Back to results
US 2024/0205263 A1Published application
Real-time detection of site phishing using Message Passing Neural Networks (MPNN) on directed graphs
AssigneeAkamai Technologies, Inc.
InventorNadav George Costa
Life of this patent
Estimating the term…
Abstract
Website phishing detection is enabled using a Message Passing Neural Network (MPNN) that scores requested HTML with a likelihood of being a phishing website. The technique leverages the assumption that the HTML in a phishing website often presents anomalous structure or features when compared with an analogous benign website. Once a phishing site is detected, a given mitigation action is then taken.
Claims21
A method of protecting an online system, comprising:
- generating a Document Object Model (DOM) associated with a Hypertext Markup Language (HTML) page;
- generating from the DOM one or more directed graphs, wherein a directed graph (DG) represents an HTML feature in the HTML page;
- applying an encoded representation of the one or more directed graphs through a Message Passing Neural Network (MPNN), the MPNN having been trained by analyzing interactions between connected HTML nodes in the DOM, to generate a likelihood that the HTML page is a phishing page;
- and
- upon a determination that the HTML page is likely a phishing page, taken a given mitigation action with respect to the HTML page.
2 more elements
An apparatus for protecting an online system, comprising:
- one or more hardware processors;
- and
- computer memory holding computer program code executed by the one or more hardware processors and configured to:
- generate a Document Object Model (DOM) associated with a Hypertext Markup Language (HTML) page;
- generate from the DOM one or more directed graphs, wherein a directed graph (DG) represents an HTML feature in the HTML page;
- apply an encoded representation of the one or more directed graphs through a Message Passing Neural Network (MPNN), the MPNN having been trained by analyzing interactions between connected HTML nodes in the DOM, to generate a likelihood that the HTML page is a phishing page;
- and
- upon a determination that the HTML page is likely a phishing page, taken a given mitigation action with respect to the HTML page.
5 more elements
A phishing detection system, comprising:
- a server executing in a hardware platform and configured to interoperate with a requesting client;
- and
- a back-end infrastructure configured to receive signaling forwarded by the server during an interaction with the requesting client with respect to a website, the back-end infrastructure comprising hardware and software configured in response to receipt of the signaling to:
- obtain an HTML page;
- generate a Document Object Model (DOM) associated with the HTML page;
- generate from the DOM one or more directed graphs, wherein a directed graph (DG) represents an HTML feature in the HTML page;
- apply a representation derived from the one or more graphs through a Message Passing Neural Network (MPNN), the MPNN having been trained by analyzing interactions between connected HTML nodes in the DOM;
- generate a score indicative of whether the HTML page is a phishing page;
- and
- forward the score to the server for handling.
7 more elements
Dependencies are inferred from the claim text.