# US 2024/0205263 A1 · Real-time detection of site phishing using Message Passing Neural Networks (MPNN) on directed graphs

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2024/0205263 A1
- Document ID: US20240205263A1
- Status: Published application
- Kind: A1
- Application number: 18/084,593
- Filed: 2022-12-20
- Published: 2024-06-20
- Earliest claimed: 2022-12-20
- Assignees: Akamai Technologies, Inc.
- Applicants: Akamai Technologies, Inc.
- Inventors: Nadav George Costa
- Web page: https://patentgrep.com/patent/US20240205263A1

## CPC

- H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)}
- G06N 3/042: Knowledge-based neural networks; Logical representations of neural networks
- G06N 3/044: Recurrent networks, e.g. Hopfield networks
- G06N 3/045: Combinations of networks
- G06N 3/0464: Convolutional networks [CNN, ConvNet]
- G06N 3/047: Probabilistic or stochastic networks
- G06N 3/048: Activation functions
- G06N 3/08: Learning methods
- G06N 3/084: Backpropagation, e.g. using gradient descent
- G06N 3/088: Non-supervised learning, e.g. competitive learning
- G06N 3/09: Supervised learning
- G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
- G06N 5/022: Knowledge engineering; Knowledge acquisition
- G06N 20/00: Machine learning
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

Website phishing detection is enabled using a Message Passing Neural Network (MPNN) that scores requested HTML with a likelihood of being a phishing website. The technique leverages the assumption that the HTML in a phishing website often presents anomalous structure or features when compared with an analogous benign website. Once a phishing site is detected, a given mitigation action is then taken.

## Claims

### Claim 1

A method of protecting an online system, comprising:
generating a Document Object Model (DOM) associated with a Hypertext Markup Language (HTML) page;
generating from the DOM one or more directed graphs, wherein a directed graph (DG) represents an HTML feature in the HTML page;
applying an encoded representation of the one or more directed graphs through a Message Passing Neural Network (MPNN), the MPNN having been trained by analyzing interactions between connected HTML nodes in the DOM, to generate a likelihood that the HTML page is a phishing page; and
upon a determination that the HTML page is likely a phishing page, taken a given mitigation action with respect to the HTML page.

### Claim 2 (depends on 1)

The method as described in claim 1 wherein the MPNN analyzes the interactions using message passing.

### Claim 3 (depends on 2)

The method as described in claim 2 wherein the HTML feature is one of: a hyperlink, and HTML inner text, and a combination of a hyperlink and HTML inner text.

### Claim 4 (depends on 3)

The method as described in claim 3 wherein the one or more directed graphs include a directed graph associated with a hyperlink, and directed graph associated with HTML inner text.

### Claim 5 (depends on 1)

The method as described in claim 1 wherein generating the one or more directed graphs from the DOM comprises:
placing the DOM into a JavaScript Object Notation (JSON) file;
parsing the JSON file into a tree data structure of defined HTML attributes; and
processing the tree data structure into the directed graph.

### Claim 6 (depends on 5)

The method as described in claim 5 wherein the processing of the tree data structure is carried out iteratively with respect to filtering criteria to generate the directed graphs.

### Claim 7 (depends on 6)

The method as described in claim 6 wherein the filtering criteria comprise HTML tag names.

### Claim 8 (depends on 1)

The method as described in claim 1 wherein the encoded representation is generated by a pretrained language encoder.

### Claim 9 (depends on 8)

The method as described in claim 8 wherein the pretrained language encoder is BERT.

### Claim 10 (depends on 1)

The method as described in claim 1 wherein applying the representation through the MPNN comprises, for each HTML feature:
passing the representation through an input layer;
passing an output from the input layer through a node representation learning layer; and
passing an output from the node representation learning layer though a message-passing attention layer.

### Claim 11 (depends on 10)

The method as described in claim 10 wherein the message passing attention layer is a multi-head self-attention layer followed by dense projections that feed a pooling layer.

### Claim 12 (depends on 11)

The method as described in claim 11 wherein the multi-head self-attention layer and the pooling layer generate a vector graph representation.

### Claim 13 (depends on 12)

The method as described in claim 12 wherein the vector graph representation is supplied to a fully-connected neural network that generates the likelihood that the HTML page is a phishing page.

### Claim 14 (depends on 1)

The method as described in claim 1 wherein the determination occurs in substantially real-time.

### Claim 15 (depends on 1)

The method as described in claim 1 further including training the MPNN.

### Claim 16

An apparatus for protecting an online system, comprising:
one or more hardware processors; and
computer memory holding computer program code executed by the one or more hardware processors and configured to:
generate a Document Object Model (DOM) associated with a Hypertext Markup Language (HTML) page;
generate from the DOM one or more directed graphs, wherein a directed graph (DG) represents an HTML feature in the HTML page;
apply an encoded representation of the one or more directed graphs through a Message Passing Neural Network (MPNN), the MPNN having been trained by analyzing interactions between connected HTML nodes in the DOM, to generate a likelihood that the HTML page is a phishing page; and
upon a determination that the HTML page is likely a phishing page, taken a given mitigation action with respect to the HTML page.

### Claim 17 (depends on 16)

The apparatus as described in claim 16 wherein the MPNN wherein the analyzes the interactions using message passing.

### Claim 18 (depends on 17)

The apparatus as described in claim 17 wherein the HTML feature is one of: a hyperlink, and HTML inner text, and a combination of a hyperlink and HTML inner text.

### Claim 19 (depends on 16)

The apparatus as described in claim 16 wherein the computer program code is further executed by the one or more hardware processors to train the MPNN.

### Claim 20

A phishing detection system, comprising:
a server executing in a hardware platform and configured to interoperate with a requesting client; and
a back-end infrastructure configured to receive signaling forwarded by the server during an interaction with the requesting client with respect to a website, the back-end infrastructure comprising hardware and software configured in response to receipt of the signaling to:
obtain an HTML page;
generate a Document Object Model (DOM) associated with the HTML page;
generate from the DOM one or more directed graphs, wherein a directed graph (DG) represents an HTML feature in the HTML page;
apply a representation derived from the one or more graphs through a Message Passing Neural Network (MPNN), the MPNN having been trained by analyzing interactions between connected HTML nodes in the DOM;
generate a score indicative of whether the HTML page is a phishing page; and
forward the score to the server for handling.

### Claim 21 (depends on 20)

The phishing detection system as described in claim 20 wherein, in response to receipt of the score, the server issues a notification to the requesting client that the website is a phishing site.