Phishing mail generator with adaptive complexity using generative adversarial network

Patent metadata

Field	Value
Publication number	US-12010142-B2
Application number	US-202117469009-A
Country	US
Kind code	B2
Filing date	Sep 8, 2021
Priority date	Sep 8, 2021
Publication date	Jun 11, 2024
Grant date	Jun 11, 2024

Abstract

A generative adversarial network and a reinforcement learning system are combined to generate phishing emails with adaptive complexity. A plurality of phishing emails are obtained from a trained generative adversarial neural network, including a generator neural network and a discriminator neural network. A subset of phishing emails is selected, from the plurality of phishing emails, using a reinforcement learning system trained on user-specific behavior. One or more of the subset of phishing emails are sent to a user email account associated with a particular user. The reinforcement learning system is then adjusted based on user action feedback to the one or more of the subset of phishing emails.

First claim

The invention claimed is:

1. A method for generating phishing electronic mail (email) with adaptive complexity, comprising:
obtaining a plurality of phishing emails from a trained generative adversarial neural network, the trained generative adversarial neural network including a generator neural network and a discriminator neural network;
selecting a subset of phishing emails, from the plurality of phishing emails, using a reinforcement learning system trained on user-specific behavior based on likelihood that a particular user will take action on one or more of the subset of phishing emails;
sending one or more of the subset of phishing emails to a user email account associated with the particular user; and
adjusting the reinforcement learning system to select one or more phishing emails that are likely to cause the particular user to take action, based on user action feedback to the one or more of the subset of phishing emails.

2. The method of claim 1 , wherein the reinforcement learning system is a bidirectional long short term memory (LSTM) recurrent neural network (RNN).

3. The method of claim 2 , wherein the reinforcement learning system has a retained memory of n previous time steps or phishing emails for the particular user.

4. The method of claim 2 , wherein at least each of the subset of phishing emails, the user-specific behavior, and the user action feedback are represented as a vector and a user state is defined based on a plurality of n previous phishing emails for the particular user.

5. The method of claim 2 , wherein the reinforcement learning system implements a Deep Deterministic Policy Gradient (DDPG) algorithm to train the reinforcement learning system.

6. The method of claim 2 , wherein the user-specific behavior includes at least one of:
(a) web browsing history for the particular user,
(b) past user behavior in identifying phishing, and
(c) phishing email features to which the particular user has been responsive in the past.

7. The method of claim 1 , wherein the trained generative adversarial neural network is trained using real phishing emails and generated phishing emails until the discriminator neural network is unable to identify a threshold percentage of the generated phishing emails as fake phishing emails.

8. The method of claim 1 , wherein the plurality of phishing emails are generated by the generator neural network after the generative adversarial neural network is trained.

9. The method of claim 1 , wherein the subset of phishing emails is selected based on the likelihood that the particular user will take action on one or more of the subset of phishing emails.

10. The method of claim 1 , wherein user action includes at least one of:
(a) selecting a link in one or more of the subset of phishing emails sent to the user email account,
(b) opening a file attached to the one or more of the subset of phishing emails sent to the user email account, and
(c) replying to one or more of the subset of phishing emails sent to the user email account.

11. The method of claim 1 , wherein the reinforcement learning system is configured to:
classify the user-specific behavior,
evaluate the likelihood that the particular user will select each of the plurality of phishing emails based on the classification of the user-specific behavior, and
select the subset of phishing emails based on the evaluation, where the subset of phishing emails is selected based on having the highest likelihood of triggering action by the particular user.

12. The method of claim 1 , further comprising:
notifying the particular user, when user action is taken in one or more of the subset of phishing emails, that it was a phishing email.

13. The method of claim 1 , wherein after adjusting the reinforcement learning system, the method further comprising:
selecting another subset of phishing emails, from the plurality of phishing emails, using the reinforcement learning system trained on user-specific behavior; and
sending one or more of the another subset of phishing emails to the user email account associated with the particular user.

14. The method of claim 1 , further comprising:
selecting another subset of phishing emails, from the plurality of phishing emails, using the reinforcement learning system trained on a different user-specific behavior;
sending one or more of the another subset of phishing emails to another user email account associated with another user; and
adjusting the reinforcement learning system based on user action feedback to the one or more of the another subset of phishing emails.

15. A non-transitory computer-readable storage medium having instructions thereon, wherein the instructions, when executed by a processing circuit, cause the processing circuit to:
obtain a plurality of phishing emails from a trained generative adversarial neural network, the trained generative adversarial neural network including a generator neural network and a discriminator neural network;
select a subset of phishing emails, from the plurality of phishing emails, using a reinforcement learning system trained on user-specific behavior based on likelihood that a particular user will take action on one or more of the subset of phishing emails;
send one or more of the subset of phishing emails to a user email account associated with the particular user; and
adjust the reinforcement learning system to select one or more phishing emails that are likely to cause the particular user to take action, based on user action feedback to the one or more of the subset of phishing emails.

16. The non-transitory computer-readable storage medium of claim 15 , wherein the reinforcement learning system is a bidirectional long short term memory (LSTM) recurrent neural network (RNN).

17. The non-transitory computer-readable storage medium of claim 15 , wherein the reinforcement learning system is configured to:
classify the user-specific behavior,
evaluate the likelihood that the particular user will select each of the plurality of phishing emails based on the classification of the user-specific behavior, and
select the subset of phishing emails based on the evaluation, where the subset of phishing emails is selected based on having the highest likelihood of triggering action by the particular user.

18. The non-transitory computer-readable storage medium of claim 15 , having further instructions thereon, which when executed by a processing circuit, cause the processing circuit to:
notify the particular user, when user action is taken in one or more of the subset of phishing emails, that it was a phishing email.

19. A server, comprising:
at least one processor;
a communication interface communicatively coupled to the at least one processor; and
a memory communicatively coupled to the at least one processor, wherein the at least one processor is configured to:
obtain a plurality of phishing emails from a trained generative adversarial neural network, the trained generative adversarial neural network including a generator neural network and a discriminator neural network;
select a subset of phishing emails, from the plurality of phishing emails, using a reinforcement learning system trained on user-specific behavior based on likelihood that a particular user will take action on one or more of the subset of phishing emails;
send one or more of the subset of phishing emails to a user email account associated with the particular user; and
adjust the reinforcement learning system to select one or more phishing emails that ar

Assignees

• Mastercard International Inc

Inventors

• Singh Alok
• Kumar Nitish
• Kayathwal Kanishka

Classifications

• G06N3/045

  Combinations of networks · CPC title

• G06N3/044

  Recurrent networks, e.g. Hopfield networks · CPC title

• G06N3/088

  Non-supervised learning, e.g. competitive learning · CPC title

• G06N3/092

  Reinforcement learning · CPC title

• G06N3/0442

  characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU] · CPC title