[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HE74HDHSN0WYPFGVCMH1AW":3,"skill-same:01M6HE74HDHSN0WYPFGVCMH1AW":124},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":85,"commitSha":86,"skillDirectory":87,"forksCount":88,"repositoryHtmlUrl":89,"repositoryHomepageUrl":6,"ownerHtmlUrl":90,"ownerBlogUrl":6,"ownerDescription":91,"updatedAt":92,"install":93,"resources":106},"01M6HE74HDHSN0WYPFGVCMH1AW","detecting-deepfake-audio-in-vishing-attacks",null,"Detects AI-generated deepfake audio used in voice phishing (vishing) attacks by extracting spectral features (MFCC, spectral centroid, spectral contrast, zero-crossing rate) and classifying samples with machine learning models. Supports batch...","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fdetecting-deepfake-audio-in-vishing-attacks\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"vishing","detecting deepfake audio in vishing attacks","attacks","detecting","Audio","cm","extracting","co","de","map","message","social","cloning","cybersecurity","aml","generated","analysis","t1566","t1078","batch","2026-11-10 10:12:30",false,"---\nname: detecting-deepfake-audio-in-vishing-attacks\ndescription: Detects AI-generated deepfake audio used in voice phishing (vishing) attacks by extracting spectral features (MFCC, spectral centroid, spectral contrast, zero-crossing rate) and classifying samples with machine learning models. Supports batch...\ndomain: cybersecurity\nsubdomain: social-engineering-defense\ntags:\n- deepfake-detection\n- vishing\n- audio-forensics\n- MFCC\n- spectral-analysis\n- voice-cloning\nversion: 1.0.0\nauthor: mukul975\nlicense: Apache-2.0\natlas_techniques:\n- AML.T0088\n- AML.T0043\n- AML.T0018\n- AML.T0052\nnist_ai_rmf:\n- MEASURE-2.7\n- GOVERN-6.2\n- MAP-5.2\n- MEASURE-2.5\n- MAP-5.1\nd3fend_techniques:\n- Sender Reputation Analysis\n- Content Validation\n- Message Analysis\n- User Behavior Analysis\n- Identifier Analysis\nnist_csf:\n- PR.AT-01\n- DE.CM-09\n- RS.CO-02\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T1566\n- T1598\ncategory: detecting-deepfake-audio-in-vishing-attacks\n---\n# Detecting-Deepfake-Audio-In-Vishing-Attacks\n\n## Overview\nDetects AI-generated deepfake audio used in voice phishing (vishing) attacks by extracting spectral features (MFCC, spectral centroid, spectral contrast, zero-crossing rate) and classifying samples with machine learning models. Supports batch analysis of audio files, generates confidence scores, and produces forensic reports. Activates for requests involving deepfake voice detection, vishing investigation, AI-generated speech analysis, voice cloning detection, or audio authenticity verification.\n\n\n\n# Detecting Deepfake Audio in Vishing Attacks\n\n## When to Use\n\n- A suspected vishing call used an AI-cloned executive voice to authorize a wire transfer\n- Security operations received a voicemail that sounds like the CEO but the tone seems off\n- Incident response needs to determine whether a recorded phone call contains synthetic speech\n- Fraud investigation requires forensic proof that audio was AI-generated\n- Red team exercises use voice cloning and blue team needs detection capability\n\n**Do not use** for text-based phishing (email\u002FSMS); use email header analysis or URL detonation tools instead.\n\n## Prerequisites\n\n- Python 3.9+ with librosa, numpy, scikit-learn, and scipy installed\n- Audio samples in WAV, MP3, or FLAC format (mono or stereo, any sample rate)\n- Reference corpus of known genuine voice samples for the targeted individual (optional but improves accuracy)\n- FFmpeg installed for audio format conversion (librosa dependency)\n- Minimum 3 seconds of audio for reliable feature extraction\n\n## Workflow\n\n### Step 1: Audio Preprocessing\n\nNormalize and prepare audio samples for feature extraction:\n\n```python\nimport librosa\nimport numpy as np\n\n# Load audio, resample to 16kHz mono\ny, sr = librosa.load(\"suspect_call.wav\", sr=16000, mono=True)\n\n# Trim silence from beginning and end\ny_trimmed, _ = librosa.effects.trim(y, top_db=25)\n\n# Normalize amplitude to [-1, 1]\ny_norm = y_trimmed \u002F np.max(np.abs(y_trimmed))\n```\n\nAudio preprocessing ensures consistent feature extraction across different recording conditions, microphones, and codec artifacts.\n\n### Step 2: Extract Spectral Features\n\nExtract the feature set that distinguishes real from synthetic speech:\n\n**Mel-Frequency Cepstral Coefficients (MFCCs):**\n```python\n# Extract 20 MFCCs + delta and delta-delta\nmfccs = librosa.feature.mfcc(y=y_norm, sr=sr, n_mfcc=20)\nmfcc_delta = librosa.feature.delta(mfccs)\nmfcc_delta2 = librosa.feature.delta(mfccs, order=2)\n```\n\nMFCCs capture the spectral envelope of speech, representing how the vocal tract shapes sound. Deepfake audio often shows unnatural smoothness in higher-order MFCCs because neural vocoders approximate but do not perfectly replicate the acoustic resonance of a physical vocal tract.\n\n**Spectral Features:**\n```python\nspectral_centroid = librosa.feature.spectral_centroid(y=y_norm, sr=sr)\nspectral_bandwidth = librosa.feature.spectral_bandwidth(y=y_norm, sr=sr)\nspectral_contrast = librosa.feature.spectral_contrast(y=y_norm, sr=sr)\nspectral_rolloff = librosa.feature.spectral_rolloff(y=y_norm, sr=sr)\nzero_crossing_rate = librosa.feature.zero_crossing_rate(y_norm)\n```\n\n**Key indicators of deepfake audio:**\n- Reduced spectral contrast in the 4-8 kHz range (vocoders compress high-frequency detail)\n- Abnormally consistent spectral centroid over time (real speech has natural variation)\n- Lower zero-crossing rate variance (synthetic speech lacks micro-perturbations)\n- Missing or attenuated formant transitions during consonant-vowel boundaries\n\n### Step 3: Build Feature Vector and Classify\n\nAggregate frame-level features into a fixed-length vector and classify:\n\n```python\nfrom sklearn.ensemble import RandomForestClassifier, GradientBoostingClassifier\nfrom sklearn.model_selection import cross_val_score\n\ndef build_feature_vector(y, sr):\n    features = []\n    mfccs = librosa.feature.mfcc(y=y, sr=sr, n_mfcc=20)\n    for coeff in mfccs:\n        features.extend([np.mean(coeff), np.std(coeff), np.min(coeff), np.max(coeff)])\n    for feat_fn in [librosa.feature.spectral_centroid,\n                    librosa.feature.spectral_bandwidth,\n                    librosa.feature.spectral_rolloff,\n                    librosa.feature.zero_crossing_rate]:\n        feat = feat_fn(y=y, sr=sr) if feat_fn != librosa.feature.zero_crossing_rate else feat_fn(y)\n        features.extend([np.mean(feat), np.std(feat), np.min(feat), np.max(feat)])\n    contrast = librosa.feature.spectral_contrast(y=y, sr=sr)\n    for band in contrast:\n        features.extend([np.mean(band), np.std(band)])\n    return np.array(features)\n```\n\nClassification uses an ensemble approach: Random Forest for robustness and Gradient Boosting for accuracy, with a voting mechanism to reduce false positives.\n\n### Step 4: Temporal Artifact Analysis\n\nExamine time-domain artifacts that neural vocoders leave behind:\n\n```python\n# Pitch stability analysis - deepfakes often have unnaturally stable F0\nf0, voiced_flag, voiced_probs = librosa.pyin(y_norm, fmin=50, fmax=500, sr=sr)\nf0_clean = f0[~np.isnan(f0)]\npitch_std = np.std(f0_clean) if len(f0_clean) > 0 else 0\npitch_jitter = np.mean(np.abs(np.diff(f0_clean))) if len(f0_clean) > 1 else 0\n```\n\nReal human speech exhibits natural pitch jitter (micro-variations in fundamental frequency) and shimmer (amplitude perturbations). Deepfake audio generated by Tacotron 2, VALL-E, or ElevenLabs typically shows reduced jitter and shimmer compared to genuine speech.\n\n### Step 5: Spectrogram Visual Inspection\n\nGenerate spectrograms for manual forensic review:\n\n```python\nimport librosa.display\nimport matplotlib.pyplot as plt\n\nfig, axes = plt.subplots(2, 2, figsize=(14, 10))\nlibrosa.display.specshow(librosa.power_to_db(librosa.feature.melspectrogram(y=y_norm, sr=sr)),\n                         sr=sr, ax=axes[0, 0], x_axis='time', y_axis='mel')\naxes[0, 0].set_title('Mel Spectrogram')\nlibrosa.display.specshow(mfccs, sr=sr, ax=axes[0, 1], x_axis='time')\naxes[0, 1].set_title('MFCCs')\n```\n\nVisual inspection reveals banding artifacts in mel spectrograms, unnatural energy cutoffs above the vocoder's frequency ceiling, and periodic noise patterns in the high-frequency range that are characteristic of neural speech synthesis.\n\n### Step 6: Generate Forensic Report\n\nCompile findings into an actionable report:\n\n```\nDEEPFAKE AUDIO ANALYSIS REPORT\n================================\nFile:              suspect_executive_call.wav\nDuration:          47.3 seconds\nSample Rate:       16000 Hz\nAnalysis Date:     2026-03-19\n\nCLASSIFICATION RESULT\nVerdict:           LIKELY DEEPFAKE (confidence: 94.2%)\nEnsemble Score:    RF=0.91, GBT=0.97, Avg=0.94\n\nFEATURE ANOMALIES DETECTED\n- MFCC variance in coefficients 13-20: 62% below genuine baseline\n- Spectral contrast (4-8 kHz): 0.23 (genuine avg: 0.41)\n- Pitch jitter: 0.8 Hz (genuine avg: 2.4 Hz)\n- Zero-crossing rate std: 0.003 (genuine avg: 0.011)\n\nSPECTROGRAM ARTIFACTS\n- Energy cutoff above 7.8 kHz (consistent with neural vocoder ceiling)\n- Banding pattern at 50ms intervals in mel spectrogram\n- Missing formant transitions at 12.4s, 23.1s, 35.7s timestamps\n\nRECOMMENDATION\nHigh confidence of AI-generated audio. Recommend out-of-band\nverification with the purported speaker. Preserve original audio\nfile with chain of custody documentation for potential legal action.\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **MFCC** | Mel-Frequency Cepstral Coefficients; representation of the short-term power spectrum on a mel (perceptual) frequency scale |\n| **Spectral Centroid** | Weighted mean of frequencies present in the signal; indicates perceived brightness of a sound |\n| **Spectral Contrast** | Difference in amplitude between peaks and valleys in the spectrum across frequency sub-bands |\n| **Vocoder** | Signal processing component that synthesizes audio waveforms from acoustic features; used in TTS and voice cloning |\n| **Pitch Jitter** | Cycle-to-cycle variation in fundamental frequency; natural in human speech, reduced in synthetic speech |\n| **Vishing** | Voice phishing; social engineering attack conducted via phone calls, increasingly using AI-cloned voices |\n| **Formant** | Resonant frequencies of the vocal tract that define vowel sounds; transitions between formants are difficult for AI to replicate perfectly |\n\n## Tools & Systems\n\n- **librosa**: Python library for audio analysis providing MFCC, spectral feature extraction, and spectrogram generation\n- **scikit-learn**: Machine learning library used for Random Forest and Gradient Boosting classification\n- **Resemblyzer**: Speaker embedding library for comparing voice identity between known genuine and suspect samples\n- **Speechbrain**: Deep learning toolkit for speech processing with pretrained deepfake detection models\n- **Praat**: Phonetics software for detailed pitch, jitter, and shimmer analysis of speech samples\n- **FFmpeg**: Audio format conversion and preprocessing utility required by librosa\n\n## Common Scenarios\n\n### Scenario: Executive Impersonation Wire Transfer Fraud\n\n**Context**: CFO receives a phone call appearing to be from the CEO requesting an urgent wire transfer of $2.3M. The call came from an unknown number but the voice sounded identical to the CEO. IT security was able to obtain a recording of the call from the phone system.\n\n**Approach**:\n1. Extract the audio from the phone system recording and convert to WAV at 16kHz\n2. Run MFCC and spectral feature extraction on the suspect audio\n3. Compare against known genuine CEO voice samples from recorded meetings\n4. Analyze pitch jitter and shimmer against human speech baselines\n5. Classify using the trained ensemble model and generate confidence score\n6. Produce forensic report with spectrogram evidence for legal\u002Fcompliance\n\n**Pitfalls**:\n- Phone codec compression (G.711, AMR) degrades audio quality and can mask deepfake artifacts\n- Short audio clips (under 3 seconds) produce unreliable feature statistics\n- Background noise from the call environment can reduce classification accuracy\n- Highly sophisticated voice cloning (e.g., fine-tuned VALL-E with 30+ minutes of training data) may evade basic feature analysis\n- Genuine speech transmitted through VoIP may exhibit spectral artifacts similar to deepfakes\n","# Detecting-Deepfake-Audio-In-Vishing-Attacks\n\n## Overview\nDetects AI-generated deepfake audio used in voice phishing (vishing) attacks by extracting spectral features (MFCC, spectral centroid, spectral contrast, zero-crossing rate) and classifying samples with machine learning models. Supports batch analysis of audio files, generates confidence scores, and produces forensic reports. Activates for requests involving deepfake voice detection, vishing investigation, AI-generated speech analysis, voice cloning detection, or audio authenticity verification.\n\n\n\n# Detecting Deepfake Audio in Vishing Attacks\n\n## When to Use\n\n- A suspected vishing call used an AI-cloned executive voice to authorize a wire transfer\n- Security operations received a voicemail that sounds like the CEO but the tone seems off\n- Incident response needs to determine whether a recorded phone call contains synthetic speech\n- Fraud investigation requires forensic proof that audio was AI-generated\n- Red team exercises use voice cloning and blue team needs detection capability\n\n**Do not use** for text-based phishing (email\u002FSMS); use email header analysis or URL detonation tools instead.\n\n## Prerequisites\n\n- Python 3.9+ with librosa, numpy, scikit-learn, and scipy installed\n- Audio samples in WAV, MP3, or FLAC format (mono or stereo, any sample rate)\n- Reference corpus of known genuine voice samples for the targeted individual (optional but improves accuracy)\n- FFmpeg installed for audio format conversion (librosa dependency)\n- Minimum 3 seconds of audio for reliable feature extraction\n\n## Workflow\n\n### Step 1: Audio Preprocessing\n\nNormalize and prepare audio samples for feature extraction:\n\n```python\nimport librosa\nimport numpy as np\n\n# Load audio, resample to 16kHz mono\ny, sr = librosa.load(\"suspect_call.wav\", sr=16000, mono=True)\n\n# Trim silence from beginning and end\ny_trimmed, _ = librosa.effects.trim(y, top_db=25)\n\n# Normalize amplitude to [-1, 1]\ny_norm = y_trimmed \u002F np.max(np.abs(y_trimmed))\n```\n\nAudio preprocessing ensures consistent feature extraction across different recording conditions, microphones, and codec artifacts.\n\n### Step 2: Extract Spectral Features\n\nExtract the feature set that distinguishes real from synthetic speech:\n\n**Mel-Frequency Cepstral Coefficients (MFCCs):**\n```python\n# Extract 20 MFCCs + delta and delta-delta\nmfccs = librosa.feature.mfcc(y=y_norm, sr=sr, n_mfcc=20)\nmfcc_delta = librosa.feature.delta(mfccs)\nmfcc_delta2 = librosa.feature.delta(mfccs, order=2)\n```\n\nMFCCs capture the spectral envelope of speech, representing how the vocal tract shapes sound. Deepfake audio often shows unnatural smoothness in higher-order MFCCs because neural vocoders approximate but do not perfectly replicate the acoustic resonance of a physical vocal tract.\n\n**Spectral Features:**\n```python\nspectral_centroid = librosa.feature.spectral_centroid(y=y_norm, sr=sr)\nspectral_bandwidth = librosa.feature.spectral_bandwidth(y=y_norm, sr=sr)\nspectral_contrast = librosa.feature.spectral_contrast(y=y_norm, sr=sr)\nspectral_rolloff = librosa.feature.spectral_rolloff(y=y_norm, sr=sr)\nzero_crossing_rate = librosa.feature.zero_crossing_rate(y_norm)\n```\n\n**Key indicators of deepfake audio:**\n- Reduced spectral contrast in the 4-8 kHz range (vocoders compress high-frequency detail)\n- Abnormally consistent spectral centroid over time (real speech has natural variation)\n- Lower zero-crossing rate variance (synthetic speech lacks micro-perturbations)\n- Missing or attenuated formant transitions during consonant-vowel boundaries\n\n### Step 3: Build Feature Vector and Classify\n\nAggregate frame-level features into a fixed-length vector and classify:\n\n```python\nfrom sklearn.ensemble import RandomForestClassifier, GradientBoostingClassifier\nfrom sklearn.model_selection import cross_val_score\n\ndef build_feature_vector(y, sr):\n    features = []\n    mfccs = librosa.feature.mfcc(y=y, sr=sr, n_mfcc=20)\n    for coeff in mfccs:\n        features.extend([np.mean(coeff), np.std(coeff), np.min(coeff), np.max(coeff)])\n    for feat_fn in [librosa.feature.spectral_centroid,\n                    librosa.feature.spectral_bandwidth,\n                    librosa.feature.spectral_rolloff,\n                    librosa.feature.zero_crossing_rate]:\n        feat = feat_fn(y=y, sr=sr) if feat_fn != librosa.feature.zero_crossing_rate else feat_fn(y)\n        features.extend([np.mean(feat), np.std(feat), np.min(feat), np.max(feat)])\n    contrast = librosa.feature.spectral_contrast(y=y, sr=sr)\n    for band in contrast:\n        features.extend([np.mean(band), np.std(band)])\n    return np.array(features)\n```\n\nClassification uses an ensemble approach: Random Forest for robustness and Gradient Boosting for accuracy, with a voting mechanism to reduce false positives.\n\n### Step 4: Temporal Artifact Analysis\n\nExamine time-domain artifacts that neural vocoders leave behind:\n\n```python\n# Pitch stability analysis - deepfakes often have unnaturally stable F0\nf0, voiced_flag, voiced_probs = librosa.pyin(y_norm, fmin=50, fmax=500, sr=sr)\nf0_clean = f0[~np.isnan(f0)]\npitch_std = np.std(f0_clean) if len(f0_clean) > 0 else 0\npitch_jitter = np.mean(np.abs(np.diff(f0_clean))) if len(f0_clean) > 1 else 0\n```\n\nReal human speech exhibits natural pitch jitter (micro-variations in fundamental frequency) and shimmer (amplitude perturbations). Deepfake audio generated by Tacotron 2, VALL-E, or ElevenLabs typically shows reduced jitter and shimmer compared to genuine speech.\n\n### Step 5: Spectrogram Visual Inspection\n\nGenerate spectrograms for manual forensic review:\n\n```python\nimport librosa.display\nimport matplotlib.pyplot as plt\n\nfig, axes = plt.subplots(2, 2, figsize=(14, 10))\nlibrosa.display.specshow(librosa.power_to_db(librosa.feature.melspectrogram(y=y_norm, sr=sr)),\n                         sr=sr, ax=axes[0, 0], x_axis='time', y_axis='mel')\naxes[0, 0].set_title('Mel Spectrogram')\nlibrosa.display.specshow(mfccs, sr=sr, ax=axes[0, 1], x_axis='time')\naxes[0, 1].set_title('MFCCs')\n```\n\nVisual inspection reveals banding artifacts in mel spectrograms, unnatural energy cutoffs above the vocoder's frequency ceiling, and periodic noise patterns in the high-frequency range that are characteristic of neural speech synthesis.\n\n### Step 6: Generate Forensic Report\n\nCompile findings into an actionable report:\n\n```\nDEEPFAKE AUDIO ANALYSIS REPORT\n================================\nFile:              suspect_executive_call.wav\nDuration:          47.3 seconds\nSample Rate:       16000 Hz\nAnalysis Date:     2026-03-19\n\nCLASSIFICATION RESULT\nVerdict:           LIKELY DEEPFAKE (confidence: 94.2%)\nEnsemble Score:    RF=0.91, GBT=0.97, Avg=0.94\n\nFEATURE ANOMALIES DETECTED\n- MFCC variance in coefficients 13-20: 62% below genuine baseline\n- Spectral contrast (4-8 kHz): 0.23 (genuine avg: 0.41)\n- Pitch jitter: 0.8 Hz (genuine avg: 2.4 Hz)\n- Zero-crossing rate std: 0.003 (genuine avg: 0.011)\n\nSPECTROGRAM ARTIFACTS\n- Energy cutoff above 7.8 kHz (consistent with neural vocoder ceiling)\n- Banding pattern at 50ms intervals in mel spectrogram\n- Missing formant transitions at 12.4s, 23.1s, 35.7s timestamps\n\nRECOMMENDATION\nHigh confidence of AI-generated audio. Recommend out-of-band\nverification with the purported speaker. Preserve original audio\nfile with chain of custody documentation for potential legal action.\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **MFCC** | Mel-Frequency Cepstral Coefficients; representation of the short-term power spectrum on a mel (perceptual) frequency scale |\n| **Spectral Centroid** | Weighted mean of frequencies present in the signal; indicates perceived brightness of a sound |\n| **Spectral Contrast** | Difference in amplitude between peaks and valleys in the spectrum across frequency sub-bands |\n| **Vocoder** | Signal processing component that synthesizes audio waveforms from acoustic features; used in TTS and voice cloning |\n| **Pitch Jitter** | Cycle-to-cycle variation in fundamental frequency; natural in human speech, reduced in synthetic speech |\n| **Vishing** | Voice phishing; social engineering attack conducted via phone calls, increasingly using AI-cloned voices |\n| **Formant** | Resonant frequencies of the vocal tract that define vowel sounds; transitions between formants are difficult for AI to replicate perfectly |\n\n## Tools & Systems\n\n- **librosa**: Python library for audio analysis providing MFCC, spectral feature extraction, and spectrogram generation\n- **scikit-learn**: Machine learning library used for Random Forest and Gradient Boosting classification\n- **Resemblyzer**: Speaker embedding library for comparing voice identity between known genuine and suspect samples\n- **Speechbrain**: Deep learning toolkit for speech processing with pretrained deepfake detection models\n- **Praat**: Phonetics software for detailed pitch, jitter, and shimmer analysis of speech samples\n- **FFmpeg**: Audio format conversion and preprocessing utility required by librosa\n\n## Common Scenarios\n\n### Scenario: Executive Impersonation Wire Transfer Fraud\n\n**Context**: CFO receives a phone call appearing to be from the CEO requesting an urgent wire transfer of $2.3M. The call came from an unknown number but the voice sounded identical to the CEO. IT security was able to obtain a recording of the call from the phone system.\n\n**Approach**:\n1. Extract the audio from the phone system recording and convert to WAV at 16kHz\n2. Run MFCC and spectral feature extraction on the suspect audio\n3. Compare against known genuine CEO voice samples from recorded meetings\n4. Analyze pitch jitter and shimmer against human speech baselines\n5. Classify using the trained ensemble model and generate confidence score\n6. Produce forensic report with spectrogram evidence for legal\u002Fcompliance\n\n**Pitfalls**:\n- Phone codec compression (G.711, AMR) degrades audio quality and can mask deepfake artifacts\n- Short audio clips (under 3 seconds) produce unreliable feature statistics\n- Background noise from the call environment can reduce classification accuracy\n- Highly sophisticated voice cloning (e.g., fine-tuned VALL-E with 30+ minutes of training data) may evade basic feature analysis\n- Genuine speech transmitted through VoIP may exhibit spectral artifacts similar to deepfakes\n",{"name":5,"tags":49,"author":55,"domain":37,"license":15,"version":56,"category":5,"nist_csf":57,"subdomain":61,"description":7,"nist_ai_rmf":62,"mitre_attack":68,"atlas_techniques":74,"d3fend_techniques":79},[50,24,51,52,53,54],"deepfake-detection","audio-forensics","MFCC","spectral-analysis","voice-cloning","mukul975","1.0.0",[58,59,60],"PR.AT-01","DE.CM-09","RS.CO-02","social-engineering-defense",[63,64,65,66,67],"MEASURE-2.7","GOVERN-6.2","MAP-5.2","MEASURE-2.5","MAP-5.1",[69,70,71,72,73],"T1078","T1190","T1059","T1566","T1598",[75,76,77,78],"AML.T0088","AML.T0043","AML.T0018","AML.T0052",[80,81,82,83,84],"Sender Reputation Analysis","Content Validation","Message Analysis","User Behavior Analysis","Identifier Analysis","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Fdetecting-deepfake-audio-in-vishing-attacks",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":94,"prompt":104,"zipAvailable":105},[95,98,101],{"tool":96,"command":97},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill detecting-deepfake-audio-in-vishing-attacks",{"tool":99,"command":100},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill detecting-deepfake-audio-in-vishing-attacks",{"tool":102,"command":103},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill detecting-deepfake-audio-in-vishing-attacks","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fdetecting-deepfake-audio-in-vishing-attacks\u002FSKILL.md",true,[107,112,118],{"path":108,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":110,"sourceHtmlUrl":111},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fdetecting-deepfake-audio-in-vishing-attacks\u002FLICENSE",{"path":113,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002Fapi-reference.md","REFERENCE","参考文档",5398,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fdetecting-deepfake-audio-in-vishing-attacks\u002Freferences\u002Fapi-reference.md",{"path":119,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":122,"sourceHtmlUrl":123},"scripts\u002Fagent.py","SCRIPT","脚本",24658,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fdetecting-deepfake-audio-in-vishing-attacks\u002Fscripts\u002Fagent.py",[125,153,179,201,217,235],{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":134,"publishedAt":44},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[131],{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",[135,136,137,138,139,140,37,141,142,143,144,145,146,42,147,148,149,150,151,152],"integrity","backup","recovery","validating backup integrity for recovery","for","testing","validate","verification","hash-verification","incident-response","ransomware","detection","t1490","disaster-recovery","restore","incident","disaster recovery","ransomware response",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":159,"publishedAt":44},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[160,161,162,163,164,37,165,166,167,168,169,170,171,172,173,174,175,176,177,178],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","with","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":185,"publishedAt":44},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[186,187,150,37,188,189,190,42,147,40,191,192,193,194,195,196,197,198,199,200],"security","triaging security incident","actions","soc","NIST","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","conversion","isolation","scope","impact","consistency",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":207,"publishedAt":44},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[186,208,209,187,150,164,37,210,189,144,211,212,42,147,213,191,174,214,215,216],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":218,"name":219,"nameZh":6,"description":220,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":221,"categories":222,"keywords":223,"publishedAt":44},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[186,224,225,226,227,228,37,229,230,231,189,232,42,41,233,234,194,29,150,32],"security alerts","splunk","triaging security alerts in splunk","alerts","review","siem","dashboard","search","correlation-search","notable-events","incident-review",{"skillNo":236,"name":237,"nameZh":6,"description":238,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":239,"categories":240,"keywords":241,"publishedAt":44},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[242,243,244,245,37,246,247,248,249,250,251,41,252,253,29,254,32,255,256,257],"infrastructure","tracking threat actor infrastructure","tracking","threat","monitoring","mitre-attack","threat-actor","threat-intelligence","command-and-control","dns","command","exploit","intelligence","domains","kit","hosts"]