Systems and methods for intelligent phishing threat detection and phishing threat remediation in a cyber security threat detection and mitigation platform

Patent metadata

Field	Value
Publication number	US-11509689-B2
Application number	US-202217696151-A
Country	US
Kind code	B2
Filing date	Mar 16, 2022
Priority date	Oct 14, 2020
Publication date	Nov 22, 2022
Grant date	Nov 22, 2022

Abstract

A system and method for accelerating a cybersecurity event detection and remediation includes extracting corpora of feature data from a suspicious electronic communication, wherein the corpora of feature data comprise at least one corpus of text data extracted from a body of the suspicious electronic communication; computing at least one text embedding value for the suspicious electronic communication; evaluating the text embedding values of the corpus of text data against an n-dimensional mapping of adverse electronic communication vectors, the n-dimensional mapping comprising a plurality of historical electronic communication vectors derived for a plurality of historical electronic communications; identifying whether the suspicious electronic communication comprises one of an adverse electronic communication based on the evaluation of the text embedding value, and accelerating a cybersecurity event detection by routing data associated with the suspicious electronic communication to one of a plurality of distinct threat mitigation routes.

First claim

What is claimed:

1. A method implemented by one or more computers for accelerating a detection of a cybersecurity event and executing a cybersecurity remediation, the method comprising:
computing, by a text embedding model, an array of embeddings based on content feature data extracted from a target electronic communication;
identifying an electronic sender's address based on the content feature data from the target electronic communication, wherein the electronic sender's address identifies a communication address of a sender of the target electronic communication;
performing an embedding search of a corpus of embeddings of a plurality of distinct historical electronic communications based on the array of embeddings of the target electronic communication;
evaluating the electronic sender's address against historical sender data associated with one or more historical electronic communications;
identifying at least one distinct historical electronic communication based on the performance of the embedding search;
identifying whether the target electronic communication is one of a malicious electronic communication or a non-malicious communication based on an evaluation of the target electronic communication against the at least one distinct historical communication;
bypassing one or more predetermined cybersecurity threat investigation steps for resolving cybersecurity threats involving one or more target electronic communications based on the evaluation of the electronic sender's address; and
accelerating a handling of a cybersecurity event associated with the target electronic communication based on whether the target electronic communication is one of the malicious electronic communication or the non-malicious communication, wherein the accelerating the handling of the cybersecurity event includes routing data associated with the target electronic communication to one of a plurality of distinct cybersecurity threat mitigation routes based on the evaluation of the electronic sender's address and identifying the target electronic communication as the malicious electronic communication.

2. The method according to claim 1 , wherein
performing the embedding search includes:
computing a cosine distance value between the array of embeddings of the target electronic communication and embeddings of the at least one distinct historical electronic communication of the corpus of embeddings.

3. The method according to claim 2 , further comprising:
deriving a similarity score for the at least one distinct historical communication based on the cosine distance value.

4. The method according to claim 1 , wherein
identifying the at least one distinct historical electronic communication includes returning the at least one distinct historical electronic communication if a computed similarity score associated with the at least one distinct historical electronic communication satisfies an electronic communication similarity threshold.

5. The method according to claim 1 , wherein
identifying whether the target electronic communication is one of the malicious electronic communication or the non-malicious communication includes:
evaluating a content of the target electronic communication against a content of the at least one distinct historical electronic communication, and
validating the target electronic communication as the malicious electronic communication based on a phishing similarity.

6. The method according to claim 1 , wherein
identifying whether the target electronic communication is one of the malicious electronic communication or the non-malicious communication includes:
evaluating a content of the target electronic communication against a content of the at least one distinct historical electronic communication, and
validating the target electronic communication as the non-malicious electronic communication based on a phishing similarity.

7. The method according to claim 1 , wherein
the corpus of embeddings of the plurality of distinct historical electronic communications comprises embeddings of a plurality of distinct historical malicious electronic communications.

8. The method according to claim 1 , wherein
the corpus of embeddings of the plurality of distinct historical electronic communications comprises embeddings of (a) a plurality of distinct historical malicious electronic communications and (b) a plurality of distinct historical non-malicious electronic communications.

9. The method according to claim 1 , wherein
accelerating the detection of the cybersecurity event includes automatically bypassing one or more predetermined cybersecurity threat investigation steps for resolving cybersecurity threats involving the target electronic communication based on identifying the target electronic communication as the malicious electronic communication.

10. A method implemented by one or more computers for accelerating a disposal of a suspected cybersecurity event, the method comprising:
identifying a suspected malicious electronic communication and an electronic sender's address of the suspected malicious electronic communication, wherein the electronic sender's address identifies a communication address of a sender of the suspected electronic communication;
extracting a corpus of content feature data from the suspected malicious electronic communication;
converting the corpus of content feature data of the suspected malicious electronic communication to model input of feature vectors;
evaluating the electronic sender's address against historical sender data associated with one or more historical electronic communications;
computing, by a phishing machine learning model, a cybersecurity threat inference comprising a phishing threat score based on the model input of feature vectors of the suspected malicious electronic communication, wherein the phishing threat score indicates a likelihood that a target electronic communication comprises an adverse electronic communication or a malicious electronic communication;
bypassing one or more predetermined cybersecurity threat investigation steps for resolving cybersecurity threats involving the suspected malicious electronic communication based on the evaluation of the electronic sender's address; and
accelerating a handling of a cybersecurity event associated with the suspected malicious electronic communication based on whether the target electronic communication is one of the malicious electronic communication or the non-malicious communication, wherein the accelerating the handling of the cybersecurity event associated with the suspected malicious electronic communication includes routing data associated with the suspected malicious electronic communication to one of a plurality of distinct cybersecurity threat mitigation routes based on the evaluation of the electronic sender's address and identifying the suspected malicious electronic communication as the malicious electronic communication.

11. The method according to claim 10 , wherein
an algorithmic structure of the phishing machine learning model comprises a plurality of distinct learnable parameters for computing the cybersecurity threat inference that map at least to feature vectors computed for each of (1) a text body of the target electronic communication and (2) a web-based domain of a sender of the suspected malicious electronic communication.

12. The method according to claim 10 , wherein:
each of a plurality of distinct score ranges of a potential phishing threat score is associated with each of the plurality of distinct cybersecurity threat mitigation routes,
wherein the routing includes:
evaluating the phishing threat score against th

Assignees

• Expel Inc

Inventors

• Weber Elisabeth
• Silberman Peter
• Field Shamus

Classifications

• G06N3/045

  Combinations of networks · CPC title

• H04L63/1483 Primary

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• G06N20/00

  Machine learning · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• G06N20/20

  Ensemble learning · CPC title