公开(公告)号：US12166796B2

公开(公告)日：2024-12-10

申请号：US18244945

申请日：2023-09-12

Applicant: Proofpoint, Inc.

Inventor： Brian Sanford Jones ,  Zachary Mitchell Abzug ,  Jeremy Thomas Jordan ,  Giorgi Kvernadze ,  Dallan Quass

IPC: H04L9/40 ,  G06F16/51 ,  G06F16/955 ,  G06F18/21 ,  G06F21/56 ,  G06N3/08 ,  G06N20/00 ,  G06N20/10

Abstract: Aspects of the disclosure relate to detecting and identifying malicious sites using machine learning. A computing platform may receive image data of a graphical rendering of a resource available at a uniform resource locator (URL). The computing platform may compute a computer vision vector representation of the image data. The computing platform may compare the computer vision vector representation of the image data to stored numeric vectors representing page elements, resulting in a feature indicating whether the computer vision vector representation of the image data is visually similar to a known page element, and may input the feature to a classifier. The computing platform may receive, from the classifier, a phish classification score indicating a likelihood that the URL is malicious. In response to determining that the phish classification score exceeds a first phish classification threshold, the computing platform may cause a cybersecurity server to perform a first action.

公开(公告)号：US11799905B2

公开(公告)日：2023-10-24

申请号：US16831009

申请日：2020-03-26

Applicant: Proofpoint, Inc.

Inventor： Brian Sanford Jones ,  Zachary Mitchell Abzug ,  Jeremy Thomas Jordan ,  Giorgi Kvernadze ,  Dallan Quass

IPC: H04L9/40 ,  G06F16/955 ,  G06N20/10 ,  G06F21/56 ,  G06N3/08 ,  G06F16/51 ,  G06N20/00 ,  G06F18/213 ,  G06F18/21

CPC classification number: H04L63/1483 ,  G06F16/51 ,  G06F16/9566 ,  G06F18/213 ,  G06F18/217 ,  G06F21/56 ,  G06N3/08 ,  G06N20/00 ,  G06N20/10 ,  H04L63/1408 ,  H04L63/1416 ,  H04L63/1441 ,  G06V2201/09

Abstract: Aspects of the disclosure relate to detecting and identifying malicious sites using machine learning. A computing platform may receive image data of a graphical rendering of a resource available at a uniform resource locator (URL). The computing platform may compute a computer vision vector representation of the image data. The computing platform may compare the computer vision vector representation of the image data to stored numeric vectors representing page elements, resulting in a feature indicating whether the computer vision vector representation of the image data is visually similar to a known page element, and may input the feature to a classifier. The computing platform may receive, from the classifier, a phish classification score indicating a likelihood that the URL is malicious. In response to determining that the phish classification score exceeds a first phish classification threshold, the computing platform may cause a cybersecurity server to perform a first action.

公开(公告)号：US11924246B2

公开(公告)日：2024-03-05

申请号：US18104487

申请日：2023-02-01

Applicant: Proofpoint, Inc.

Inventor： Brian Sanford Jones ,  Zachary Mitchell Abzug ,  Jeremy Thomas Jordan ,  Giorgi Kvernadze ,  Dallan Quass

IPC: H04L9/40 ,  G06F16/51 ,  G06F16/955 ,  G06F18/21 ,  G06F18/213 ,  G06F21/56 ,  G06N3/08 ,  G06N20/00 ,  G06N20/10

CPC classification number: H04L63/1483 ,  G06F16/51 ,  G06F16/9566 ,  G06F18/213 ,  G06F18/217 ,  G06F21/56 ,  G06N3/08 ,  G06N20/00 ,  G06N20/10 ,  H04L63/1408 ,  H04L63/1416 ,  H04L63/1441 ,  G06V2201/09

Abstract: Aspects of the disclosure relate to detecting and identifying malicious sites using machine learning. A computing platform may receive a uniform resource locator (URL). The computing platform may parse and/or tokenize the URL to reduce the URL into a plurality of components. The computing platform may identify human-engineered features of the URL. The computing platform may compute a vector representation of the URL to identify deep learned features of the URL. The computing platform may concatenate the human-engineered features of the URL to the deep learned features of the URL, resulting in a concatenated vector representation. By inputting the concatenated vector representation of the URL to a URL classifier, the computing platform may compute a phish classification score. In response to determining that the phish classification score exceeds a first phish classification threshold, the computing platform may cause a cybersecurity server to perform a first action.

公开(公告)号：US20250071144A1

公开(公告)日：2025-02-27

申请号：US18940946

申请日：2024-11-08

Applicant: Proofpoint, Inc.

Inventor： Brian Sanford Jones ,  Zachary Mitchell Abzug ,  Jeremy Thomas Jordan ,  Giorgi Kvernadze ,  Dallan Quass

IPC: H04L9/40 ,  G06F16/51 ,  G06F16/955 ,  G06F18/21 ,  G06F21/56 ,  G06N3/08 ,  G06N20/00 ,  G06N20/10

Abstract: Aspects of the disclosure relate to detecting and identifying malicious sites using machine learning. A computing platform may receive image data of a graphical rendering of a resource available at a uniform resource locator (URL). The computing platform may compute a computer vision vector representation of the image data. The computing platform may compare the computer vision vector representation of the image data to stored numeric vectors representing page elements, resulting in a feature indicating whether the computer vision vector representation of the image data is visually similar to a known page element, and may input the feature to a classifier. The computing platform may receive, from the classifier, a phish classification score indicating a likelihood that the URL is malicious. In response to determining that the phish classification score exceeds a first phish classification threshold, the computing platform may cause a cybersecurity server to perform a first action.

公开(公告)号：US20200314122A1

公开(公告)日：2020-10-01

申请号：US16831009

申请日：2020-03-26

Applicant: Proofpoint, Inc.

Inventor： Brian Sanford Jones ,  Zachary Mitchell Abzug ,  Jeremy Thomas Jordan ,  Giorgi Kvernadze ,  Dallan Quass

IPC: H04L29/06 ,  G06F16/51 ,  G06N20/00 ,  G06K9/62

Abstract: Aspects of the disclosure relate to detecting and identifying malicious sites using machine learning. A computing platform may receive image data of a graphical rendering of a resource available at a uniform resource locator (URL). The computing platform may compute a computer vision vector representation of the image data. The computing platform may compare the computer vision vector representation of the image data to stored numeric vectors representing page elements, resulting in a feature indicating whether the computer vision vector representation of the image data is visually similar to a known page element, and may input the feature to a classifier. The computing platform may receive, from the classifier, a phish classification score indicating a likelihood that the URL is malicious. In response to determining that the phish classification score exceeds a first phish classification threshold, the computing platform may cause a cybersecurity server to perform a first action.

公开(公告)号：US20200311265A1

公开(公告)日：2020-10-01

申请号：US16830923

申请日：2020-03-26

Applicant: Proofpoint, Inc.

Inventor： Brian Sanford Jones ,  Zachary Mitchell Abzug ,  Jeremy Thomas Jordan ,  Giorgi Kvernadze ,  Dallan Quass

IPC: G06F21/56 ,  H04L29/06 ,  G06F16/955 ,  G06N3/08 ,  G06N20/10

Abstract: Aspects of the disclosure relate to detecting and identifying malicious sites using machine learning. A computing platform may receive a uniform resource locator (URL). The computing platform may parse and/or tokenize the URL to reduce the URL into a plurality of components. The computing platform may identify human-engineered features of the URL. The computing platform may compute a vector representation of the URL to identify deep learned features of the URL. The computing platform may concatenate the human-engineered features of the URL to the deep learned features of the URL, resulting in a concatenated vector representation. By inputting the concatenated vector representation of the URL to a URL classifier, the computing platform may compute a phish classification score. In response to determining that the phish classification score exceeds a first phish classification threshold, the computing platform may cause a cybersecurity server to perform a first action.

公开(公告)号：US20240171610A1

公开(公告)日：2024-05-23

申请号：US18426724

申请日：2024-01-30

Applicant: Proofpoint, Inc.

Inventor： Brian Sanford Jones ,  Zachary Mitchell Abzug ,  Jeremy Thomas Jordan ,  Giorgi Kvernadze ,  Dallan Quass

IPC: H04L9/40 ,  G06F16/51 ,  G06F16/955 ,  G06F18/21 ,  G06F18/213 ,  G06F21/56 ,  G06N3/08 ,  G06N20/00 ,  G06N20/10

CPC classification number: H04L63/1483 ,  G06F16/51 ,  G06F16/9566 ,  G06F18/213 ,  G06F18/217 ,  G06F21/56 ,  G06N3/08 ,  G06N20/00 ,  G06N20/10 ,  H04L63/1408 ,  H04L63/1416 ,  H04L63/1441 ,  G06V2201/09

Abstract: Aspects of the disclosure relate to detecting and identifying malicious sites using machine learning. A computing platform may receive a uniform resource locator (URL). The computing platform may parse and/or tokenize the URL to reduce the URL into a plurality of components. The computing platform may identify human-engineered features of the URL. The computing platform may compute a vector representation of the URL to identify deep learned features of the URL. The computing platform may concatenate the human-engineered features of the URL to the deep learned features of the URL, resulting in a concatenated vector representation. By inputting the concatenated vector representation of the URL to a URL classifier, the computing platform may compute a phish classification score. In response to determining that the phish classification score exceeds a first phish classification threshold, the computing platform may cause a cybersecurity server to perform a first action.

公开(公告)号：US20230421607A1

公开(公告)日：2023-12-28

申请号：US18244945

申请日：2023-09-12

Applicant: Proofpoint, Inc.

Inventor： Brian Sanford Jones ,  Zachary Mitchell Abzug ,  Jeremy Thomas Jordan ,  Giorgi Kvernadze ,  Dallan Quass

IPC: H04L9/40 ,  G06F16/955 ,  G06N20/10 ,  G06F21/56 ,  G06N3/08 ,  G06F16/51 ,  G06N20/00 ,  G06F18/213 ,  G06F18/21

CPC classification number: H04L63/1483 ,  G06F16/9566 ,  G06N20/10 ,  G06F21/56 ,  G06N3/08 ,  G06F16/51 ,  G06N20/00 ,  H04L63/1416 ,  H04L63/1441 ,  H04L63/1408 ,  G06F18/213 ,  G06F18/217 ,  G06V2201/09

Abstract: Aspects of the disclosure relate to detecting and identifying malicious sites using machine learning. A computing platform may receive image data of a graphical rendering of a resource available at a uniform resource locator (URL). The computing platform may compute a computer vision vector representation of the image data. The computing platform may compare the computer vision vector representation of the image data to stored numeric vectors representing page elements, resulting in a feature indicating whether the computer vision vector representation of the image data is visually similar to a known page element, and may input the feature to a classifier. The computing platform may receive, from the classifier, a phish classification score indicating a likelihood that the URL is malicious. In response to determining that the phish classification score exceeds a first phish classification threshold, the computing platform may cause a cybersecurity server to perform a first action.

公开(公告)号：US20230188566A1

公开(公告)日：2023-06-15

申请号：US18104487

申请日：2023-02-01

Applicant: Proofpoint, Inc.

Inventor： Brian Sanford Jones ,  Zachary Mitchell Abzug ,  Jeremy Thomas Jordan ,  Giorgi Kvernadze ,  Dallan Quass

IPC: H04L9/40 ,  G06F16/955 ,  G06N20/10 ,  G06F21/56 ,  G06N3/08 ,  G06F16/51 ,  G06N20/00 ,  G06F18/213 ,  G06F18/21

CPC classification number: H04L63/1483 ,  G06F16/9566 ,  G06N20/10 ,  G06F21/56 ,  G06N3/08 ,  G06F16/51 ,  G06N20/00 ,  H04L63/1416 ,  H04L63/1441 ,  H04L63/1408 ,  G06F18/213 ,  G06F18/217 ,  G06V2201/09

Abstract: Aspects of the disclosure relate to detecting and identifying malicious sites using machine learning. A computing platform may receive a uniform resource locator (URL). The computing platform may parse and/or tokenize the URL to reduce the URL into a plurality of components. The computing platform may identify human-engineered features of the URL. The computing platform may compute a vector representation of the URL to identify deep learned features of the URL. The computing platform may concatenate the human-engineered features of the URL to the deep learned features of the URL, resulting in a concatenated vector representation. By inputting the concatenated vector representation of the URL to a URL classifier, the computing platform may compute a phish classification score. In response to determining that the phish classification score exceeds a first phish classification threshold, the computing platform may cause a cybersecurity server to perform a first action.