Technology for phishing awareness and phishing detection
The present disclosure is directed to training email users to enhance awareness of attempted spear phishing by attackers observing user actions to build a model of user susceptibilities using a trained LLM. A service in an intrusion prevention system can receive from one or more accounts linked to an enterprise and provide a message, along with a prompt to the LLM, stimulating the generation of one or more variants of the received messages that exhibit similar content characteristics. The LLM can produce a set of variant messages encompassing these content characteristics, purposefully including one or more phishing traits identified during training with the prelabeled dataset. These variant messages are then transmitted to the relevant accounts to assess interactions with the set. Based on the interactions observed across the accounts, an interaction score is generated to evaluate the efficacy of the user's training to avoid phishing attempts within the enterprise environment.
1 . A method comprising:
training an LLM with a prelabeled dataset of example phishing messages, the LLM being configured to identify one or more phishing messages based on the prelabeled dataset;
receiving messages from one or more accounts associated with an enterprise;
providing a message with a prompt to the LLM, the message prompting the LLM to create one or more variants of the received messages that includes similar content characteristics;
receiving from the LLM a set of variant messages including the content characteristics, the set of variant messages generated to include one or more phishing characteristics identified during training with the prelabeled dataset;
transmitting the set of variant messages to the accounts to identify one or more interactions with at least one of the set of variant messages; and
generating an interaction score based on the one or more interactions by the one or more accounts.
2 . The method of claim 1 , wherein training the LLM comprises:
providing to the LLM the prelabeled dataset of phishing messages;
sending a first request to the LLM to identify the one or more phishing messages in a first set of training messages;
receiving an output from the LLM identifying the one or more phishing messages in the first set of training messages as including phishing; and
providing a set of feedback to the LLM including an accuracy level of the output.
3 . The method of claim 1 , further comprising:
determining that the interaction score for a first account is above a predetermined threshold; and
identifying that the first account has received a satisfactory result based on the one or more interactions with the set of variant messages, the satisfactory result indicating that the first account has completed at least one category of phishing training.
4 . The method of claim 3 , wherein the satisfactory result indicates one or more of a completion of training for the first account or an additional category of phishing training to prompt the LLM to generate additional variants of the received messages related to the first account.
5 . The method of claim 1 , further comprising:
determining that the interaction score for a first account is below a predetermined threshold;
identifying that the first account has received a non-satisfactory result based on the one or more interactions with the set of variant messages, the non-satisfactory result indicating that the first account has not completed an assigned category of phishing training;
identifying at least one of the interactions related to the first account that interacted with a phishing message;
providing to the LLM a second request including a second prelabeled dataset of phishing examples related to the phishing message;
receiving a second output from the LLM identifying additional example emails based on the second prelabeled dataset; and
transmitting to the first account the additional example emails to retrain the first account.
6 . The method of claim 1 , wherein the prompt to the LLM further comprises:
prompting the LLM to create the one or more variants of the received messages that include content characteristics including variant hyperlinks, domain names, and homoglyphic characters, the variant messages being generated based on the prelabeled dataset and configured to mimic the content characteristics observed in known phishing messages and the received messages from the one or more accounts.
7 . The method of claim 1 , wherein the interaction score is generated by:
collecting the one or more interactions with the set of variant messages by the one or more accounts in a database;
analyzing the one or more interactions to identify patterns in the interactions associated with known vulnerabilities to phishing attempts; and
applying a score based on at least one user accounts susceptibility to the known vulnerabilities indicated by the one or more interactions.
8 . A network device comprising:
one or more memories having computer-readable instructions stored therein; and
one or more processors configured to execute the computer-readable instructions to:
train an LLM with a prelabeled dataset of example phishing messages, the LLM being configured to identify one or more phishing messages based on the prelabeled dataset;
receive messages from one or more accounts associated with an enterprise;
provide a message with a prompt to the LLM, the message prompting the LLM to create one or more variants of the received messages that includes similar content characteristics;
receive from the LLM a set of variant messages including the content characteristics, the set of variant messages generated to include one or more phishing characteristics identified during training with the prelabeled dataset;
transmit the set of variant messages to the accounts to identify one or more interactions with at least one of the set of variant messages; and
generate an interaction score based on the one or more interactions by the one or more accounts.
9 . The network device of claim 8 , wherein training the LLM comprises:
providing to the LLM the prelabeled dataset of phishing messages;
sending a first request to the LLM to identify the one or more phishing messages in a first set of training messages;
receiving an output from the LLM identifying the one or more phishing messages in the first set of training messages as including phishing; and
providing a set of feedback to the LLM including an accuracy level of the output.
10 . The network device of claim 8 , wherein the instructions further configure the network device to:
determine that the interaction score for a first account is above a predetermined threshold; and
identify that the first account has received a satisfactory result based on the one or more interactions with the set of variant messages, the satisfactory result indicating that the first account has completed at least one category of phishing training.
11 . The network device of claim 10 , wherein the satisfactory result indicates one or more of a completion of train for the first account or an additional category of phishing training to prompt the LLM to generate additional variants of the received messages related to the first account.
12 . The network device of claim 8 , wherein the instructions further configure the network device to:
determine that the interaction score for a first account is below a predetermined threshold;
identify that the first account has received a non-satisfactory result based on the one or more interactions with the set of variant messages, the non-satisfactory result indicating that the first account has not completed an assigned category of phishing training;
identify at least one of the interactions related to the first account that interacted with a phishing message;
provide to the LLM a second request including a second prelabeled dataset of phishing examples related to the phishing message;
receive a second output from the LLM identifying additional example emails based on the second prelabeled dataset; and
transmit to the first account the additional example emails to retrain the first account.
13 . The network device of claim 8 , wherein the prompt to the LLM further comprises:
prompt the LLM to create the one or more variants of the received messages that include content characteristics including variant hyperlinks, domain names, and homoglyphic characters, the variant messages being generated based on the prelabeled dataset and configured to mimic the content characteristics observed in known phishing messages and the received messages from the one or more accounts.
14 . The network device of claim 8 , wherein the interaction score is generated by:
collecting the one or more interactions with the set of variant messages by the one or more accounts in a database;
analyzing the one or more interactions to identify patterns in the interactions associated with known vulnerabilities to phishing attempts; and
applying a score based on at least one user accounts susceptibility to the known vulnerabilities indicated by the one or more interactions.
15 . A non-transitory computer-readable storage medium comprising computer-readable instructions, which when executed by one or more processors of a network appliance, cause the network appliance to:
train an LLM with a prelabeled dataset of example phishing messages, the LLM being configured to identify one or more phishing messages based on the prelabeled dataset;
receive messages from one or more accounts associated with an enterprise;
provide a message with a prompt to the LLM, the message prompting the LLM to create one or more variants of the received messages that includes similar content characteristics;
receive from the LLM a set of variant messages including the content characteristics, the set of variant messages generated to include one or more phishing characteristics identified during training with the prelabeled dataset;
transmit the set of variant messages to the accounts to identify one or more interactions with at least one of the set of variant messages; and
generate an interaction score based on the one or more interactions by the one or more accounts.
16 . The non-transitory computer-readable storage medium of claim 15 , wherein training the LLM comprises:
provide to the LLM the prelabeled dataset of phishing messages;
send a first request to the LLM to identify the one or more phishing messages in a first set of training messages;
receive an output from the LLM identifying the one or more phishing messages in the first set of training messages as including phishing; and
provide a set of feedback to the LLM including an accuracy level of the output.
17 . The non-transitory computer-readable storage medium of claim 15 , wherein the instructions further configure the network appliance to:
determine that the interaction score for a first account is above a predetermined threshold; and
identify that the first account has received a satisfactory result based on the one or more interactions with the set of variant messages, the satisfactory result indicating that the first account has completed at least one category of phishing training.
18 . The non-transitory computer-readable storage medium of claim 17 , wherein the satisfactory result indicates one or more of a completion of train for the first account or an additional category of phishing training to prompt the LLM to generate additional variants of the received messages related to the first account.
19 . The non-transitory computer-readable storage medium of claim 15 , wherein the instructions further configure the network appliance to:
determine that the interaction score for a first account is below a predetermined threshold;
identify that the first account has received a non-satisfactory result based on the one or more interactions with the set of variant messages, the non-satisfactory result indicating that the first account has not completed an assigned category of phishing training;
identify at least one of the interactions related to the first account that interacted with a phishing message;
provide to the LLM a second request including a second prelabeled dataset of phishing examples related to the phishing message;
receive a second output from the LLM identifying additional example emails based on the second prelabeled dataset; and
transmit to the first account the additional example emails to retrain the first account.
20 . The non-transitory computer-readable storage medium of claim 15 , wherein the prompt to the LLM further comprises:
prompting the LLM to create the one or more variants of the received messages that include content characteristics including variant hyperlinks, domain names, and homoglyphic characters, the variant messages being generated based on the prelabeled dataset and configured to mimic the content characteristics observed in known phishing messages and the received messages from the one or more accounts.