公开(公告)号：US20230188566A1

公开(公告)日：2023-06-15

申请号：US18104487

申请日：2023-02-01

Applicant: Proofpoint, Inc.

Inventor： Brian Sanford Jones ,  Zachary Mitchell Abzug ,  Jeremy Thomas Jordan ,  Giorgi Kvernadze ,  Dallan Quass

IPC: H04L9/40 ,  G06F16/955 ,  G06N20/10 ,  G06F21/56 ,  G06N3/08 ,  G06F16/51 ,  G06N20/00 ,  G06F18/213 ,  G06F18/21

CPC classification number: H04L63/1483 ,  G06F16/9566 ,  G06N20/10 ,  G06F21/56 ,  G06N3/08 ,  G06F16/51 ,  G06N20/00 ,  H04L63/1416 ,  H04L63/1441 ,  H04L63/1408 ,  G06F18/213 ,  G06F18/217 ,  G06V2201/09

Abstract: Aspects of the disclosure relate to detecting and identifying malicious sites using machine learning. A computing platform may receive a uniform resource locator (URL). The computing platform may parse and/or tokenize the URL to reduce the URL into a plurality of components. The computing platform may identify human-engineered features of the URL. The computing platform may compute a vector representation of the URL to identify deep learned features of the URL. The computing platform may concatenate the human-engineered features of the URL to the deep learned features of the URL, resulting in a concatenated vector representation. By inputting the concatenated vector representation of the URL to a URL classifier, the computing platform may compute a phish classification score. In response to determining that the phish classification score exceeds a first phish classification threshold, the computing platform may cause a cybersecurity server to perform a first action.