045: Combinations of networks - G06N 3/0475: Generative networks - G06N 3/088: Non-supervised learning, e.g. competitive learning - G06N 3/092: Reinforcement learning - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A generative adversarial network and a reinforcement learning system are combined to generate phishing emails with adaptive complexity. A plurality of phishing emails are obtained from a trained generative adversarial neural network, including a generator neural network and a discriminator neural network. A subset of phishing emails is selected, from the plurality of phishing emails, using a reinforcement learning system trained on user-specific behavior. One or more of the subset of phishing emails are sent to a user email account associated with a particular user. The reinforcement learning system is then adjusted based on user action feedback to the one or more of the subset of phishing emails. ## Claims ### Claim 1 A method for generating phishing electronic mail (email) with adaptive complexity, comprising: obtaining a plurality of phishing emails from a trained generative adversarial neural network, the trained generative adversarial neural network including a generator neural network and a discriminator neural network; selecting a subset of phishing emails, from the plurality of phishing emails, using a reinforcement learning system trained on user-specific behavior based on likelihood that a particular user will take action on one or more of the subset of phishing emails; sending one or more of the subset of phishing emails to a user email account associated with the particular user; and adjusting the reinforcement learning system to select one or more phishing emails that are likely to cause the particular user to take action, based on user action feedback to the one or more of the subset of phishing emails. ### Claim 2 (depends on 1) The method of claim 1, wherein the reinforcement learning system is a bidirectional long short term memory (LSTM) recurrent neural network (RNN). ### Claim 3 (depends on 2) The method of claim 2, wherein the reinforcement learning system has a retained memory of n previous time steps or phishing emails for the particular user. ### Claim 4 (depends on 2) The method of claim 2, wherein at least each of the subset of phishing emails, the user-specific behavior, and the user action feedback are represented as a vector and a user state is defined based on a plurality of n previous phishing emails for the particular user. ### Claim 5 (depends on 2) The method of claim 2, wherein the reinforcement learning system implements a Deep Deterministic Policy Gradient (DDPG) algorithm to train the reinforcement learning system. ### Claim 6 (depends on 2) The method of claim 2, wherein the user-specific behavior includes at least one of: (a) web browsing history for the particular user, (b) past user behavior in identifying phishing, and (c) phishing email features to which the particular user has been responsive in the past. ### Claim 7 (depends on 1) The method of claim 1, wherein the trained generative adversarial neural network is trained using real phishing emails and generated phishing emails until the discriminator neural network is unable to identify a threshold percentage of the generated phishing emails as fake phishing emails. ### Claim 8 (depends on 1) The method of claim 1, wherein the plurality of phishing emails are generated by the generator neural network after the generative adversarial neural network is trained. ### Claim 9 (depends on 1) The method of claim 1, wherein the subset of phishing emails is selected based on the likelihood that the particular user will take action on one or more of the subset of phishing emails. ### Claim 10 (depends on 1) The method of claim 1, wherein user action includes at least one of: (a) selecting a link in one or more of the subset of phishing emails sent to the user email account, (b) opening a file attached to the one or more of the subset of phishing emails sent to the user email account, and (c) replying to one or more of the subset of phishing emails sent to the user email account. ### Claim 11 (depends on 1) The method of claim 1, wherein the reinforcement learning system is configured to: classify the user-specific behavior, evaluate the likelihood that the particular user will select each of the plurality of phishing emails based on the classification of the user-specific behavior, and select the subset of phishing emails based on the evaluation, where the subset of phishing emails is selected based on having the highest likelihood of triggering action by the particular user. ### Claim 12 (depends on 1) The method of claim 1, further comprising: notifying the particular user, when user action is taken in one or more of the subset of phishing emails, that it was a phishing email. ### Claim 13 (depends on 1) The method of claim 1, wherein after adjusting the reinforcement learning system, the method further comprising: selecting another subset of phishing emails, from the plurality of phishing emails, using the reinforcement learning system trained on user-specific behavior; and sending one or more of the another subset of phishing emails to the user email account associated with the particular user. ### Claim 14 (depends on 1) The method of claim 1, further comprising: selecting another subset of phishing emails, from the plurality of phishing emails, using the reinforcement learning system trained on a different user-specific behavior; sending one or more of the another subset of phishing emails to another user email account associated with another user; and adjusting the reinforcement learning system based on user action feedback to the one or more of the another subset of phishing emails. ### Claim 15 A non-transitory computer-readable storage medium having instructions thereon, wherein the instructions, when executed by a processing circuit, cause the processing circuit to: obtain a plurality of phishing emails from a trained generative adversarial neural network, the trained generative adversarial neural network including a generator neural network and a discriminator neural network; select a subset of phishing emails, from the plurality of phishing emails, using a reinforcement learning system trained on user-specific behavior based on likelihood that a particular user will take action on one or more of the subset of phishing emails; send one or more of the subset of phishing emails to a user email account associated with the particular user; and adjust the reinforcement learning system to select one or more phishing emails that are likely to cause the particular user to take action, based on user action feedback to the one or more of the subset of phishing emails. ### Claim 16 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the reinforcement learning system is a bidirectional long short term memory (LSTM) recurrent neural network (RNN). ### Claim 17 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the reinforcement learning system is configured to: classify the user-specific behavior, evaluate the likelihood that the particular user will select each of the plurality of phishing emails based on the classification of the user-specific behavior, and select the subset of phishing emails based on the evaluation, where the subset of phishing emails is selected based on having the highest likelihood of triggering action by the particular user. ### Claim 18 (depends on 15) The non-transitory computer-readable storage medium of claim 15, having further instructions thereon, which when executed by a processing circuit, cause the processing circuit to: notify the particular user, when user action is taken in one or more of the subset of phishing emails, that it was a phishing email. ### Claim 19 A server, comprising: at least one processor; a communication interface communicatively coupled to the at least one processor; and a memory communicatively coupled to the at least one processor, wherein the at least one processor is configured to: obtain a plurality of phishing emails from a trained generative adversarial neural network, the trained generative adversarial neural network including a generator neural network and a discriminator neural network; select a subset of phishing emails, from the plurality of phishing emails, using a reinforcement learning system trained on user-specific behavior based on likelihood that a particular user will take action on one or more of the subset of phishing emails; send one or more of the subset of phishing emails to a user email account associated with the particular user; and adjust the reinforcement learning system to select one or more phishing emails that are likely to cause the particular user to take action, based on user action feedback to the one or more of the subset of phishing emails. ### Claim 20 (depends on 19) The server of claim 19, wherein the at least one processor is further configured to: notify the particular user, when user action is taken in one or more of the subset of phishing emails, that it was a phishing email.