# US 12,225,047 B2 · Intelligent anti-phishing management

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,225,047 B2
- Document ID: US12225047B2
- Status: Granted
- Kind: B2
- Application number: 18/736,499
- Filed: 2024-06-06
- Published: 2024-11-28
- Granted: 2025-02-11
- Earliest claimed: 2023-05-26
- Assignees: Copperfasten Technologies Limited
- Applicants: Copperfasten Technologies Limited
- Inventors: Sean Morris; Neil Farrell
- Web page: https://patentgrep.com/patent/US12225047B2

## CPC

- H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Systems and methods are disclosed for monitoring, evaluating protection against, improving protection against, and simulating phishing threats. Network usage information for users of an organization can be leveraged to determine user-specific network behavior information. This user-specific network behavior information can then be leveraged to better identify incoming threats as well as generate and deploy user-specific phishing lures. Phishing simulation campaigns can be conducted, including by implementing variations in how the phishing lures are presented. Such campaigns can be scored to determine how different presentation variations perform. User-specific phishing lures can be generated using user environment information collected by an agent running on the user's device. Alerts informing users of potential threats can be dynamically updated with different presentation parameters to improve performance. Digital communications identified as threats can be used to generate hashes to speedily identify subsequent digital communications that are threats.

## Claims

### Claim 1

A computer-implemented method comprising:
conducting a phishing simulation campaign including:
determining, for each of a plurality of users of an organization, user-specific network behavior information based on network usage information, the user-specific network behavior information being indicative of how the respective user has interacted with a set of assets;
selecting, for each user of the plurality of users, an asset of the set of assets associated with the respective user based at least in part on the user-specific network behavior information associated with the respective user;
generating a plurality of phishing lures based on one or more presentation variations, the plurality of phishing lures including, for each of the plurality of users, a user-specific phishing lure that is based at least in part on the selected respective asset, each of the user-specific phishing lures being generated to appear to be associated with the selected respective asset upon receipt by the respective user;
deploying the plurality of phishing lures to the plurality of users of the organization;
receiving simulation response information associated with how at least a portion of the plurality of users responded to their respective user-specific phishing lure;
generating scoring information based at least in part on the simulation response information and the one or more presentation variations, the generating the scoring information including (i) generating at least a first subscore that is correlated with a first presentation variation of the one or more presentation variations and (ii) a second subscore that is correlated with a second presentation variation of the one or more presentation variations, the generating the scoring information being based at least in part on the first subscore and the second subscore; and
causing a training recommendation to be transmitted based at least in part on the generated scoring information.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, wherein each of the one or more presentation variations is indicative of:
(i) a text content variation;
(ii) an image content variation;
(iii) a text quality variation;
(iv) an image quality variation;
(v) a formatting variation;
(vi) a timing variation; or
(vii) any combination of (i)-(vi).

### Claim 3 (depends on 2)

The computer-implemented method of claim 2, wherein conducting the phishing simulation further includes analyzing each of the generated plurality of phishing lures to identify which one of the one or more presentation variations was used in generating the respective phishing lures.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1, wherein the one or more presentation variations includes a timing variation, and wherein the conducting the phishing simulation campaign further includes:
determining a first time to deploy a first one of the plurality of phishing lures; and
determining a second time, based at least in part on the first time and the timing variation, to deploy a second one of the plurality of phishing lures,
wherein the deploying the plurality of phishing lures includes deploying the first one of the phishing lures at the first time and deploying the second one of the plurality of phishing lures at the second time.

### Claim 5 (depends on 1)

The computer-implemented method of claim 1, wherein
the user-specific phishing lure, for each respective user, is further based at least in part on the user-specific network behavior information, and
wherein the deploying the plurality of phishing lures includes causing the user-specific phishing lure to be presented on a respective user device.

### Claim 6 (depends on 5)

The computer-implemented method of claim 5, wherein the conducting the phishing simulation campaign further includes deploying, for at least a subset of the plurality of users, the respective user-specific phishing lure based at least in part on the user-specific network behavior information and one of the one or more presentation variations.

### Claim 7 (depends on 6)

The computer-implemented method of claim 6, wherein each of the user-specific phishing lures includes a hyperlink, and wherein the receiving the simulation response information includes receiving an indication that at least one hyperlink of the user-specific phishing lures was activated.

### Claim 8 (depends on 5)

The computer-implemented method of claim 5, wherein, for a first user of the plurality of users, the conducting the phishing simulation campaign further includes:
determining a target timing based on the user-specific network behavior information associated with the first user,
wherein the target timing is determined as a time or time range in which:
(i) the first user is expected to use the respective user device;
(ii) a legitimate digital communication is expected to be received by the first user; or
(iii) both (i) and (ii); and
the deploying the user-specific phishing lure for the first user is based at least in part on the target timing.

### Claim 9 (depends on 1)

The computer-implemented method of claim 1, wherein, for at least a first user of the plurality of users, the conducting the phishing simulation campaign further includes:
analyzing the network usage information to identify an authentic communication associated with the selected asset for the first user;
generating a phishing simulation template for the selected asset based at least in part on the identified authentic communication; and
generating a phishing simulation communication using the phishing simulation template.

### Claim 10 (depends on 9)

The computer-implemented method of claim 9, wherein, for at least the first user of the plurality of users, the generating the phishing simulation communication includes applying at least one of the one or more presentation variations to the phishing simulation templates.

### Claim 11 (depends on 1)

The computer-implemented method of claim 1, wherein the one or more presentation variations includes at least one text quality variation, the text quality variation including:
(i) a spelling error;
(ii) a grammatical error;
(iii) a capitalization error;
(iv) a word spacing variation;
(v) a formatting variation;
(vi) a font variation; or
(vii) any combination of (i)-(vi).

### Claim 12

A computer program product, embodied on a non-transitory computer readable medium, comprising instructions which, when executed by a computer, cause the computer to perform operations including:
conducting a phishing simulation campaign including:
determining, for each of a plurality of users of an organization, user-specific network behavior information based on network usage information, the user-specific network behavior information being indicative of how the respective user has interacted with a set of assets;
selecting, for each user of the plurality of users, an asset of the set of assets associated with the respective user based at least in part on the user-specific network behavior information associated with the respective user;
generating a plurality of phishing lures based on one or more presentation variations, the plurality of phishing lures including, for each of the plurality of users, a user-specific phishing lure that is based at least in part on the selected respective asset, each of the user-specific phishing lures being generated to appear to be associated with the selected respective asset upon receipt by the respective user;
deploying the plurality of phishing lures to the plurality of users of the organization;
receiving simulation response information associated with how at least a portion of the plurality of users responded to their respective user-specific phishing lure;
generating scoring information based at least in part on the simulation response information and the one or more presentation variations, the generating the scoring information including (i) generating at least a first subscore that is correlated with a first presentation variation of the one or more presentation variations and (ii) a second subscore that is correlated with a second presentation variation of the one or more presentation variations, the generating the scoring information being based at least in part on the first subscore and the second subscore; and
causing a training recommendation to be transmitted based at least in part on the generated scoring information.

### Claim 13 (depends on 12)

The computer program product of claim 12, wherein each of the one or more presentation variations is indicative of:
(i) a text content variation;
(ii) an image content variation;
(iii) a text quality variation;
(iv) an image quality variation;
(v) a formatting variation;
(vi) a timing variation; or
(vii) any combination of (i)-(vi).

### Claim 14 (depends on 13)

The computer program product of claim 13, wherein conducting the phishing simulation further includes analyzing each of the generated plurality of phishing lures to identify which one of the one or more presentation variations was used in generating the respective phishing lures.

### Claim 15 (depends on 12)

The computer program product of claim 12, wherein the one or more presentation variations includes a timing variation, and wherein the conducting the phishing simulation campaign further includes:
determining a first time to deploy a first one of the plurality of phishing lures; and
determining a second time, based at least in part on the first time and the timing variation, to deploy a second one of the plurality of phishing lures,
wherein the deploying the plurality of phishing lures includes deploying the first one of the phishing lures at the first time and deploying the second one of the plurality of phishing lures at the second time.

### Claim 16 (depends on 12)

The computer program product of claim 12, wherein the user specific phishing lure, for each respective user, is further based at least in part on the user-specific network behavior information, and wherein the deploying the plurality of phishing lures includes causing the user-specific phishing lure to be presented on a respective user device.

### Claim 17 (depends on 16)

The computer program product of claim 16, wherein the conducting the phishing simulation campaign further includes deploying, for at least a subset of the plurality of users, the respective user-specific phishing lure based at least in part on the user-specific network behavior information and one of the one or more presentation variations.

### Claim 18 (depends on 17)

The computer program product of claim 17, wherein each of the user-specific phishing lures includes a hyperlink, and wherein the receiving the simulation response information includes receiving an indication that at least one hyperlink of the user-specific phishing lures was activated.

### Claim 19 (depends on 16)

The computer program product of claim 16, wherein, for a first user of the plurality of users, the conducting the phishing simulation campaign further includes:
determining a target timing based on the user-specific network behavior information associated with the first user,
wherein the target timing is determined as a time or time range in which:
(i) the first user is expected to use the respective user device;
(ii) a legitimate digital communication is expected to be received by the first user; or
(iii) both (i) and (ii); and
the deploying the user-specific phishing lure for the first user is based at least in part on
the target timing.

### Claim 20 (depends on 12)

The computer program product of claim 12, wherein, for at least a first user of the plurality of users, the conducting the phishing simulation campaign further includes:
analyzing the network usage information to identify an authentic communication associated with the selected asset for the first user;
generating a phishing simulation template for the selected asset based at least in part on the identified authentic communication; and
generating a phishing simulation communication using the phishing simulation template.

### Claim 21 (depends on 20)

The computer program product of claim 20, wherein, for at least the first user of the plurality of users, the generating the phishing simulation communication includes applying at least one of the one or more presentation variations to the phishing simulation templates.

### Claim 22 (depends on 12)

The computer program product of claim 12, wherein the one or more presentation variations includes at least one text quality variation, the text quality variation including:
(i) a spelling error;
(ii) a grammatical error;
(iii) a capitalization error;
(iv) a word spacing variation;
(v) a formatting variation;
(vi) a font variation; or
(vii) any combination of (i)-(vi).

### Claim 23

A system comprising:
a control system including one or more processors; and
a memory having stored thereon machine readable instructions, which when executed by at least one of the one or more processors of the control system, cause the system to perform operations including:
conducting a phishing simulation campaign including:
determining, for each of a plurality of users of an organization, user-specific network behavior information based on network usage information, the user-specific network behavior information being indicative of how the respective user has interacted with a set of assets;
selecting, for each user of the plurality of users, an asset of the set
of assets associated with the respective user based at least in part on the user-specific network behavior information associated with the respective user;
generating a plurality of phishing lures based on one or more presentation variations, the plurality of phishing lures including, for each of the plurality of users, a user-specific phishing lure that is based at least in part on the selected respective asset, each of the user-specific phishing lures being generated to appear to be associated with the selected respective asset upon receipt by the respective user;
deploying the plurality of phishing lures to the plurality of users of the organization;
receiving simulation response information associated with how at least a portion of the plurality of users responded to their respective user-specific phishing lure;
generating scoring information based at least in part on the simulation response information and the one or more presentation variations, the generating the scoring information including (i) generating at least a first subscore that is correlated with a first presentation variation of the one or more presentation variations and (ii) a second subscore that is correlated with a second presentation variation of the one or more presentation variations, the generating the scoring information being based at least in part on the first subscore and the second subscore; and
causing a training recommendation to be transmitted based at least in part on the generated scoring information.

### Claim 24 (depends on 23)

The system of claim 23, wherein each of the one or more presentation variations is indicative of:
(i) a text content variation;
(ii) an image content variation;
(iii) a text quality variation;
(iv) an image quality variation;
(v) a formatting variation;
(vi) a timing variation; or
(vii) any combination of (i)-(vi).

### Claim 25 (depends on 24)

The system of claim 24, wherein conducting the phishing simulation further includes analyzing each of the generated plurality of phishing lures to identify which one of the one or more presentation variations was used in generating the respective phishing lures.

### Claim 26 (depends on 23)

The system of claim 23, wherein the one or more presentation variations includes a timing variation, and wherein the conducting the phishing simulation campaign further includes:
determining a first time to deploy a first one of the plurality of phishing lures; and
determining a second time, based at least in part on the first time and the timing variation, to deploy a second one of the plurality of phishing lures,
wherein the deploying the plurality of phishing lures includes deploying the first one of the phishing lures at the first time and deploying the second one of the plurality of phishing lures at the second time.

### Claim 27 (depends on 23)

The system of claim 23, wherein the user specific phishing lure, for each respective user, is further based at least in part on the user-specific network behavior information, and wherein the deploying the plurality of phishing lures includes causing the user-specific phishing lure to be presented on a respective user device.

### Claim 28 (depends on 27)

The system of claim 27, wherein the conducting the phishing simulation campaign further includes deploying, for at least a subset of the plurality of users, the respective user-specific phishing lure based at least in part on the user-specific network behavior information and one of the one or more presentation variations.

### Claim 29 (depends on 28)

The system of claim 28, wherein each of the user-specific phishing lures includes a hyperlink, and wherein the receiving the simulation response information includes receiving an indication that at least one hyperlink of the user-specific phishing lures was activated.

### Claim 30 (depends on 27)

The system of claim 27, wherein, for a first user of the plurality of users, the conducting the phishing simulation campaign further includes:
determining a target timing based on the user-specific network behavior information associated with the first user,
wherein the target timing is determined as a time or time range in which:
(i) the first user is expected to use the respective user device;
(ii) a legitimate digital communication is expected to be received by the first user; or
(iii) both (i) and (ii); and
the deploying the user-specific phishing lure for the first user is based at least in part on
the target timing.

### Claim 31 (depends on 23)

The system of claim 23, wherein, for at least a first user of the plurality of users, the conducting the phishing simulation campaign further includes:
analyzing the network usage information to identify an authentic communication associated with the selected asset for the first user;
generating a phishing simulation template for the selected asset based at least in part on the identified authentic communication; and
generating a phishing simulation communication using the phishing simulation template.

### Claim 32 (depends on 31)

The system of claim 31, wherein, for at least the first user of the plurality of users, the generating the phishing simulation communication includes applying at least one of the one or more presentation variations to the phishing simulation templates.

### Claim 33 (depends on 23)

The system of claim 23, wherein the one or more presentation variations includes at least one text quality variation, the text quality variation including:
(i) a spelling error;
(ii) a grammatical error;
(iii) a capitalization error;
(iv) a word spacing variation;
(v) a formatting variation;
(vi) a font variation; or
(vii) any combination of (i)-(vi).