US 12,192,235 B2
Machine learning uniform resource locator (URL) classifier
Steve Rozzo, San Francisco, CA (US); and Sarah Solieman, San Francisco, CA (US)
Assigned to Proofpoint, Inc., Sunnyvale, CA (US)
Filed by Proofpoint, Inc., Sunnyvale, CA (US)
Filed on Apr. 4, 2022, as Appl. No. 17/712,675.
Prior Publication US 2023/0319106 A1, Oct. 5, 2023
Int. Cl. H04L 9/40 (2022.01); G06F 16/951 (2019.01); G06F 16/955 (2019.01); G06F 18/2431 (2023.01); G06N 20/00 (2019.01)
CPC H04L 63/1483 (2013.01) [G06F 16/951 (2019.01); G06F 16/955 (2019.01); G06F 18/2431 (2023.01); G06N 20/00 (2019.01)] 20 Claims
OG exemplary drawing
 
1. A computing platform comprising:
at least one processor;
a communication interface communicatively coupled to the at least one processor; and
memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
receive, from an enterprise user device, a request to evaluate a uniform resource locator (URL);
execute one or more feature enrichment actions on the URL to identify one or more data points corresponding to the URL, wherein executing the one or more feature enrichment actions on the URL comprises crawling the URL to extract metadata for the URL and extracting information corresponding to one or more redirects of the URL, wherein the information comprises a number of URLs accessed before a crawl reaches a final URL;
input, into a URL classification model, the one or more data points corresponding to the URL and the extracted information, wherein inputting the one or more data points corresponding to the URL and the extracted information causes the URL classification model to output a maliciousness score indicative of a degree to which the URL is malicious; and
send, to the enterprise user device, a malicious score notification and one or more commands directing the enterprise user device to display the malicious score notification, wherein sending the one or more commands directing the enterprise user device to display the malicious score notification causes the enterprise user device to display the malicious score notification.