System and method for identifying phishing cyber-attacks through deep machine learning via a convolutional neural network (CNN) engine
The presently disclosed subject matter includes a system for the detection of phishing cyber-attacks based on an application of deep machine learning techniques including the implementation of a deep convolutional neural network to determine whether a web element associated with a uniform resource locator is part of a phishing cyber-attack. The system produces a notification indicative of the phishing cyber-attack when a positive match between the uniform resource locator and the phishing cyber-attack is determined. The convolutional neural network is retrained at periodic time intervals with new datasets retrieved by an automated dataset collector and thus, improves the detection of zero-days cyber-attacks.
1. An apparatus, comprising:
a processor; and
a memory storing code which, when executed by the processor, causes the processor to:
receive a signal indicative of a uniform resource locator;
extract a first web element associated with the uniform resource locator based on an output of a uniform resource locator filter;
generate via at least one convolutional neural network a first set of features associated with the first web element;
determine a positive match between the uniform resource locator and a phishing cyber-attack when a similarity score between the first set of features and a third set of features learned by the at least one convolutional neural network reaches a first predetermined threshold;
when the similarity score between the first set of features and the third set of features does not reach the first predetermined threshold:
generate via the at least one convolutional neural network a second set of features associated with a second web element extracted from the first web element; and
determine the positive match between the uniform resource locator and the phishing cyber-attack when a similarity score between the second set of features and a fourth set of features learned by the at least one convolutional neural network reaches a second predetermined threshold; and
produce a notification indicative of the phishing cyber-attack when the positive match between the uniform resource locator and the phishing cyber-attack is determined.
2. The apparatus of claim 1 , wherein:
the signal is a first signal; and
the memory storing code which, when executed by the processor, further causes the processor to:
send a second signal with the notification indicative of the phishing cyber-attack to a compute device of a user.
3. The apparatus of claim 1 , wherein the code to extract the first web element includes code to:
load a webpage referenced by the uniform resource locator; and
input an image of the webpage into the at least one convolutional neural network.
4. The apparatus of claim 1 , wherein the code to extract the first web element includes code to:
input the uniform resource locator to the uniform resource locator filter, the uniform resource locator filter includes at least one of a blacklist filter, a whitelist filter, or a signature filter; and
extract the first web element when the uniform resource locator filter classifies the uniform resource locator as unknown.
5. The apparatus of claim 1 , wherein the code to generate via the at least one convolutional neural network the second set of features includes code to:
extract from the first web element an image of at least one of a logo, a logotype, or a logomark; and
input the image of the at least one of a logo, a logotype, or a logomark into the at least one convolutional neural network.
6. The apparatus of claim 1 , wherein the at least one convolutional neural network includes a first convolutional neural network trained to identify a phishing cyber-attack based on a webpage image and a second convolutional neural network trained to identify a phishing cyber-attack based on at least one image of a logo, a logotype and a logomark.
7. The apparatus of claim 1 , wherein the signal indicative of the uniform resource locator is an email message.
8. A non-transitory computer-readable medium comprising code which, when executed by a processor, cause the processor to:
collect a dataset with images associated with a set of uniform resource locators;
produce a set of image clusters based on a content-based image retrieval process and the dataset, each image cluster from the set of image clusters including a subset of the images grouped together based on similarities of at least one feature included in the subset of the images;
train a first convolutional neural network with a training set that includes at least one image cluster associated with a phishing cyber-attack and at least one image cluster associated with trusted sources, the at least one image cluster associated with the phishing cyber-attack and the at least one image cluster associated with the trusted sources selected from the set of image clusters;
extract, via the first convolutional neural network, a set of features associated with the phishing cyber-attack; and
train a second convolutional neural network based on the set of features associated with the phishing cyber-attack such that the second convolutional neural network is configured to predict when an image associated with a uniform resource locator not included in the training set is associated with the phishing cyber-attack.
9. The non-transitory computer-readable medium of claim 8 wherein the code includes code to further cause the processor to:
execute an optical character recognition process to label each image cluster from the set of image clusters.
10. The non-transitory computer-readable medium of claim 8 wherein the uniform resource locator is a first uniform resource locator and the code includes code to further cause the processor to:
receive a signal indicative of a second uniform resource locator not included in the training set;
produce at least one image associated with the second uniform resource locator; and
send a signal with a notification indicative of the phishing cyber-attack to a compute device of a user when the second convolutional neural network predicts that the at least one image associated with the second uniform resource locator is associated with the phishing cyber-attack.
11. The non-transitory computer-readable medium of claim 8 wherein the image associated with the uniform resource locator is an image of a webpage referenced by the uniform resource locator.
12. The non-transitory computer-readable medium of claim 8 wherein the image associated with the uniform resource locator is an image of a logo, a logotype, or a logomark.
13. The non-transitory computer-readable medium of claim 8 wherein each uniform resource locator from the set of uniform resource locators is associated with the phishing cyber-attack.
14. A non-transitory computer-readable medium comprising code which, when executed by a processor, cause the processor to:
train a first convolutional neural network with a first dataset including a set of images that are not associated with a phishing cyber-attack;
remove a processing layer from the first convolutional neural network when the first convolutional neural network reaches a predetermined accuracy level;
extract, via the first convolutional neural network, a set of features from a second dataset including a set of image clusters associated with the phishing cyber-attack;
train, based on the extracted set of features, a second convolutional neural network to predict whether a received image is associated with the phishing cyber-attack; and
produce a notification signal indicative of the phishing cyber-attack when the second convolutional neural network predicts that the received image is associated with the phishing cyber-attack.
15. The non-transitory computer-readable medium of claim 14 wherein the phishing cyber-attack is a first phishing cyber-attack, the received image is a first received image, the notification signal is a first notification signal, and the code includes code to further cause the processor to:
produce a subsequent dataset via a content-based image retrieval process executed at periodic intervals of time and for each periodic interval of time:
extract, via the first convolutional neural network, a subsequent set of features from the subsequent dataset, the subsequent dataset includes a set of image clusters associated with a second phishing cyber-attack;
re-train, based on the subsequent set of features, the second convolutional neural network to predict whether a second received image is associated with the second phishing cyber-attack; and
produce a second notification signal indicative of the second phishing cyber-attack when the second convolutional neural network predicts that the second received image is associated with the second phishing cyber-attack.
16. The non-transitory computer-readable medium of claim 14 wherein the processing layer is a fully connected processing layer of the first convolutional neural network.
17. The non-transitory computer-readable medium of claim 14 wherein the received image is a website image.
18. The non-transitory computer-readable medium of claim 14 wherein the received image is an image of a logo, a logotype, or a logomark.
19. The non-transitory computer-readable medium of claim 14 wherein the received image is extracted from an email content.
20. The non-transitory computer-readable medium of claim 14 wherein the received image is extracted based on a uniform resource locator included in an email content.
21. A method, comprising:
receiving an input with a uniform resource locator;
producing an image of a webpage based on the uniform resource locator;
determining a first correlation between the uniform resource locator and a phishing cyber-attack based on the image of the webpage and an output of a first convolutional neural network;
determining a second correlation between the uniform resource locator and the phishing cyber-attack based on (1) an image of at least one of a logo, a logotype, or a logomark, and (2) the output of a second convolutional neural network when the first correlation does not indicate a positive correlation between the uniform resource locator and the phishing cyber-attack, the at least one of the logo, the logotype, or the logomark extracted from the image of the webpage; and
producing a notification indicative of the phishing cyber-attack when at least one of the first correlation and the second correlation indicates a positive correlation between the uniform resource locator and the phishing cyber-attack.
22. The apparatus of claim 1 , wherein:
the at least one convolutional neural network includes a first convolutional neural network trained to identify a phishing cyber-attack based on a webpage image, the webpage image generated based on the uniform resource locator; and
the at least one convolutional neural network includes a second convolutional neural network trained to identify a phishing cyber-attack based on at least one image of a logo, a logotype or a logomark, the at least one image of a logo, a logotype or a logomark extracted based on the webpage image.
23. The apparatus of claim 1 , wherein:
the first set of features is associated with a webpage image; and
the second set of features is associated with at least one of a logo, a logotype or a logomark.
24. A method, comprising:
receiving a dataset with images associated with a set of uniform resource locators;
generating a set of image clusters based on a content-based image retrieval process and the dataset, each image cluster from the set of image clusters including a subset of the images grouped together based on similarities of at least one feature included in the subset of the images;
train a first convolutional neural network with a training set that includes at least one image cluster associated with a phishing cyber-attack and at least one image cluster associated with trusted sources, the at least one image cluster associated with the phishing cyber-attack and the at least one image cluster associated with the trusted sources selected from the set of image clusters;
extract, via the first convolutional neural network, a set of features associated with the phishing cyber-attack; and
train a second convolutional neural network based on the set of features associated with the phishing cyber-attack such that the second convolutional neural network is configured to predict when an image associated with a uniform resource locator not included in the training set is associated with the phishing cyber-attack.