US 2023/0065787 A1 · DETECTION OF PHISHING WEBSITES USING MACHINE LEARNING

Abstract

Salient features are extracted from a training data set. The training data set includes, for each of a subset of known legitimate websites and a subset of known phishing websites, Uniform Resource Locators (URLs) and Hypertext Markup Language (HTML) information. The salient features are fed to a machine learning engine, a classifier engine to identify potential phishing websites is generated by applying the machine learning engine to the salient features, and parameters of the classifier engine are tuned. This enables identification of potential phishing websites by parsing a target website into URL information and HTML information, and identifying predetermined URL features and predetermined HTML features. A prediction as to whether the target website is a phishing website or a legitimate website, based on the predetermined URL features and the predetermined HTML features, is received from the classifier engine.

Claims18

Dependent claims

A method for identifying potential phishing websites, the method comprising:

receiving a target website;
parsing the target website into:
Uniform Resource Locator (URL) information;
and
Hypertext Markup Language (HTML) information;
identifying predetermined URL features of the URL information;
and
identifying predetermined HTML features of the HTML information;
and
receiving, from a classifier engine, a prediction as to whether the target website is a phishing website or a legitimate website;
wherein the prediction is based on the predetermined URL features and the predetermined HTML features.

8 more elements

A data processing system comprising at least one processor and memory coupled to the at least one processor, wherein the memory contains instructions which, when executed by the at least one processor, cause the at least one processor to implement a method comprising:

receiving a target website;
parsing the target website into:
Uniform Resource Locator (URL) information;
and
Hypertext Markup Language (HTML) information;
identifying predetermined URL features of the URL information;
and
identifying predetermined HTML features of the HTML information;
and
receiving, from a classifier engine, a prediction as to whether the target website is a phishing website or a legitimate website;
wherein the prediction is based on the predetermined URL features and the predetermined HTML, features.

8 more elements

A computer program product comprising a tangible, non-transitory computer readable medium embodying instructions which, when executed by at least one processor of a data processing system, cause the data processing system to implement a method comprising:

receiving a target website;
parsing the target website into:
Uniform Resource Locator (URL) information;
and
Hypertext Markup Language (HTML) information;
identifying predetermined URL features of the URL information;
and
identifying predetermined HTML features of the HTML information;
and
receiving, from a classifier engine, a prediction as to whether the target website is a phishing website or a legitimate website;
wherein the prediction is based on the predetermined URL features and the predetermined HTML features.

8 more elements

Dependencies are inferred from the claim text.

Facts

Application

17/887,037Filed 12 Aug 2022

Priority

27 Aug 2021

Published

2 Mar 2023

Term ends

Not estimatedThe source records don’t support an estimate.

Classification7 codes

G06F 21/554
Detecting local intrusion or implementing counter-measures: involving event detection and direct action
G06F 21/566
Computer malware detection or handling, e.g. anti-virus arrangements: dynamic detection, i.e. detection performed at run-time, e.g. emulation,…
G06N 20/00
Machine learning
G06N 20/20
Machine learning: ensemble learning

Detection of phishing websites using machine learning

Life of this patent

Detection of phishing websites using machine learning

Life of this patent

Abstract

Claims18