Abnormal Security Corporation

Fang Shuo Deng

Yea So Jung

Jeremy Kao

Abhijit Bagri

Rami Faris Habal

Jeshua Alexis Bratman

Kai Jing Jiang

Su Li Debbie Tan

Umut Gultepe

Hariank Sagar Muthakana

Sanjay Jeyakumar

Yu Zhou Lee

Cheng-Lin Yeh

Evan James Reiser

Venkatram Krishnamoorthi

Oz Wasserman

Selectively rewriting URLs is disclosed. An indication is received that a message has arrived at a user message box. A determination is made that the message includes a first link to a first resource. The first link is analyzed to determine whether the first link is classified as a non-rewrite link. In response to determining that the first link is not classified as a non-rewrite link, a first replacement link is generated for the first link.

URL rewriting

Introduced here are computer programs and computer-implemented techniques for building, training, or otherwise developing models of the behavior of employees across more than one channel used for communication. These models can be stored in profiles that are associated with the employees. At a high level, these profiles allow behavior to be monitored across multiple channels so that deviations can be detected and then examined. Moreover, remediation may be performed if an account is determined to be compromised based on its recent activity.

Multichannel threat detection for protecting against account compromise

Techniques for building, training, or otherwise developing models of the behavior of employees across more than one channel used for communication are disclosed. These models can be stored in profiles that are associated with the employees. Such profiles allow behavior to be monitored across multiple channels so that deviations can be detected and then examined. Remediation can be performed if an account is determined to be compromised based on its recent activity.

Introduced here are computer programs and computer-implemented techniques for discovering malicious emails and then remediating the threat posed by those malicious emails in an automated manner. A threat detection platform may monitor a mailbox to which employees of an enterprise are able to forward emails deemed to be suspicious for analysis. This mailbox may be referred to as an 'abuse mailbox' or 'phishing mailbox.' The threat detection platform can examine emails contained in the abuse mailbox and then determine whether any of those emails represent threats to the security of the enterprise. For example, the threat detection platform may classify each email contained in the abuse mailbox as being malicious or non-malicious. Thereafter, the threat detection platform may determine what remediation actions, if any, are appropriate for addressing the threat posed by those emails determined to be malicious.

Abuse mailbox for facilitating discovery, investigation, and analysis of email-based threats

Growing community of inventors

Berkeley, CA, United States of America

Fang Shuo Deng