Abnormal Security Corporation

Abhijit Bagri

Jeshua Alexis Bratman

Jeremy Kao

Sanjay Jeyakumar

Cheng-Lin Yeh

Kai Jing Jiang

Su Li Debbie Tan

Kevin Lau

Evan James Reiser

Yu Zhou Lee

Dmitry Chechik

Carlos Daniel Gasperi

Yea So Jung

Sanny Xiao Yang Liao

Rami Faris Habal

Fang Shuo Deng

Sanny Xiao Lang Liao

Umut Gultepe

Hariank Sagar Muthakana

Sharan Dev Sankar

Dhruv Purushottam

Venkat Krishnamoorthi

Franklin X Wang

Jocelyn Mikael Raphael Beauchesne

Venkatram Krishnamoorthi

Venkatram Kishnamoorthi

Feng Shuo Deng

Conventional email filtering services are not suitable for recognizing sophisticated malicious emails, and therefore may allow sophisticated malicious emails to reach inboxes by mistake. Introduced here are threat detection platforms designed to take an integrative approach to detecting security threats. For example, after receiving input indicative of an approval from an individual to access past email received by employees of an enterprise, a threat detection platform can download past emails to build a machine learning (ML) model that understands the norms of communication with internal contacts (e.g., other employees) and/or external contacts (e.g., vendors). By applying the ML model to incoming email, the threat detection platform can identify security threats in real time in a targeted manner.

Programmatic discovery, retrieval, and analysis of communications to identify abnormal communication activity

Multistage analysis of emails to identify security threats

Introduced here are computer programs and computer-implemented techniques for discovering malicious emails and then remediating the threat posed by those malicious emails in an automated manner. A threat detection platform may monitor a mailbox to which employees of an enterprise are able to forward emails deemed to be suspicious for analysis. This mailbox may be referred to as an 'abuse mailbox' or “phishing mailbox.” The threat detection platform can examine emails contained in the abuse mailbox and then determine whether any of those emails represent threats to the security of the enterprise. For example, the threat detection platform may classify each email contained in the abuse mailbox as being malicious or non-malicious. Thereafter, the threat detection platform may determine what remediation actions, if any, are appropriate for addressing the threat posed by those emails determined to be malicious.

Abuse mailbox for facilitating discovery, investigation, and analysis of email-based threats

Threat detection platforms for detecting, characterizing, and remediating email-based threats in real time

Introduced here are computer programs and computer-implemented techniques for building, training, or otherwise developing models of the behavior of employees across more than one channel used for communication. These models can be stored in profiles that are associated with the employees. At a high level, these profiles allow behavior to be monitored across multiple channels so that deviations can be detected and then examined. Moreover, remediation may be performed if an account is determined to be compromised based on its recent activity.

Multichannel threat detection for protecting against account compromise

Retrospective learning of communication patterns by machine learning models for discovering abnormal behavior

Techniques for identifying and processing graymail are disclosed. An electronic message store is accessed. A determination is made that a first message included in the electronic message store represents graymail, including by accessing a profile associated with an addressee of the first message. A remedial action is taken in response to determining that the first message represents graymail.

Discovering graymail through real-time analysis of incoming email

Techniques for building, training, or otherwise developing models of the behavior of employees across more than one channel used for communication are disclosed. These models can be stored in profiles that are associated with the employees. Such profiles allow behavior to be monitored across multiple channels so that deviations can be detected and then examined. Remediation can be performed if an account is determined to be compromised based on its recent activity.

Introduced here are computer programs and computer-implemented techniques for discovering malicious emails and then remediating the threat posed by those malicious emails in an automated manner. A threat detection platform may monitor a mailbox to which employees of an enterprise are able to forward emails deemed to be suspicious for analysis. This mailbox may be referred to as an 'abuse mailbox' or 'phishing mailbox.' The threat detection platform can examine emails contained in the abuse mailbox and then determine whether any of those emails represent threats to the security of the enterprise. For example, the threat detection platform may classify each email contained in the abuse mailbox as being malicious or non-malicious. Thereafter, the threat detection platform may determine what remediation actions, if any, are appropriate for addressing the threat posed by those emails determined to be malicious.

Growing community of inventors

Oakland, CA, United States of America

Abhijit Bagri