Back to results
US 12,615,293 B2Granted
Systems and methods for preventing phishing attacks
AssigneeOpen Text Corporation
InventorsHemanth Moganna Gowda, Sachin Pargi
Life of this patent
Estimating the term…
Abstract
Embodiments of the present disclosure provide systems and methods to classify webpages according to phishing risk. Embodiments combine generative AI with a knowledgebase of anti-phishing questions. To classify a webpage, the generative AI processes details from the webpage to answer the anti-phishing questions. The webpage is classified at least in part based on the results generated by the generative AI.
Claims19
A computer-implemented method for preventing phishing, the method comprising:
- receiving a request to classify a webpage requested by a web browser, the request to classify the webpage comprising details of the webpage;
- classifying the webpage using the details of the webpage, wherein classifying the webpage comprises:
- accessing an instruction definition from a memory, the instruction definition specifying anti-phishing questions for phishing detection and an answer format for the anti-phishing questions, wherein the instruction definition associates the anti-phishing questions specified in the instruction definition with contexts selected from the details of the webpage;
- generating, according to the instruction definition, a programmatic instruction to a large language model to prompt the large language model to answer the anti-phishing questions using the details of the webpage, the programmatic instruction comprising the anti-phishing questions, the answer format, and the details of the webpage, wherein the programmatic instruction specifies which context is to be used for answering each of the anti-phishing questions specified in the instruction definition;
- receiving a result of processing the programmatic instruction from the large language model, the result comprising a plurality of answers, the plurality of answers comprising answers to the anti-phishing questions;
- and
- determining a phishing classification from a plurality of potential classifications based on the result;
- and
- returning a response to the request to classify the webpage, the response including the phishing classification.
6 more elements
An anti-phishing system comprising:
- a client computer comprising a web browser with a browser plug-in, the browser plug-in comprising instructions executable for:
- capturing details of a webpage requested by the web browser;
- generating a request to classify the webpage, the request to classify the webpage comprising the details of the webpage;
- receiving a response to the request to classify the webpage, the response comprising a phishing classification for the webpage;
- executing a predefined action based on the response;
- a server computer in communication with the client computer over a network, the server computer comprising a cybersecurity agent, the cybersecurity agent comprising a large language model and instructions executable for:
- maintaining an anti-phishing knowledgebase;
- classifying the webpage using the details of the webpage, wherein classifying the webpage comprises:
- accessing an instruction definition, the instruction definition specifying anti-phishing questions for phishing detection from the anti-phishing knowledgebase and an answer format for the anti-phishing questions, wherein the instruction definition associates the anti-phishing questions specified in the instruction definition with contexts selected from the details of the webpage;
- generating, according to the instruction definition, a programmatic instruction to the large language model to prompt the large language model to answer the anti-phishing questions using the details of the webpage, the programmatic instruction comprising the anti-phishing questions specified by the instruction definition, the answer format, and the details of the webpage, wherein the programmatic instruction specifies which context is to be used for answering each of the anti-phishing questions specified in the instruction definition;
- receiving a result of processing the programmatic instruction from the large language model, the result comprising a plurality of answers, the plurality of answers comprising answers to the anti-phishing questions included in the programmatic instruction to the large language model;
- and
- determining the phishing classification based on the result;
- and
- returning the response to the request to classify the webpage to the browser plug-in, the response including the phishing classification.
12 more elements
A computer program product comprising a non-transitory, computer-readable medium storing thereon anti-phishing software, the anti-phishing software comprising instructions translatable by a processor for:
- receiving a request to classify a webpage, the request to classify the webpage comprising details of the webpage;
- classifying the webpage using the details of the webpage, wherein classifying the webpage comprises:
- accessing an instruction definition from a memory, the instruction definition specifying anti-phishing questions for phishing detection and an answer format for the anti-phishing questions wherein the instruction definition associates the anti-phishing questions specified in the instruction definition with contexts selected from the details of the webpage;
- generating, according to the instruction definition, a programmatic instruction to a large language model to prompt the large language model to answer the anti-phishing questions using the details of the webpage, the programmatic instruction comprising the anti-phishing questions, the answer format, and the details of the webpage, wherein the programmatic instruction specifies which context is to be used for answering each of the anti-phishing questions specified in the instruction definition;
- receiving a result of processing the programmatic instruction from the large language model, the result comprising a plurality of answers, the plurality of answers comprising answers to the anti-phishing questions;
- and
- determining a phishing classification from a plurality of potential classifications based on the result;
- and
- returning a response to the request to classify the webpage, the response including the phishing classification.
6 more elements
Dependencies are inferred from the claim text.