US 2026/0230504 A1 · PHISHING DETECTION ENGINE(S) FOR AUTONOMOUS PHISHING IDENTIFICATION

Abstract

Systems and methods herein provide a phishing detection engine and its related functions. In an aspect, a phishing detection engine captures focal content displayed via a user interface on a client device. From the focal content, the phishing detection engine extracts features. These features include textual elements and visual elements. Using the features, and in some cases historical user interactions associated with the client device, the phishing detection engine determines whether the features indicate potential phishing activity. If potential phishing activity is detected from the features, the phishing detection engine performs one or more security actions to limit damage of the potential phishing activity, such as blocking execution of an activation step of the phishing activity. In scenarios where the phishing activity is indeterminate, the phishing detection engine may continue to monitor the user's content interaction and extract features from subsequent contents, until a determinate conclusion is reached.

Claims20

Dependent claims

A computing apparatus comprising:

a computer-readable storage media;
a phishing detection engine comprising processor-executable instructions stored on the computer-readable storage media;
and
a processor coupled to the computer-readable storage media and configured to execute the processor-executable instructions, wherein the processor-executable instructions, when executed by the processor, direct the computing apparatus, to at least:
determine focal content displayed on a user interface of a client device;
extract a plurality of features from the focal content;
detect potential phishing activity by processing the plurality of features using a machine-learning model;
and
perform a security action to limit execution of the potential phishing activity responsive to detection.

6 more elements

A method comprising:

capturing, by a phishing detection engine, first content displayed via a user interface on a client device;
detecting, by the phishing detection engine, potential phishing activity from the first content;
monitoring, by the phishing detection engine, subsequent content interactions performed via the user interface;
determining, by the phishing detection engine, a high-risk of phishing activity based on the subsequent content interactions;
and
performing, by the phishing detection engine, a security action to limit potential damage of the phishing activity.

3 more elements

A computer readable storage media comprising processor-executable instructions configured to cause a processor to:

determine, by a phishing detection engine, first content displayed via a user interface on a client device;
extract, by the phishing detection engine, a plurality of features from the first content;
detect, by the phishing detection engine, potential phishing activity from the plurality of features;
determine, by the phishing detection engine, a risk level of the potential phishing activity;
and
perform, by the phishing detection engine, a security action to limit execution of the potential phishing activity based on the risk level.

3 more elements

Dependencies are inferred from the claim text.

Phishing detection engine(s) for autonomous phishing identification

Life of this patent

Phishing detection engine(s) for autonomous phishing identification

Life of this patent

Abstract

Claims20