Abstract: The disclosure provides a computerized method including operations of obtaining training data comprising sample webpage images, wherein at least a portion of the sample webpage images include login screen components, training an autoencoder on the training data comprising the sample webpage images by iteratively performing a set of operations for each of the sample webpage images including, providing a first sample webpage image to the encoder resulting in a first sample latent representation, decoding the first sample latent representation by the decoder thereby producing a reconstructed version of a sample login component of the first sample webpage image, and comparing the reconstructed version of the sample login component of the first sample webpage image with an original version of the sample login component of the first sample webpage image resulting in computation of a loss.

Abstract: One implementation is directed to a phishing detection methodology including operations of obtaining an image of a candidate phishing webpage having a login screen component, where encoder is deployed on the image resulting in the generation of a latent representation corresponding to the login screen component. The login screen component may then be classified as one of a defined set of classes by deploying a machine learning model taking the latent representation as input. Further, an additional operation may include obtaining allow/deny lists of account authentication providers for the domain of the URL of the candidate phishing webpage. Finally, a determination may be made as to whether the candidate phishing webpage is a phishing webpage when the login class assigned by the classifying machine learning model does not appear on the allow list.

Abstract: Some implementations of the disclosure provided a method including operations of obtaining a data set, performing feature extraction operations resulting to extract features according to the first time window, performing aggregation operations for each feature of the extracted features with historical features resulting in a set of aggregated features, performing feature engineering on the aggregated features on a per entity basis resulting in generation of set of feature vectors, performing an anomaly detection process on the set of feature vectors including providing the set of feature vectors as input to a machine learning model resulting in generation of a label for each feature vector of the set of features, and performing a remedial action determination process including performing a threshold comparison with each label and, responsive to satisfaction of the threshold comparison by a first label, causing performance of one or more remedial actions.

Abstract: Methods and devices are disclosed herein to facilitate the detection of Domain Name System (DNS) exfiltration attacks. In some examples, a DNS request is used to generate a tokenized vector that corresponds to the DNS request, features of the DNS request, and aggregated features calculated over a sliding window representative of a recent history of events between a particular source and domain. The tokenized vector is input into a neural network to generate a probability score indicating a likelihood that the current DNS request corresponds to a DNS exfiltration. A graphical user interface is generated to display an indication of the probability score for the current DNS request.

Abstract: Disclosed herein is a machine learning-based approach to detect suspiciously named processes. When malware executes on a networking device, such as a laptop or desktop computer, the malware may create a copy of itself, assign the copy a process name consisting of random characters, and store the copy in a directory of the networking device. As characters of words in a given language follow patterns and rules, the presence of each character is not equally likely. In contrast, characters in random sequences have an equal likelihood of being present. In some implementations disclosed herein, a character-level recurrent neural network (RNN) is trained to distinguish between randomly generated filenames from those created by an user and thus, identify malware attacks. In some implementations, a character-level RNN is configured to classify filenames as malicious or benign.

Abstract: A computer-implemented method for detecting malicious content is disclosed that includes operations of receiving a character set as an input, where the character set represents a domain name, generating a deep machine learning output by analyzing the character set with a first plurality of layers arranged in a deep machine learning architecture, generating a wide machine learning output by analyzing the character set with a second plurality of layers arranged in a wide machine learning architecture, and jointly processing the deep machine learning output and the wide machine learning output resulting in a comparison score that is indicative of a probability that the character set was generated by a domain generation algorithm (DGA).

Abstract: One implementation is directed to a phishing detection methodology including operations of obtaining an image of a candidate phishing webpage having a login screen component, where encoder is deployed on the image resulting in the generation of a latent representation corresponding to the login screen component. The login screen component may then be classified as one of a defined set of classes by deploying a machine learning model taking the latent representation as input. Further, an additional operation may include obtaining allow/deny lists of account authentication providers for the domain of the URL of the candidate phishing webpage. Finally, a determination may be made as to whether the candidate phishing webpage is a phishing webpage when the login class assigned by the classifying machine learning model does not appear on the allow list.

Abstract: Disclosed herein is a machine learning-based approach to detect suspiciously named processes. When malware executes on a networking device, such as a laptop or desktop computer, the malware may create a copy of itself, assign the copy a process name consisting of random characters, and store the copy in a directory of the networking device. As characters of words in a given language follow patterns and rules, the presence of each character is not equally likely. In contrast, characters in random sequences have an equal likelihood of being present. In some implementations disclosed herein, a character-level recurrent neural network (RNN) is trained to distinguish between randomly generated filenames from those created by an user and thus, identify malware attacks. In some implementations, a character-level RNN is configured to classify filenames as malicious or benign.

Abstract: A computer-implemented method for detecting malicious content is disclosed that includes operations of: receiving a character set as an input, converting the input into an integer array containing indexes of each character, and creating an input vector from the integer array, the input vector being a dense numerical representation of the character set. The input vector is passed to a machine learning model to generate a plurality of features based on the character set, the plurality of features comprising at least two of: a length of the character set, a Shannon Entropy of the character set, n-gram similarity score of the character set with English dictionary words, n-gram similarity score of the character set with a set of legitimate domains, and an online web traffic ranking service. A dense input vector is formed by concatenating the plurality of features to the input vector, and then processed to obtain a comparison score.

Abstract: A method for performing federated learning includes initializing, by a server, a global model G0. The server shares G0 with a plurality of participants (N) using a secure communications channel. The server selects n out of N participants, according to filtering criteria, to contribute training for a round r. The server partitions the selected participants n into s groups and informs each participant about the other participants belonging to the same group. The server obtains aggregated group updates AU1, . . . , AUg from each group and compares the aggregated group updates and identifies suspicious aggregated group updates. The server combines the aggregated group updates by excluding the updates identified as suspicious, to obtain an aggregated update Ufinal. The server derives a new global model Gr from the previous model Gr-1 and the aggregated update Ufinal and shares Gr with the plurality of participants.

Abstract: A system for machine learning that is configured to receive an input having a plurality of features and predict one or more attributes of the input. The system includes a security mechanism, which determines an initial value for each of the features; determines a perturbation value for each of the features, the perturbation being randomly selected; adds the perturbation value to the initial value to determine a perturbed value for each of the features; and quantizes the perturbation value for each of the features to determine a quantized value for each of the features. The system also includes a classifier that receives the quantized value for each of the features and predict the one or more attributes of the input based on the quantized value for each of the features.

Abstract: A method for performing federated learning includes initializing, by a server, a global model G0. The server shares G0 with a plurality of participants (N) using a secure communications channel. The server selects n out of N participants, according to filtering criteria, to contribute training for a round r. The server partitions the selected participants n into s groups and informs each participant about the other participants belonging to the same group. The server obtains aggregated group updates AU1, . . . , AUg from each group and compares the aggregated group updates and identifies suspicious aggregated group updates. The server combines the aggregated group updates by excluding the updates identified as suspicious, to obtain an aggregated update Ufinal. The server derives a new global model Gr from the previous model Gr-1 and the aggregated update Ufinal and shares Gr with the plurality of participants.

Abstract: A system for machine learning that is configured to receive an input having a plurality of features and predict one or more attributes of the input. The system includes a security mechanism, which determines an initial value for each of the features; determines a perturbation value for each of the features, the perturbation being randomly selected; adds the perturbation value to the initial value to determine a perturbed value for each of the features; and quantizes the perturbation value for each of the features to determine a quantized value for each of the features. The system also includes a classifier that receives the quantized value for each of the features and predict the one or more attributes of the input based on the quantized value for each of the features.