Exploring The Integration of Artificial Intelligence and Cybersecurity with PhishText.Ai

It’s no secret that Artificial Intelligence and Large Language Models are dominating the technology industry in 2023. After years of speculation and predictions, ChatGPT burst onto the scene in November last year and quickly became an overnight sensation.

This explosion in AI adoption and the seemingly endless possibilities inspired me to start building programs that could integrate with ChatGPT or other AI technologies myself. After experimenting with some personal projects and getting a feel for how AI worked, I started to think about ways this technology could be applied in cybersecurity. I wanted to build a tool that could help raise the level of security for everyday individuals, while making it simple to use and understand.

It was around this time that a huge SMS phishing campaign was reported in New Zealand, with victims losing upwards of $10,000 in an unpaid fines scam. This got me thinking about how AI could be used to quickly and accurately analyse phishing SMS messages, which lead to the development of my first AI powered cybersecurity tool PhishText.Ai.

PhishText.AI – SMS Phishing Analysis using OpenAI, VirusTotal and UrlScan.io

PhishText.Ai is a tool built in Python that aims to identify potential phishing attempts in SMS messages. It uses a combination of AI language evaluation and web security checks to evaluate the contents and URLs in a SMS message to determine if the SMS is a phishing attempt.

PhishText.Ai uses two main steps to perform analysis of SMS messages:

1. URL Check: The tool first looks for any URLs in the SMS message submitted. If a URL is found, it is extracted and analysed using the VirusTotal and UrlScan.io API’s, which can provide various indicators to help determine if the URL is unsafe.
2. Text Analysis: The tool uses the ChatGPT API from OpenAI to analyse the overall text of the SMS and the analysis output from VirusTotal. ChatGPT will then provide a final analysis on whether the SMS could be a phishing attempt.

PhishText.Ai currently operates via the Command Line Interface, where the program is run with the contents of a SMS message pasted in as an argument, the final output of the program is the response from ChatGPT which will provide the result of the entire analysis. For example, current input looks like:

python .\phishtextai.py "NZTA-Your tolls are not yet paid and are about to be overdue.please click to view and pay: https://web.nz-t.cyou"

And the resulting output is as follows:

Based on the given SMS message and the VirusTotal analysis, it is highly likely that this is a phishing attempt.

The SMS message is designed to create a sense of urgency and fear by indicating that the recipient's tolls are about to be overdue. It requests the recipient to click on a link to view and pay their tolls. However, the link provided in the message directs to a suspicious domain "https://web.nz-t.cyou" which is not a legitimate domain for the New Zealand Transport Agency (NZTA).

The VirusTotal analysis also indicates that the URL has been submitted eight times and flagged as "malicious" and "phishing and fraud" by Sophos and "Phishing and Other Frauds" by Webroot. The URL has also been categorized as a "newly registered website" by Forcepoint ThreatSeeker and as "Suspicious" by alphaMountain.ai.

Therefore, it is highly recommended not to click on the link provided in the message and to delete it immediately to avoid any potential phishing attacks or scams. It is always safer to directly visit the legitimate website or call the official customer support number to inquire about the status of your tolls.

A screenshot example of PhisText.Ai is as follows:

Because ChatGPT is context aware and can analyse submitted data, the VirusTotal output can be included in the prompt sent to ChatGPT to provide extra information on the SMS being analysed. This allows ChatGPT to perform analysis on the language used in the SMS and the artefacts provided by VirusTotal to make a judgement call on whether the SMS should be treated as phishing. ChatGPT is even able to provide some recommendations for next steps and safeguarding techniques when dealing with phishing SMS messages.

The current interface using the command line provides flexibility and makes it easy to develop and integrate with other systems, but is not a particularly user-friendly option. For future releases I intend to build PhishText.Ai into a web application compatible with mobile and desktop devices for an improved end user experience.

PhishText.Ai is open source and available on GitHub: github.com/DCKento/PhishText.Ai

How PhishText.Ai Works – Implementation Details

URL Extraction

When a SMS message is first submitted to PhishText.Ai, any URL contained is identified and extracted using regex that is based on the assumption that URL’s start with http or https as the primary indicator. This allows for the URL specifically to be analysed using the VirusTotal API integration.

The current regex implementation is as follows:

re.findall('http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\\(\\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+')

VirusTotal Integration and Analysis

PhishText.Ai then takes the extracted URL and uses the VirusTotal API to perform an analysis on whether this URL is malicious. This is done using a personal VirusTotal API key and the vt python module, where a new scan request is first made using client.scan_url and the results obtained using client.get_object with the returned scan identifier.

The VirusTotal output of a scanned URL contains a range of information, with the relevant information being the number times the URL was submitted, analysis stats, reputation and categories of the URL. An example output of the VirusTotal scan output looks like the following:

Times submitted: 4
Last analysis stats: {'harmless': 66, 'malicious': 5, 'suspicious': 1, 'undetected': 17, 'timeout': 0}
Reputation: 0
Categories: {'Forcepoint ThreatSeeker': 'newly registered websites', 'Webroot': 'Phishing and Other Frauds', 'alphaMountain.ai': 'Suspicious (alphaMountain.ai)'}

Update 2/7/2023: PhishText.Ai is integrated with UrlScan.io to provide further indicators before continuing to send the results and SMS message to ChatGPT. The function to submit a scan and retrieve the results is similar to the VirusTotal integration detailed above, but was added to provide even more indicators to ensure a reliable outcome.

ChatGPT Integration and Analysis

Finally, the output from the VirusTotal analysis as well as the entire SMS message are submitted to ChatGPT for analysis using the OpenAI API and the OpenAI Python module.

The prompt used when submitting the request to ChatGPT is as follows:

{"role": "system", "content": "You are an intelligent assistant that specializes in cybersecurity and the identification and analysis of phishing SMS messages."},

{"role": "user", "content": f"Analyze this SMS message: '{sms_text}' and its VirusTotal analysis: '{analysis_result}' to determine if this is a phishing attempt. Give your reasoning for why this is or is not a phishing SMS"},

In this implementation, the {analysis_result} is the output from the VirusTotal scan + analysis, and {sms_text} is the full SMS message submitted at the start of the program being run. This allows for both the analysis and the message to be submitted together to ChatGPT for the AI model to process and return the final judgement and recommendation.

Note that the ChatGPT API specifies three different roles that provide context to both the user and to ChatGPT.

The first role, “system”, can be used as a high-level guide for the AI model to use during the prompt. This can shape the behaviour of the model toward a specific outcome as the first property input in a prompt. In this case, PhishText.Ai is specifying to ChatGPT that the prompt should focus on cybersecurity and the analysis of phishing SMS messages.

The second role, “user”, specifies to ChatGPT what the user has submitted as text. This is the prompt that is submitted to ChatGPT which includes the VirusTotal analysis and SMS message. The final part of the prompt is directly telling ChatGPT to determine if the SMS is a phishing attempt and provide reasoning for this conclusion.

The third role, “assistant”, is the response from ChatGPT and can be used during subsequent API calls if the chat history needs to be maintained. In this case, the “assistant” property is not required as PhishText.Ai only requires a single call and response to analyse a SMS message.

Future Enhancements and Improvements

The following ideas are noted for future improvement initiatives to increase the effectiveness, usability or reliability of the PhishText.Ai tool.

• Upgrade to the ChatGPT 4.0 model once API access is made available.
• Add a web-interface that is compatible with both mobile and desktop interfaces for easier submission of SMS messages.
• Integrate with more analysis tools to provide ChatGPT with extra information, such as OpenThreatExchange(OTX) or urlscan.io.
  • UrlScan.io integration added! 2/7/2023
• Improve URL extraction mechanism to cover a wider range of URL formats.
• Add more sophisticated natural language processing to analyze the textual content of the SMS.
• Use a secure method to handle sensitive information such as API keys.
• Implement mechanisms to handle API rate limiting.
• Add error handling for network failures and other exceptions.

Assumptions, Limitations and Risks

While PhishText.Ai is an effective solution, it’s not without limitations. In this case, there are a few key areas of concern that are worth calling out.

• The accuracy of the solution depends on the effectiveness of the GPT-3.5-turbo model in detecting phishing attempts and the reliability of the VirusTotal API.
• Overuse may result in hitting rate limits or large financial charge for both OpenAI and VirusTotal APIs.
• PhishText.Ai may not correctly interpret URLs that do not match the regular expression used for URL extraction.
• The model can potentially output false positives or negatives.
• The OpenAI API key and the VirusTotal API key are hardcoded into the PhishText.Ai code currently, posing a potential security risk if the code is publicly exposed.

Lessons Learned and Conclusion

Overall, PhishText.Ai is probably not a replacement for an experienced cybersecurity professional who is able to perform a more technical analysis of URL’s and make a more nuanced judgement call. However, for the speed and ease at which PhishText.Ai provides a result, this is certainly a useful tool especially for individuals who do not possess a deep knowledge of phishing techniques and the ways to identify phishing attempts. With further improvements and a better interface, PhishText.Ai could provide value to a lot of people for a very low cost.

The process of exploring AI technology and the way to integrate them into Python applications has been extremely interesting. Doing a deep dive into the OpenAI API and corresponding documentation has given me a greater understanding of how AI and LLM technologies work, and given me a greater appreciation as to how disruptive this technology can be in the future. I’m excited to improve PhishText.Ai further and build new applications as my understanding of this topic grows.

It’s been great to improve my Python skills also, as my coding ability had decreased significantly having not developed for some time. Building out programs to explore AI use cases has really reignited my passion for developing new tools and I already have ideas for new projects that I want to get stuck into. Learning is best done through doing, so the goal is to work more with AI to learn more about AI.

For those reading this, I hope PhishText.Ai helps demonstrate how AI can be used to improve security and inspire you to work on your own projects or learn more about AI technology. I strongly believe that AI is here to stay, so learning about it now while it’s still relatively new could really pay dividends further down the line.

Cheers,

Kento.