Patent Description:
Phishing refers to a form of illegal activity intended to force a victim to share sensitive information, such as a password or credit card number. Most often, fraudsters try to deceive a user into visiting a fake site and entering their details - login name, password, or a Personal Identification Number (PIN) or code.

In order to induce a victim into visiting a fake site, attackers may use bulk or individually addressed email messages that masquerade as messages sent by a work colleague, a bank employee, or a representative of a government agency. However, these messages contain a malicious link. The text included in the message instructs or requires the victim to click on the link and immediately perform certain actions in order to avoid threats or some kind of serious consequences. Another approach fraudsters employ involves using an attachment in the form of a file that also contains malicious links or exploits vulnerable applications to further compromise the user's computer.

When the victim clicks on the link, he/she is taken to a phishing site where an invitation is extended to the victim to "log into the system" using his/her account details. Some scammers go even further by asking the victim to send copies of documents or photos establishing their identity. If the victim is sufficiently trusting and agrees, then the data transferred from the victim is sent directly to the attackers - thereby enabling the scammers to use the transferred data to steal confidential information or money.

Fraud detection schemes may be used to order to mitigate against these types of phishing attacks. There are two main types of fraud detection schemes. The first type of fraud detection scheme relates to schemes that detect phishing based on analysis of the contents of target web pages, that is, analysis of the web pages to which the emails are the attached documents are linked. The second type of fraud detection scheme relates to schemes that work directly with the contents of the email messages. While these first and second fraud detection schemes handle the tasks of recognizing targeted mailings that mimic emails from trusted senders, neither type is able to recognize phishing messages from unknown senders. In addition, the identification of a phishing message based on the degree of similarity of domains may discredit a legitimate sender. Instead, it is necessary to take a multi-level approach to reduce the number of attacks and reduce falsely identified phishing messages.

Therefore, there is a need for a method and a system for improving information security while blocking phishing emails in order to improve the systems and method disclosed in prior art documents <CIT>, <CIT> and <CIT>.

The present invention relates to information security, more specifically, to systems and methods of identifying phishing emails. According to the present invention, the systems and methods block phishing email messages using a multi-level approach - thereby reducing the number of attacks while simultaneously reducing the number of emails falsely identified as phishing emails.

According to the invention, a method is provided for identifying phishing emails as claimed in appended claim <NUM>.

In one example, the method further comprises placing the suspicious email message into a temporary quarantine.

In one example, the first machine learning model is pre-trained on first attributes of email messages, the first attributes comprising at least attributes related to: a value of a Message_ID header of the email message; a value of an X-mail email header of the email message; and a sequence of values of headers of the email message.

In one example, the second machine learning model is pre-trained on second attributes of email messages, the second attributes comprising attributes related to at least one of: a reputation of a plurality of links which characterizes a probability that an email message contains a phishing link; a category of the email message; a flag indicating a presence of a domain of a sender in a previously created list of blocked senders; a flag indicating a presence of a domain of a sender in a previously created list of known senders; a degree of similarity of a domain of a sender with domains in a previously created list of known senders; a flag indicating a presence of an Hyper-Text Markup Language (HTML) code in a body of the email message; and a flag indicating a presence of a script inserted in a body of the email.

In one example, the reputation of the plurality of links is calculated using a recurrent neural network.

In one example, a category of the email message indicating whether or not the email message is a phishing message is based on N-grams of text of the email message, the N-grams being identified by selecting one or more important features that strongly influence a binary classification of the phishing email message.

In one example, a category of the email message indicating whether or not the email message is a phishing message is based on a logic regression algorithm with regularization, wherein the regularization allows weight coefficients to be determined for N-grams, the weight coefficient of a given N-gram characterizing a degree of influence of the N-gram on a classification of the email message as a phishing message.

In one example, the second machine learning model is based on at least one of the following learning algorithms: an algorithm based on a Bayesian classifier; a logistical regression algorithm; a modified random forest training algorithm; a support vector machine; an algorithm using nearest neighbor; and a decision tree based algorithm.

In one example, the taking of the action to provide information security against the identified phishing message comprises at least one of: blocking the phishing message; informing a recipient that the email message is a phishing message; and placing an identifier of phishing email in a database storing a list of malicious emails.

According to the invention, a system is provided for identifying phishing emails as claimed in appended claim <NUM>.

The method and system of the present disclosure are designed to provide information security, in a more optimal and effective manner, enabling legitimate emails to proceed towards the recipient while blocking phishing emails. Thus, in one example, the technical result of the present disclosure includes the identification of a phishing email messages. In another example, the technical result includes reducing the number of email messages falsely identified as phishing emails. In yet another example, the technical result comprises providing information security by blocking phishing email messages.

The accompanying drawings, which are incorporated into and constitute a part of this specification, illustrate one or more examples of the present invention and, together with the detailed description, serve to explain their principles and implementations thereof.

Examples of the invention are described herein in the context of a system, method, and a computer program for identifying phishing emails. Those of ordinary skill in the art will realize that the following description is illustrative only and is not intended to be in any way limiting. Other examples will readily suggest themselves to those skilled in the art having the benefit of the disclosure. Reference will now be made in detail to implementations of the example embodiments of the invention as illustrated in the accompanying drawings. The same reference indicators will be used to the extent possible throughout the drawings and the following description to refer to the same or like items.

<FIG> illustrates a block diagram of an exemplary system <NUM> for collecting and storing attributes of an email message. In one example, the block diagram of the example system for collecting and storing the attributes of an email message contains a communication network <NUM>, a user device <NUM>, an email message <NUM>, #<NUM> attributes <NUM>, an attribute identification agent <NUM>, a data storage device <NUM>, and machine learning model #<NUM> <NUM>.

The communication network <NUM> is a system of physical communication channels that implements an electronic message transfer protocol <NUM> between the terminal devices, as well as the transfer of #<NUM> attributes <NUM> to the data storage device <NUM>.

The email message <NUM> has a specific structure. It contains a body and headers - ancillary information about the route taken by the emails. For example, the headers provide information about when and where the email came from and by which route, as well as information added to the email by various utility programs (mail clients).

In one example, the #<NUM> attributes <NUM> include the values of the headers associated with routing information of the email <NUM>, and ancillary information generated by mail clients.

For example, the #<NUM> attributes <NUM> consist of at least:.

In one example, the user device <NUM> contains the mail client and the attribute identification agent <NUM>. Then, using the e-mail client, the user device <NUM> generates an email message <NUM> and sends it via the communication network <NUM>, and also receives an email message <NUM> from other devices.

In one example, the attribute identification agent <NUM> intercepts the email message <NUM> by at least one of:.

In one example, the attribute identification agent <NUM> identifies #<NUM> attributes <NUM> contained in the intercepted email message <NUM> and transfers them to the data storage device <NUM> via the communication network <NUM>.

In one example, the data storage device <NUM> is designed to collect, store, and process the #<NUM> attributes <NUM>. For example, the #<NUM> attributes <NUM> are used to train the machine learning model #<NUM> stored in database <NUM>.

The storage device <NUM> is a cloud storage device that handles the #<NUM> attributes <NUM> in the so-called cloud, where the cloud is a storage model that provides internet-based data storage by means of a cloud computing resource provider that provides and manages data storage as a service. For example, the data storage device <NUM> may be a tool containing the Kaspersky Security Network (KSN) system from the Kaspersky Lab company.

<FIG> illustrates a block diagram <NUM> of an exemplary system used to implement a method for identifying a phishing email message. In one example, the block diagram <NUM> of the system for identifying a phishing email contains an email message <NUM>, an attribute identification agent <NUM>, a data storage device <NUM>, #<NUM> attributes <NUM>, #<NUM> attributes <NUM>, a machine learning model #<NUM> stored in database <NUM>, an email filter <NUM>, a machine learning model #<NUM> stored in database <NUM>, and an information security provider <NUM>.

The attribute identification agent <NUM> is designed to intercept the email message <NUM>, identify the #<NUM> attributes <NUM>, the #<NUM> attributes <NUM>, and to transfer the #<NUM> attributes <NUM> to a data storage device <NUM>.

In one example, the #<NUM> attributes <NUM> consist of at least one of:.

The machine learning model #<NUM> stored in database <NUM> is designed to classify an email message <NUM> based on the #<NUM> attributes <NUM>. In one example, the machine learning model #<NUM> classifies the email message <NUM> as at least as one of:.

In one example, the machine learning model #<NUM> stored in database <NUM> has been pre-trained using the #<NUM> attributes <NUM> transferred to the data storage device <NUM>, such that the machine learning model #<NUM> stored in database <NUM> identifies, based on the specified attributes, the features with which an email message <NUM> is classified with a certain probability.

According to the invention, the machine learning model #<NUM> can be based on deep learning methods. In particular, the #<NUM> attributes <NUM> are represented as a matrix, where each symbol of a #<NUM> attribute <NUM> is encoded by a fixed-length vector of numbers, and is transformed using a neural network that calculates the degree of similarity of the specified attributes with the attributes of suspicious messages. The features are formed by the #<NUM> attributes <NUM> transformed by the neural network layer.

The email filter <NUM> is designed to place an email message <NUM>, which has been classified as suspicious by machine learning model #<NUM> stored in database <NUM>, into temporary quarantine.

In one example, the email filter <NUM> temporarily quarantines an email <NUM> that has a higher degree of similarity to a suspicious message than a predefined value (for example, <NUM>).

In one example, the machine learning model #<NUM> stored in database <NUM> is designed to classify a suspicious email message based on the #<NUM> attributes <NUM>. The machine learning model #<NUM> classifies a suspicious email message as at least one of:.

In one example, the attribute identification agent <NUM> calculates the reputation of the plurality of links using a recurrent neural network (RNN).

For example, the attribute identification agent <NUM> encodes the URL address string of the link as a matrix of numbers (in particular, encodes each symbol of the URL as a fixed-length vector), and then passes the encoded string to the recurred neural network. The network extracts structural and semantic features from the URL address, and then uses the activation function to calculate the degree of similarity of the extracted features to corresponding features of phishing URLs. As a result, the reputation of the link consists of the probability that the link URL address will be associated with phishing URLs.

In another example, the reputation of a plurality of links consists of a measure of the central trend of the reputations of a plurality of links.

In one example, the category of the email message for determining whether or not the email message is a phishing message is based on N-grams of text of the email message, the N-grams being identified by selecting the most important features that most strongly influence a binary classification of a phishing email message.

For example, in phishing email messages, the following trigrams are often encountered: "Account will be blocked", "you won money", "change password urgently", which appeal to the emotions of the recipient.

In another example, a phishing message is classified on the basis of a logistic regression algorithm with regularization. For example, the text of a message from a training sample is broken down into N-grams of a predetermined length. These N-grams are used as features for training the classification model of a phishing email message based on a logic regression algorithm with L1-regularization. The use of L1-regularization allows the weight coefficient of each N-gram to be determined, which characterizes the degree of influence of each N-gram on the classification result. N-grams with a weight coefficient greater than a predefined value (for example, greater than <NUM>) are used as the message category.

In one example, attributes of email messages belonging to a known class of messages (for example, phishing) are collected in advance. Based on the collected data, the classification machine learning model #<NUM> stored in database <NUM> is trained in such a way that messages with similar attributes can be classified by the aforementioned machine learning model with an accuracy greater than a specified value.

The classification algorithm consists of at least one of the following algorithms (or a combination of them):.

In one of the embodiments, the system additionally comprises an information security provider <NUM>, which is designed to ensure information security.

In one example, the providing of the information security includes at least:.

For example, the information security provider <NUM> is formed by the security application module supplied by Kaspersky Lab (for example, Kaspersky Internet Security).

<FIG> illustrates a method <NUM> for identifying a phishing email message. The method <NUM> comprises a step <NUM>, in which the email is identified as suspicious, a step <NUM>, in which an email identified as suspicious is placed in temporary quarantine, a step <NUM>, in which a phishing email is identified, and a step <NUM>, in which the information security is provided.

In step <NUM>, method <NUM> identifies an email message as a suspicious email message. The method <NUM> applies a machine learning model #<NUM> stored in the database <NUM> to identify emails as being suspicious email messages.

In optional step <NUM>, method <NUM> places an email message identified as a suspicious email message into a temporary quarantine. For example, the method <NUM> uses an email filter <NUM> to filter emails for placing to a temporary quarantine.

In step <NUM>, method <NUM> identifies the suspicious email message (as identified in step <NUM>) as a phishing message. For example, the method <NUM> applies a machine learning model #<NUM> stored in database <NUM> to determine whether or not the suspicious email message is a phishing message.

In step <NUM>, method <NUM> takes an action to provide information security against the identified phishing message. The action to provide information security is taken using the information security provider <NUM>.

<FIG> is a block diagram illustrating a computer system <NUM> on which systems and methods for identifying phishing emails may be implemented. The computer system <NUM> can be in the form of multiple computing devices, or in the form of a single computing device, for example, a desktop computer, a notebook computer, a laptop computer, a mobile computing device, a smart phone, a tablet computer, a server, a mainframe, an embedded device, and other forms of computing devices.

As shown, the computer system <NUM> includes a central processing unit (CPU) <NUM>, a system memory <NUM>, and a system bus <NUM> connecting the various system components, including the memory associated with the central processing unit <NUM>. The system bus <NUM> may comprise a bus memory or bus memory controller, a peripheral bus, and a local bus that is able to interact with any other bus architecture. Examples of the buses may include PCI, ISA, PCI-Express, HyperTransport™, InfiniBand™, Serial ATA, I<NUM>C, and other suitable interconnects. The central processing unit <NUM> (also referred to as a processor) can include a single or multiple sets of processors having single or multiple cores. The processor <NUM> may execute one or more computerexecutable code implementing the techniques of the present disclosure. The system memory <NUM> may be any memory for storing data used herein and/or computer programs that are executable by the processor <NUM>. The system memory <NUM> may include volatile memory such as a random access memory (RAM) <NUM> and non-volatile memory such as a read only memory (ROM) <NUM>, flash memory, etc., or any combination thereof. The basic input/output system (BIOS) <NUM> may store the basic procedures for transfer of information between elements of the computer system <NUM>, such as those at the time of loading the operating system with the use of the ROM <NUM>.

Embodiments of the present invention may be implemented as a system, a method, and/or a computer program product. The computer program product may include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out embodiments of the present invention.

Computer readable program instructions for carrying out operations of the present disclosure may be assembly instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language, and conventional procedural programming languages. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a LAN or WAN, or the connection may be made to an external computer (for example, through the Internet). In some examples, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform embodiments of the present disclosure.

In various examples, the systems and methods described in the present disclosure can be addressed in terms of modules. The term "module" as used herein refers to a real-world device, component, or arrangement of components implemented using hardware, such as by an application specific integrated circuit (ASIC) or FPGA, for example, or as a combination of hardware and software, such as by a microprocessor system and a set of instructions to implement the module's functionality, which (while being executed) transform the microprocessor system into a specialpurpose device. A module may also be implemented as a combination of the two, with certain functions facilitated by hardware alone, and other functions facilitated by a combination of hardware and software. In certain implementations, at least a portion, and in some cases, all, of a module may be executed on the processor of a computer system (such as the one described in greater detail in <FIG>, above). Accordingly, each module may be realized in a variety of suitable configurations, and should not be limited to any particular implementation exemplified herein.

In the interest of clarity, not all of the routine features of the invention are disclosed herein. It is understood that such a development effort might be complex and timeconsuming, but would nevertheless be a routine undertaking of engineering for those of ordinary skill in the art, having the benefit of this disclosure.

Furthermore, it is to be understood that the phraseology or terminology used herein is for the purpose of description and not of restriction, such that the terminology or phraseology of the present specification is to be interpreted by the skilled in the art in light of the teachings and guidance presented herein, in combination with the knowledge of those skilled in the relevant art(s). Moreover, it is not intended for any term in the specification or claims to be ascribed an uncommon or special meaning unless explicitly set forth as such.

Claim 1:
A method (<NUM>) for identifying a phishing email message, the method comprising:
identifying (<NUM>) an email message as a suspicious email message by applying a first machine learning model, wherein the first machine learning model is pre-trained on first attributes of email messages, wherein the first attributes are represented as a matrix, where each symbol of each of the first attribute is encoded by a fixed-length vector of numbers and is transformed using a neural network configured to calculate a degree of similarity of the first attributes with attributes of suspicious messages;
identifying (<NUM>) the suspicious email message as a phishing message by applying a second machine learning model; and
taking an action (<NUM>) to provide information security against the identified phishing message.