Patent ID: 11924246
Assignee: PROOFPOINT, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 17:
18. A method, comprising:
at a computing platform comprising at least one processor, a communication interface, and memory:
identifying, by parsing a uniform resource locator (URL), one or more human-engineered features of a URL, wherein the one or more human-engineered features comprise one or more of: a protocol, a top level domain (TLD), a domain, a subdomain, a port, a port type, a path, or path components;
identifying one or more deep learned features of the URL;
concatenating the one or more human-engineered features of the URL to the one or more deep learned features of the URL, resulting in a concatenated vector representation;
computing, by inputting the concatenated vector representation of the URL to a URL classifier, a first phish classification score;
in response to determining that the first phish classification score is between a first phish classification threshold and a second phish classification threshold, causing image data for the URL to be sent to a visual similarity classification platform, configured to produce a computer vision vector representation of the image data and a corresponding second phish classification score; and
in response to determining that the second phish classification score exceeds the first phish classification threshold, causing a cybersecurity server to perform a first action.