Bank of America Corporation

Benjamin L Gatti

David Joseph Walsh

Nicholas Edward Peach

Jamison William Scheeres

According to one embodiment, an apparatus is configured to store a plurality of phishing scores, each phishing score of the plurality of phishing scores indicating a likelihood that a user of a plurality of users will respond to a phishing email. The apparatus is configured to receive an email, to select a first subset of the plurality of users based on the phishing score of each user in the first subset, and to select a second subset of the plurality of users based on the phishing score of each user in the second subset, wherein each user in the second subset is determined to be more likely to respond to a phishing email than each user in the first subset. The apparatus is configured to communicate the email to the first subset and to communicate the email to the second subset based on the first subset's responses to the email.

Delaying phishing communication

According to one embodiment, an apparatus includes a memory and a processor. The processor is configured to receive a forwarded email and to determine a plurality of keywords in the forwarded email. The processor is further configured to search an email server using the plurality of keywords and to determine that an email message from the plurality of email messages is the original email corresponding to the forwarded email. The processor is also configured to attach a portion of the determined email message to the forwarded email.

Phishing source tool

Systems, apparatus, and computer program products provide for electronic mail (email) attachment hold and dispatch for security monitoring of email attachments. Specifically, embodiments of the invention provide for removing email attachments from emails containing such, holding the removed attachments in storage prior to delivering the email to the recipient and communicating the email to the intended recipient absent the attachment, but rather with a link or other means by which the email recipient can retrieve the attachment from the storage. Such a procedure not only allows for the attachment to be analyzed for threats prior to transferring the attachment to the email recipient, but also provides for a means by which information pertaining to the retrieval of the attachment is logged (e.g., who retrieved the attachment, from which computing device was the attachment retrieved, at what date and time was the attachment retrieved and the like).

Electronic mail attachment hold and dispatch for security monitoring

According to one embodiment, an apparatus is configured to communicate a first plurality of phishing emails to a first plurality of users, each phishing email of the first plurality of phishing emails is of a first type or a second type. The apparatus is configured to determine a first response rate of the first plurality of users to phishing emails of the first type and to determine a second response rate of the first plurality of users to phishing emails of the second type. The apparatus is configured to determine a second plurality of phishing emails comprising phishing emails of the first type and the second type, wherein an aggregate response rate of a second plurality of users to the second plurality of phishing emails is predicted to be closer to a target response rate than one or more of the first response rate and the second response rate.

Phishing training tool

According to one embodiment, an apparatus includes a memory and a processor. The processor is configured to receive an email and to detect a click of a button that indicates that a user should be warned about the email being a phishing email. In response to detecting the click of the button, the processor can generate a new email and add a deactivated representation of the received email to the new email. The processor may communicate the new email to the user.

Phishing warning tool

According to one embodiment, an apparatus includes a memory and a processor. The memory is configured to store a plurality of phishing scores, each phishing score of the plurality of phishing scores indicating a likelihood that a user will delete a phishing email. The processor is configured to determine that a plurality of phishing campaigns are occurring. For each phishing campaign of the plurality of phishing campaigns, the processor is configured to determine that a plurality of users deleted a phishing email of the phishing campaign and to determine a priority score for the phishing campaign based on the phishing score of each user of the plurality of users. The processor is further configured to rank the plurality of phishing campaigns based on the priority score of each phishing campaign, wherein the phishing campaign of the plurality of phishing campaigns with the highest rank is presented first.

Phishing campaign ranker

According to one embodiment, an apparatus is configured to store a plurality of phishing scores, each phishing score of the plurality of phishing scores indicating a likelihood that a user will respond to a phishing email The apparatus is communicatively coupled to the memory and is configured to determine that a plurality of phishing campaigns are occurring. For each phishing campaign of the plurality of phishing campaigns, the apparatus is configured to determine that a plurality of users responded to the phishing campaign and to determine a priority score for the phishing campaign based on the phishing score of each user of the plurality of users. The apparatus is further configured to rank the plurality of phishing campaigns based on the priority score of each phishing campaign, wherein the phishing campaign of the plurality of phishing campaigns with the highest rank is reviewed first.

Growing community of inventors

Lake Park, NC, United States of America

Benjamin L Gatti