Systems and methods for detecting phishing emails using machine learning
The disclosure provides for systems and methods directed to classifying emails as phishing or non-phishing through the use of machine learning. Preprocessing operations may be performed on the email that include removal of punctuation and changing all letters to lower case. Additionally, recipient and sender email addresses and a subject line may be concatenated to the text of the email body, which is then tokenized and provided to a machine learning model. In some implementations, the machine learning model may be constructed with a multi-layer transformer encoder architecture that includes a plurality of transformer blocks. The result of the machine learning model may include a contextualized embedding sequence. A set of linear layers may reduce the dimensionality of a first vector of the contextualized embedding sequence and an activation function may be applied thereto to determine a classification predication.
1 . A computer-implemented method, comprising:
obtaining an email object to be classified as phishing or non-phishing;
generating a token sequence by tokenizing a text portion of the email object;
deploying a machine learning model with the token sequence as input to the machine learning model resulting in a contextualized embedding sequence, wherein the contextualized embedding sequence is formed of a plurality of contextualized embedding vectors;
reducing a dimension of a first contextualized embedding vector of the plurality of contextualized embedding vectors with a multi-layer transformer encoder including a plurality of linear layers resulting in a low-dimensionality vector, including a first linear layer configured to reduce the dimension of the first contextualized embedding vector from a first dimensionality to a second dimensionality, and a second linear layer configured to further reduce the dimension of the first contextualized embedding vector from the second dimensionality to a third dimensionality resulting in the low-dimensionality vector having two-dimensions;
applying an activation function to the low-dimensionality vector resulting in a classification prediction of phishing or non-phishing; and
responsive to the classification prediction being phishing indicating the email object is to be classified as phishing, causing one or more remediation or preventive efforts.
2 . The computer-implemented method of claim 1 , wherein the machine learning model is constructed with a multi-layer transformer encoder architecture comprising a plurality of transformer blocks.
3 . The computer-implemented method of claim 1 , wherein the first linear layer is configured to reduce the dimension of the first contextualized embedding vector from 768-dimensions to 512-dimensions, and wherein the second linear layer is configured to further reduce the dimension of the first contextualized embedding vector from 512-dimensions to 2-dimensions resulting in the low-dimensionality vector.
4 . The computer-implemented method of claim 1 , wherein the email object includes components of an email including a recipient email address, a sender email address, a subject line, and a text body.
5 . The computer-implemented method of claim 4 , wherein the email object further includes an attachment to the email.
6 . The computer-implemented method of claim 1 , further comprising:
extracting phishing-related features from the email object; and
prior to reducing the dimension of the first contextualized embedding vector, concatenating the phishing-related features to the first contextualized embedding vector.
7 . The computer-implemented method of claim 1 , wherein obtaining the email object includes executing a search query to retrieve the email object as one of a batch of email objects.
8 . A computing device, comprising:
a processor; and
a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to perform operations including:
obtaining an email object to be classified as phishing or non-phishing;
generating a token sequence by tokenizing a text portion of the email object;
deploying a machine learning model with the token sequence as input to the machine learning model resulting in a contextualized embedding sequence, wherein the contextualized embedding sequence is formed of a plurality of contextualized embedding vectors;
reducing a dimension of a first contextualized embedding vector of the plurality of contextualized embedding vectors with a multi-layer transformer encoder including a plurality of linear layers resulting in a low-dimensionality vector, including a first linear layer configured to reduce the dimension of the first contextualized embedding vector from a first dimensionality to a second dimensionality, and a second linear layer configured to further reduce the dimension of the first contextualized embedding vector from the second dimensionality to a third dimensionality resulting in the low-dimensionality vector having two-dimensions;
applying an activation function to the low-dimensionality vector resulting in a classification prediction of phishing or non-phishing; and
responsive to the classification prediction being phishing indicating the email object is to be classified as phishing, causing one or more remediation or preventive efforts.
9 . The computing device of claim 8 , wherein the machine learning model is constructed with a multi-layer transformer encoder architecture comprising a plurality of transformer blocks.
10 . The computing device of claim 8 , wherein the first linear layer is configured to reduce the dimension of the first contextualized embedding vector from 768-dimensions to 512-dimensions, and wherein the second linear layer is configured to further reduce the dimension of the first contextualized embedding vector from 512-dimensions to 2-dimensions resulting in the low-dimensionality vector.
11 . The computing device of claim 8 , wherein the email object includes components of an email including a recipient email address, a sender email address, a subject line, and a text body.
12 . The computing device of claim 11 , wherein the email object further includes an attachment to the email.
13 . The computing device of claim 8 , wherein the operations further include:
extracting phishing-related features from the email object; and
prior to reducing the dimension of the first contextualized embedding vector, concatenating the phishing-related features to the first contextualized embedding vector.
14 . The computing device of claim 8 , wherein obtaining the email object includes executing a search query to retrieve the email object as one of a batch of email objects.
15 . A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, cause the one or more processor to perform operations including:
obtaining an email object to be classified as phishing or non-phishing;
generating a token sequence by tokenizing a text portion of the email object;
deploying a machine learning model with the token sequence as input to the machine learning model resulting in a contextualized embedding sequence, wherein the contextualized embedding sequence is formed of a plurality of contextualized embedding vectors;
reducing a dimension of a first contextualized embedding vector of the plurality of contextualized embedding vectors with a multi-layer transformer encoder including a plurality of linear layers resulting in a low-dimensionality vector, including a first linear layer configured to reduce the dimension of the first contextualized embedding vector from a first dimensionality to a second dimensionality, and a second linear layer configured to further reduce the dimension of the first contextualized embedding vector from the second dimensionality to a third dimensionality resulting in the low-dimensionality vector having two-dimensions;
applying an activation function to the low-dimensionality vector resulting in a classification prediction of phishing or non-phishing; and
responsive to the classification prediction being phishing indicating the email object is to be classified as phishing, causing one or more remediation or preventive efforts.
16 . The non-transitory computer-readable medium of claim 15 , wherein the machine learning model is constructed with a multi-layer transformer encoder architecture comprising a plurality of transformer blocks.
17 . The non-transitory computer-readable medium of claim 15 , wherein the first linear layer is configured to reduce the dimension of the first contextualized embedding vector from 768-dimensions to 512-dimensions, and wherein the second linear layer is configured to further reduce the dimension of the first contextualized embedding vector from 512-dimensions to 2-dimensions resulting in the low-dimensionality vector.
18 . The non-transitory computer-readable medium of claim 15 , wherein an email object includes components of an email including a recipient email address, a sender email address, a subject line, a text body.
19 . The non-transitory computer-readable medium of claim 15 , wherein the operations further include:
extracting phishing-related features from the email object; and
prior to reducing the dimension of the first contextualized embedding vector, concatenating the phishing-related features to the first contextualized embedding vector.
20 . The non-transitory computer-readable medium of claim 15 , wherein obtaining the email object includes executing a search query to retrieve the email object as one of a batch of email objects.