# US 2026/0100969 A1 · Systems, methods, apparatus, and articles of manufacture to classify data via tiered machine learning analysis

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2026/0100969 A1
- Document ID: US20260100969A1
- Status: Published application
- Kind: A1
- Application number: 18/910,998
- Filed: 2024-10-09
- Published: 2026-04-09
- Earliest claimed: 2024-10-09
- Assignees: McAfee, Inc.
- Applicants: McAfee, LLC
- Inventors: German Lancioni; Steven Leonard Grobman; Oliver Devane
- Web page: https://patentgrep.com/patent/US20260100969A1

## CPC

- H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)}
- G06F 16/951: Indexing; Web crawling techniques
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Systems, apparatus, articles of manufacture, and methods are disclosed to classify data via tiered machine learning analysis. An example apparatus includes interface circuitry to access a latent space representation (LSR) of a first sample of a webpage, machine-readable instructions, and at least one processor circuit to be programmed by the machine-readable instructions. For example, the at least one processor circuit is to initiate a first artificial intelligence (AI) model to classify the webpage as benign or potentially malicious based on the LSR. Additionally, the at least one processor circuit is to, after the first AI model classifies the webpage as potentially malicious, initiate a second AI model to classify the webpage as benign or malicious based on a second sample of the webpage, the first AI model being less precise than the second AI model.

## Claims

### Claim 1

An apparatus comprising:
interface circuitry to access a latent space representation (LSR) of a first sample of a webpage;
machine-readable instructions; and
at least one processor circuit to be programmed by the machine-readable instructions to:
initiate a first artificial intelligence (AI) model to classify the webpage as benign or potentially malicious based on the LSR; and
after the first AI model classifies the webpage as potentially malicious, initiate a second AI model to classify the webpage as benign or malicious based on a second sample of the webpage, the first AI model being less precise than the second AI model.

### Claim 2 (depends on 1)

The apparatus of claim 1, wherein one or more of the at least one processor circuit is to cause storage of a pointer to the webpage in a queue accessible by a web crawler after the first AI model classifies the webpage as potentially malicious.

### Claim 3 (depends on 1)

The apparatus of claim 1, wherein one or more of the at least one processor circuit is to cause scraping of data from the webpage to collect the second sample after the first AI model classifies the webpage as potentially malicious.

### Claim 4 (depends on 1)

The apparatus of claim 1, wherein one or more of the at least one processor circuit is to at least one of (a) cause an endpoint device to present a warning to a user of the endpoint device that the webpage may be malicious or (b) cause the endpoint device to prohibit entry of data into the webpage.

### Claim 5 (depends on 1)

The apparatus of claim 1, wherein one or more of the at least one processor circuit is to cause an endpoint device to block access to the webpage.

### Claim 6 (depends on 1)

The apparatus of claim 1, wherein the LSR obfuscates personally identifiable information of a user that accessed the webpage with an endpoint device.

### Claim 7 (depends on 1)

The apparatus of claim 1, wherein the first AI model has high recall and low precision, and the second AI model has high recall and high precision.

### Claim 8

A non-transitory computer-readable medium comprising instruction to cause at least one processor circuit to:
initiate a first artificial intelligence (AI) model to classify a webpage as benign or potentially malicious based on a latent space representation of a first sample of the webpage; and
after the first AI model classifies the webpage as potentially malicious, initiate a second AI model to classify the webpage as benign or malicious based on a second sample of the webpage, the first AI model being less precise than the second AI model.

### Claim 9 (depends on 8)

The non-transitory computer-readable medium of claim 8, wherein the instructions cause one or more of the at least one processor circuit to cause storage of an identifier of the webpage in a queue accessible by a web crawler after the first AI model classifies the webpage as potentially malicious.

### Claim 10 (depends on 8)

The non-transitory computer-readable medium of claim 8, wherein the instructions cause one or more of the at least one processor circuit to cause scraping of data from the webpage to collect the second sample after the first AI model classifies the webpage as potentially malicious.

### Claim 11 (depends on 8)

The non-transitory computer-readable medium of claim 8, wherein the instructions cause one or more of the at least one processor circuit to at least one of (a) cause an endpoint device to display a message to a user of the endpoint device that the webpage may be malicious or (b) cause the endpoint device to block entry of data into the webpage.

### Claim 12 (depends on 8)

The non-transitory computer-readable medium of claim 8, wherein the instructions cause one or more of the at least one processor circuit to cause an endpoint device to prevent access to the webpage.

### Claim 13 (depends on 8)

The non-transitory computer-readable medium of claim 8, wherein the latent space representation removes personally identifiable information of a user from the first sample of the webpage.

### Claim 14 (depends on 8)

The non-transitory computer-readable medium of claim 8, wherein the first AI model has high recall and low precision, and the second AI model has high recall and high precision.

### Claim 15

A system comprising:
an endpoint device including:
at least one first processor circuit to encode a first sample of data into a latent space representation (LSR); and
first interface circuitry to transmit the LSR over a network; and
a network device including:
second interface circuitry to access the LSR from the endpoint device; and
at least one second processor circuit to:
initiate a first artificial intelligence (AI) model to classify the data as benign or potentially malicious based on the LSR; and
after the first AI model classifies the data as potentially malicious, initiate a second AI model to classify the data as benign or malicious based on a second sample of the data, the first AI model being less precise than the second AI model.

### Claim 16 (depends on 15)

The system of claim 15, wherein one or more of the at least one second processor circuit is to cause storage of a pointer to the data in a queue accessible by a web crawler after the first AI model classifies the data as potentially malicious.

### Claim 17 (depends on 15)

The system of claim 15, wherein one or more of the at least one second processor circuit is to cause scraping of a webpage to collect the second sample after the first AI model classifies the webpage as potentially malicious.

### Claim 18 (depends on 15)

The system of claim 15, wherein the data is first data, and one or more of the at least one first processor circuit is to, based on a communication from the network device, at least one of (a) cause a display of the endpoint device to present a warning to a user of the endpoint device that the first data may be malicious or (b) block entry of second data into a field associated with the first data.

### Claim 19 (depends on 15)

The system of claim 15, wherein one or more of the at least one second processor circuit is to prevent access to the data based on a communication from the network device.

### Claim 20 (depends on 15)

The system of claim 15, wherein the first AI model has high recall and low precision, and the second AI model has high recall and high precision.