Abnormal Security Corporation

Dmitry Chechik

Jeshua Alexis Bratman

Sanjay Jeyakumar

Cheng-Lin Yeh

Yu Zhou Lee

Kai Jing Jiang

Jeremy Kao

Abhijit Bagri

Su Li Debbie Tan

Kevin Lau

Evan James Reiser

Carlos Daniel Gasperi

Sanny Xiao Yang Liao

Sanny Xiao Lang Liao

Umut Gultepe

Erin Elisabeth Edkins Ludert

Raphael Kargon

Hariank Sagar Muthakana

Micah J Zirn

Michael Douglas Kralka

Conventional email filtering services are not suitable for recognizing sophisticated malicious emails, and therefore may allow sophisticated malicious emails to reach inboxes by mistake. Introduced here are threat detection platforms designed to take an integrative approach to detecting security threats. For example, after receiving input indicative of an approval from an individual to access past email received by employees of an enterprise, a threat detection platform can download past emails to build a machine learning (ML) model that understands the norms of communication with internal contacts (e.g., other employees) and/or external contacts (e.g., vendors). By applying the ML model to incoming email, the threat detection platform can identify security threats in real time in a targeted manner.

Programmatic discovery, retrieval, and analysis of communications to identify abnormal communication activity

Introduced here are threat detection platforms designed to discover possible instances of email account compromise in order to identify threats to an enterprise. In particular, a threat detection platform can examine the digital activities performed with the email accounts associated with employees of the enterprise to determine whether any email accounts are exhibiting abnormal behavior. Examples of digital activities include the reception of an incoming email, transmission of an outgoing email, creation of a mail filter, and occurrence of a sign-in event (also referred to as a 'login event'). Thus, the threat detection platform can monitor the digital activities performed with a given email account to determine the likelihood that the given email account has been compromised.

Discovering email account compromise through assessments of digital activities

Multistage analysis of emails to identify security threats

A plurality of features associated with a message are determined. At least one feature included in the plurality of features is associated with a payload of the message. A determination is made that supplemental analysis should be performed on the message. The determination is based at least in part on performing behavioral analysis using at least some of the features included in the plurality of features. Supplemental analysis is performed.

Multi-tiered approach to payload detection for incoming communications

Threat detection platforms for detecting, characterizing, and remediating email-based threats in real time

Retrospective learning of communication patterns by machine learning models for discovering abnormal behavior

Growing community of inventors

San Carlos, CA, United States of America

Dmitry Chechik