SYSTEM AND METHOD FOR IDENTIFYING A PHISHING EMAIL

Disclosed herein are systems and methods for identifying a phishing email message. In one aspect, an exemplary method comprises, identifying an email message as a suspicious email message by applying a first machine learning model, identifying the suspicious email message as a phishing message by applying a second machine learning model, and taking an action to provide information security against the identified phishing message. In one aspect, the first machine learning model is pre-trained on first attributes comprising values of Message_ID header, X-mail headers, or sequences of values of headers. In one aspect, the second machine learning model is pre-trained on second attributes comprising attributes related to at least one of: reputation of links, categories of email messages, flag indicating domains of blocked or known senders, a degree of similarity of the domain with those of known senders, flags indicating HTML code or script in the body of the email.

FIELD OF TECHNOLOGY

The present disclosure relates to the field of information security, e.g., by blocking phishing email messages.

BACKGROUND

Phishing refers to a form of illegal activity intended to force a victim to share sensitive information, such as a password or credit card number. Most often, fraudsters try to deceive a user into visiting a fake site and entering their details - login name, password, or a Personal Identification Number (PIN) or code.

In order to induce a victim into visiting a fake site, attackers may use bulk or individually addressed email messages that masquerade as messages sent by a work colleague, a bank employee, or a representative of a government agency. However, these messages contain a malicious link. The text included in the message instructs or requires the victim to click on the link and immediately perform certain actions in order to avoid threats or some kind of serious consequences. Another approach fraudsters employ involves using an attachment in the form of a file that also contains malicious links or exploits vulnerable applications to further compromise the user’s computer.

When the victim clicks on the link, he/she is taken to a phishing site where an invitation is extended to the victim to “log into the system” using his/her account details. Some scammers go even further by asking the victim to send copies of documents or photos establishing their identity. If the victim is sufficiently trusting and agrees, then the data transferred from the victim is sent directly to the attackers - thereby enabling the scammers to use the transferred data to steal confidential information or money.

Fraud detection schemes may be used to order to mitigate against these types of phishing attacks. There are two main types of fraud detection schemes. The first type of fraud detection scheme relates to schemes that detect phishing based on analysis of the contents of target web pages, that is, analysis of the web pages to which the emails are the attached documents are linked. The second type of fraud detection scheme relates to schemes that work directly with the contents of the email messages. While these first and second fraud detection schemes handle the tasks of recognizing targeted mailings that mimic emails from trusted senders, neither type is able to recognize phishing messages from unknown senders. In addition, the identification of a phishing message based on the degree of similarity of domains may discredit a legitimate sender. Instead, it is necessary to take a multi-level approach to reduce the number of attacks and reduce falsely identified phishing messages.

Therefore, there is a need for a method and a system for improving information security while blocking phishing emails.

SUMMARY

Aspects of the disclosure relate to information security, more specifically, to systems and methods of identifying phishing emails. For example, the method of the present disclosure is designed to block phishing email messages using a multi-level approach - thereby reducing the number of attacks while simultaneously reducing the number of emails falsely identified as phishing emails.

In one exemplary aspect, a method is provided for identifying phishing emails, the method comprising: identifying an email message as a suspicious email message by applying a first machine learning model, identifying the suspicious email message as a phishing message by applying a second machine learning model, and taking an action to provide information security against the identified phishing message.

In one aspect, the method further comprises placing the suspicious email message into a temporary quarantine.

In one aspect, the first machine learning model is pre-trained on first attributes of email messages, the first attributes comprising at least attributes related to: a value of a Message_ID header of the email message; a value of an X-mail email header of the email message; and a sequence of values of headers of the email message.

In one aspect, the second machine learning model is pre-trained on second attributes of email messages, the second attributes comprising attributes related to at least one of: a reputation of a plurality of links which characterizes a probability that an email message contains a phishing link; a category of the email message; a flag indicating a presence of a domain of a sender in a previously created list of blocked senders; a flag indicating a presence of a domain of a sender in a previously created list of known senders; a degree of similarity of a domain of a sender with domains in a previously created list of known senders; a flag indicating a presence of an Hyper-Text Markup Language (HTML) code in a body of the email message; and a flag indicating a presence of a script inserted in a body of the email.

In one aspect, the reputation of the plurality of links is calculated using a recurrent neural network.

In one aspect, a category of the email message indicating whether or not the email message is a phishing message is based on N-grams of text of the email message, the N-grams being identified by selecting one or more important features that strongly influence a binary classification of the phishing email message.

In one aspect, a category of the email message indicating whether or not the email message is a phishing message is based on a logic regression algorithm with regularization, wherein the regularization allows weight coefficients to be determined for N-grams, the weight coefficient of a given N-gram characterizing a degree of influence of the N-gram on a classification of the email message as a phishing message.

In one aspect, the second machine learning model is based on at least one of the following learning algorithms: an algorithm based on a Bayesian classifier; a logistical regression algorithm; a modified random forest training algorithm; a support vector machine; an algorithm using nearest neighbor; and a decision tree based algorithm.

In one aspect, the taking of the action to provide information security against the identified phishing message comprises at least one of: blocking the phishing message; informing a recipient that the email message is a phishing message; and placing an identifier of phishing email in a database storing a list of malicious emails.

According to one aspect of the disclosure, a system is provided for identifying phishing emails, the system comprising a hardware processor configured to: identify an email message as a suspicious email message by applying a first machine learning model, identify the suspicious email message as a phishing message by applying a second machine learning model, and take an action to provide information security against the identified phishing message.

In one exemplary aspect, a non-transitory computer-readable medium is provided storing a set of instructions thereon for identifying phishing emails, wherein the set of instructions comprises instructions for: identifying an email message as a suspicious email message by applying a first machine learning model, identifying the suspicious email message as a phishing message by applying a second machine learning model, and taking an action to provide information security against the identified phishing message.

The method and system of the present disclosure are designed to provide information security, in a more optimal and effective manner, enabling legitimate emails to proceed towards the recipient while blocking phishing emails. Thus, in one aspect, the technical result of the present disclosure includes the identification of a phishing email messages. In another aspect, the technical result includes reducing the number of email messages falsely identified as phishing emails. In yet another aspect, the technical result comprises providing information security by blocking phishing email messages.

DETAILED DESCRIPTION

Exemplary aspects are described herein in the context of a system, method, and a computer program for identifying phishing emails in accordance with aspects of the present disclosure. Those of ordinary skill in the art will realize that the following description is illustrative only and is not intended to be in any way limiting. Other aspects will readily suggest themselves to those skilled in the art having the benefit of the disclosure. Reference will now be made in detail to implementations of the example aspects as illustrated in the accompanying drawings. The same reference indicators will be used to the extent possible throughout the drawings and the following description to refer to the same or like items.

FIG.1illustrates a block diagram of an exemplary system100for collecting and storing attributes of an email message in accordance with aspects of the present disclosure. In one aspect, the block diagram of the example system for collecting and storing the attributes of an email message contains a communication network101, a user device110, an email message111, #1 attributes140, an attribute identification agent120, a data storage device130, and machine learning model #1150.

The communication network101is a system of physical communication channels that implements an electronic message transfer protocol111between the terminal devices, as well as the transfer of #1 attributes140to the data storage device130.

The email message111has a specific structure. It contains a body and headers -ancillary information about the route taken by the emails. For example, the headers provide information about when and where the email came from and by which route, as well as information added to the email by various utility programs (mail clients).

In one aspect, the #1 attributes140include the values of the headers associated with routing information of the email111, and ancillary information generated by mail clients

For example, the #1 attributes140consist of at least:Message_ID: a unique identifier of the email message111, which is assigned by the first mail server that the message meets along its path;X-mailer (mailer_name): the value of the header field in which the email client or service that was used to create the email message111identifies itself; andthe sequence of values of the headers of the email message111.

In one aspect, the user device110contains the mail client and the attribute identification agent120. Then, using the e-mail client, the user device110generates an email message111and sends it via the communication network101, and also receives an email message111from other devices.

In one aspect, the attribute identification agent120intercepts the email message111by at least one of:tracking the traffic received and transmitted via mail protocols (POP3, SMTP, IMAP, NNTP);tracking files in the mail server repositories; andtracking files in the mail client repositories.

In one aspect, the attribute identification agent120identifies #1 attributes140contained in the intercepted email message111and transfers them to the data storage device130via the communication network101.

In one aspect, the data storage device130is designed to collect, store, and process the #1 attributes140. For example, the #1 attributes140are used to train the machine learning model #1 stored in database150.

The storage device130is a cloud storage device that handles the #1 attributes140in the so-called cloud, where the cloud is a storage model that provides internet-based data storage by means of a cloud computing resource provider that provides and manages data storage as a service. For example, the data storage device130may be a tool containing the Kaspersky Security Network (KSN) system from the Kaspersky Lab company.

FIG.2illustrates a block diagram200of an exemplary system used to implement a method for identifying a phishing email message in accordance with aspects of the present disclosure. In one aspect, the block diagram200of the system for identifying a phishing email contains an email message111, an attribute identification agent120, a data storage device130, #1 attributes140, #2 attributes201, a machine learning model #1 stored in database150, an email filter220, a machine learning model #2 stored in database230, and an information security provider240.

The attribute identification agent120is designed to intercept the email message111, identify the #1 attributes140, the #2 attributes201, and to transfer the #1 attributes140to a data storage device130.

In one aspect, the #1 attributes140consist of at least one of:a value of a Message_ID header of the email message111;a value of an X-mailer (mailer_name) header of the email message111; anda sequence of values of headers of the email message111.

The machine learning model #1 stored in database150is designed to classify an email message111based on the #1 attributes140. In one aspect, the machine learning model #1 classifies the email message111as at least as one of:suspicious (e.g., containing spam, a malicious attachment, or a phishing link); andgenuine.

In one aspect, the machine learning model #1 stored in database150has been pre-trained using the #1 attributes140transferred to the data storage device130, such that the machine learning model #1 stored in database150identifies, based on the specified attributes, the features with which an email message111is classified with a certain probability.

In one aspect, the machine learning model #1 can be based on deep learning methods. In particular, the #1 attributes140are represented as a matrix, where each symbol of a #1 attribute140is encoded by a fixed-length vector of numbers, and is transformed using a neural network that calculates the degree of similarity of the specified attributes with the attributes of suspicious messages. The features are formed by the #1 attributes140transformed by the neural network layer.

The email filter220is designed to place an email message111, which has been classified as suspicious by machine learning model #1 stored in database150, into temporary quarantine.

In one aspect, the email filter220temporarily quarantines an email111that has a higher degree of similarity to a suspicious message than a predefined value (for example, 0.7).

In one aspect, the machine learning model #2 stored in database230is designed to classify a suspicious email message based on the #2 attributes201. The machine learning model #2 classifies a suspicious email message as at least one of:a phishing email; andan unknown email.

In one aspect, the #2 attributes201consist of at least one of:a reputation of a plurality of links which characterizes a probability that an email message contains a phishing link;a category of the email message;a flag indicating a presence of a domain of a sender in a previously created list of blocked senders;a flag indicating a presence of a domain of a sender in a previously created list of known senders;a degree of similarity of a domain of a sender with domains in a previously created list of known senders;a flag indicating a presence of an Hyper-Text Markup Language (HTML) code in a body of the email message; anda flag indicating a presence of a script inserted in a body of the email.

In one aspect, the attribute identification agent120calculates the reputation of the plurality of links using a recurrent neural network (RNN).

For example, the attribute identification agent120encodes the URL address string of the link as a matrix of numbers (in particular, encodes each symbol of the URL as a fixed-length vector), and then passes the encoded string to the recurred neural network. The network extracts structural and semantic features from the URL address, and then uses the activation function to calculate the degree of similarity of the extracted features to corresponding features of phishing URLs. As a result, the reputation of the link consists of the probability that the link URL address will be associated with phishing URLs.

In another aspect, the reputation of a plurality of links consists of a measure of the central trend of the reputations of a plurality of links.

In one aspect, the category of the email message for determining whether or not the email message is a phishing message is based on N-grams of text of the email message, the N-grams being identified by selecting the most important features that most strongly influence a binary classification of a phishing email message.

For example, in phishing email messages, the following trigrams are often encountered: “Account will be blocked”, “you won money”, “change password urgently”, which appeal to the emotions of the recipient.

In another aspect, a phishing message is classified on the basis of a logistic regression algorithm with regularization. For example, the text of a message from a training sample is broken down into N-grams of a predetermined length. These N-grams are used as features for training the classification model of a phishing email message based on a logic regression algorithm with L1-regularization. The use of L1-regularization allows the weight coefficient of each N-gram to be determined, which characterizes the degree of influence of each N-gram on the classification result. N-grams with a weight coefficient greater than a predefined value (for example, greater than 0) are used as the message category.

In one aspect, attributes of email messages belonging to a known class of messages (for example, phishing) are collected in advance. Based on the collected data, the classification machine learning model #2 stored in database230is trained in such a way that messages with similar attributes can be classified by the aforementioned machine learning model with an accuracy greater than a specified value.

The classification algorithm consists of at least one of the following algorithms (or a combination of them):Bayesian classifiers (naive Bayesian classifiers);logistical regression;MRF classifier;support vector machine (SVM);methods based on nearest neighbors (k-nearest neighbor); anddecision tree.

In one of the embodiments, the system additionally comprises an information security provider240, which is designed to ensure information security.

In one aspect, the providing of the information security includes at least:blocking a phishing email message;informing the recipient of the phishing nature of the email message; andplacing an identifier of the phishing email in a database of malicious email messages.

For example, the information security provider240is formed by the security application module supplied by Kaspersky Lab (for example, Kaspersky Internet Security).

FIG.3illustrates a method300for identifying a phishing email message in accordance with aspects of the present disclosure. The method300comprises a step310, in which the email is identified as suspicious, a step320, in which an email identified as suspicious is placed in temporary quarantine, a step330, in which a phishing email is identified, and a step340, in which the information security is provided.

In step310, method300identifies an email message as a suspicious email message. The method300applies a machine learning model #1 stored in the database150to identify emails as being suspicious email messages.

In optional step320, method300places an email message identified as a suspicious email message into a temporary quarantine. For example, the method300uses an email filter220to filter emails for placing to a temporary quarantine.

In step330, method300identifies the suspicious email message (as identified in step310) as a phishing message. For example, the method300applies a machine learning model #2 stored in database230to determine whether or not the suspicious email message is a phishing message.

In step340, method300takes an action to provide information security against the identified phishing message. The action to provide information security is taken using the information security provider240.

FIG.4is a block diagram illustrating a computer system20on which aspects of systems and methods for identifying phishing emails may be implemented. The computer system20can be in the form of multiple computing devices, or in the form of a single computing device, for example, a desktop computer, a notebook computer, a laptop computer, a mobile computing device, a smart phone, a tablet computer, a server, a mainframe, an embedded device, and other forms of computing devices.