Abnormal Security Corporation

Hariank Sagar Muthakana

Jeshua Alexis Bratman

Umut Gultepe

Sanjay Jeyakumar

Cheng-Lin Yeh

Abhijit Bagri

Jeremy Kao

Dmitry Chechik

Rami Faris Habal

Yea So Jung

Sanny Xiao Lang Liao

Fang Shuo Deng

Raphael Kargon

Erin Elisabeth Edkins Ludert

Introduced here are threat detection platforms designed to discover possible instances of email account compromise in order to identify threats to an enterprise. In particular, a threat detection platform can examine the digital activities performed with the email accounts associated with employees of the enterprise to determine whether any email accounts are exhibiting abnormal behavior. Examples of digital activities include the reception of an incoming email, transmission of an outgoing email, creation of a mail filter, and occurrence of a sign-in event (also referred to as a 'login event'). Thus, the threat detection platform can monitor the digital activities performed with a given email account to determine the likelihood that the given email account has been compromised.

Discovering email account compromise through assessments of digital activities

Introduced here are computer programs and computer-implemented techniques for building, training, or otherwise developing models of the behavior of employees across more than one channel used for communication. These models can be stored in profiles that are associated with the employees. At a high level, these profiles allow behavior to be monitored across multiple channels so that deviations can be detected and then examined. Moreover, remediation may be performed if an account is determined to be compromised based on its recent activity.

Multichannel threat detection for protecting against account compromise

Techniques for building, training, or otherwise developing models of the behavior of employees across more than one channel used for communication are disclosed. These models can be stored in profiles that are associated with the employees. Such profiles allow behavior to be monitored across multiple channels so that deviations can be detected and then examined. Remediation can be performed if an account is determined to be compromised based on its recent activity.

Growing community of inventors

San Francisco, CA, United States of America

Hariank Sagar Muthakana