Autonomous email report generator

Patent metadata

Field	Value
Publication number	US-12063243-B2
Application number	US-202016941878-A
Country	US
Kind code	B2
Filing date	Jul 29, 2020
Priority date	Feb 20, 2018
Publication date	Aug 13, 2024
Grant date	Aug 13, 2024

Abstract

An autonomous email-report composer composes a type of report on cyber threats that is composed in a human-readable format with natural language prose, terminology, and level of detail on the cyber threats aimed at a target audience. The autonomous email-report composer cooperates with libraries with prewritten text templates with i) standard pre-written sentences written in the natural language prose and ii) prewritten text templates with fillable blanks that are populated with data for the cyber threats specific for a current report being composed, where a template for the type of report contains two or more sections in that template. Each section having different standard pre-written sentences written in the natural language prose.

First claim

What is claimed is:

1. An apparatus, comprising:
one or more processing units; and
a non-transitory computer readable medium including information accessible by the one or more processing units, the information comprises a formatting module and an autonomous email-report composer configured to cooperate with Artificial Intelligence (AI) models and modules of an email protection system and one or more libraries of sets of prewritten text and visual representations to populate on templates of pages in an email threat report,
wherein a template of the templates of pages in the email threat report comprises two or more sections, including i) standard pre-written sentences written in a natural language prose and ii) one or more visual representations,
wherein the autonomous email-report composer is configured, when executed by the one or more processing units, to compose the email threat report on cyber threats in a human-readable format with natural language prose, terminology, and detail on cyber threats aimed at a target audience, wherein the detail on the cyber threats includes a summary on different types of cyber threats occurring within an email network during a period of time covered by the email threat report,
wherein the autonomous email-report composer is configured, when executed by the one or more processing units, to cooperate with the one or more libraries with prewritten text templates and visual representation templates with i) one or more standard pre-written sentences written in the natural language prose derived from previously generated email threat reports and ii) one or more of the prewritten text templates with fillable blanks that are populated with data for the cyber threats specific for a current email threat report composed of a summary on different types of cyber threats occurring within the email network during a period of time covered by the current email threat report along with a trend indicator that indicates whether one of the types of cyber threats has increased, decreased, or remained constant during the period of time, where the autonomous email-report composer is configured to cooperate with the one or more AI models trained with machine learning on a normal email pattern of life for entities in the email network and a data store to compose content in the email threat report, and
wherein the formatting module is configured to format, present, and output the current email threat report, from a first template of a plurality of report templates, that is outputted for a human user's consumption in a medium of any of 1) a printable report, 2) presented digitally on a user interface on a display screen, 3) in a machine readable format for further use in machine-learning reinforcement and refinement, and 4) any combination of the three.

2. The apparatus of claim 1 , wherein the email protection system further has a gatherer module, an autonomous response module, an analyzer module, and the data store to cooperate with the autonomous email-report composer, where the gatherer module and the data store are configured to cooperate to store data points on an inbound email flow received over a period of time as well as one or more autonomous response actions performed by the autonomous response module on the inbound email flow, where the analyzer module is configured to cooperate with the one or more AI models trained with machine learning on the normal email pattern of life for entities in the email network to detect anomalous email, which is detected as outside the normal pattern of life for an entity of the email network, and/or suspicious emails that exhibit traits that suggest a malicious intent in order to determine an email attack's 1) purpose, 2) targeted group, and 3) any combination of both, and then cooperate with the autonomous email-report composer to populate in the email threat report the email attack's 1) purpose, 2) targeted group, and 3) any combination of both.

3. The apparatus of claim 2 , wherein an analyzer module and the autonomous email-report composer are configured to cooperate with the data store to identify and supply a list of users in the email network that are at a most risk from emails over the period of time, where the autonomous email-report composer is configured to cooperate with the analyzer module, the one or more libraries of templates, and one or more AI models to compose at least a page in the current email threat report to represent the most at-risk users.

4. The apparatus of claim 1 , wherein the autonomous email-report composer is configured to cooperate with an AI model trained on composing threat reports to compose the email threat report in the human-readable format with the natural language prose, terminology, and a prescribed level of detail on the cyber threats aimed at a selected target audience.

5. The apparatus of claim 1 , wherein the autonomous email-report composer is configured to cooperate with the library of templates, where the first template for the email threat report comprises two or more sections, each section spans one or more pages in the email threat report, each section includes its own set of i) standard pre-written sentences written in the natural language prose in the one or more prewritten text templates, ii) visual representations, and iii) any combination of these, that are presented in each of those sections making up the email threat report.

6. The apparatus of claim 1 , wherein the autonomous email-report composer is configured to cooperate with the data store and an autonomous response module to collect data points and compose an information needed to populate one more pages for an analysis of one or more specific autonomous response actions taken by the autonomous response module.

7. The apparatus of claim 1 , wherein the autonomous email-report composer is configured to cooperate with an autonomous action module, the data store, and an AI model on cyber threats to list actionable actions to take in light of the cyber threats, and then to populate suggested actionable actions to take into the email threat report as well as generate a detailed explanation into one or more interesting email incidents for an individual write up which includes details about at least a targeted user of an email attack, one or more autonomous actions taken by an autonomous response module to remediate the email attack, and a textual discussion on incident triage with details of a resolution taken.

8. The apparatus of claim 1 , wherein the autonomous email-report composer is configured to cooperate with the AI models trained with machine learning on the normal email pattern of life for entities in the email network in order to draw links between email incidents to identify trends between current users affected by the email incidents and then other users, who have a high similarity to the current users affected, who may be similarly targeted in a future,
where the autonomous email-report composer is then configured to generate a write up on the links between the current users affected by the email incidents and the highly similar users.

9. The apparatus of claim 1 , wherein the autonomous email-report composer is configured to cooperate with the data store to represent complex metrics in a visually engaging way with the visual representations including i) graphs ii) contact links to a user, iii) pie charts, iv) bar charts, v) bubbles, and vi) any combination of these in one or more sections of the current email-threat report while also providing a textual analysis.

10. The apparatus of claim 1 , wherein the autonomous email-report composer is configured to cooperate with the user interface to make the email threat report customizable for an end user to select

Assignees

• Darktrace Ltd
• Darktrace Holdings Ltd

Inventors

• Boyer John Anthony
• Humphrey Dickon
• Dunn Matthew

Classifications

• G06F40/186

  Templates · CPC title

• G06F3/04847

  Interaction techniques to control parameter settings, e.g. interaction with sliders or dials · CPC title

• G06F40/103

  Formatting, i.e. changing of presentation of documents (automatic justification G06F40/189; automatic line break hyphenation G06F40/191) · CPC title

• G06F40/174

  Form filling; Merging · CPC title

• G06F40/40

  Processing or translation of natural language (natural language analysis G06F40/20; semantic analysis G06F40/30) · CPC title