Abnormal Security Corporation

Jeshua Alexis Bratman

Sanjay Jeyakumar

Yu Zhou Lee

Cheng-Lin Yeh

Abhijit Bagri

Dmitry Chechik

Kai Jing Jiang

Jeremy Kao

Su Li Debbie Tan

Kevin Lau

Evan James Reiser

Carlos Daniel Gasperi

Lawrence Stockton Moore

Rami Faris Habal

Lei Xu

Sanny Xiao Lang Liao

Umut Gultepe

Sanny Xiao Yang Liao

Yea So Jung

Hariank Sagar Muthakana

Raphael Kargon

Erin Elisabeth Edkins Ludert

Fang Shuo Deng

Sharan Dev Sankar

Dhruv Purushottam

Venkat Krishnamoorthi

Franklin X Wang

Jocelyn Mikael Raphael Beauchesne

Geng Sng

Joey Esteban Cerquera

Nishant Bhalchandra Karandikar

Michael Douglas Kralka

Micah J Zirn

Conventional email filtering services are not suitable for recognizing sophisticated malicious emails, and therefore may allow sophisticated malicious emails to reach inboxes by mistake. Introduced here are threat detection platforms designed to take an integrative approach to detecting security threats. For example, after receiving input indicative of an approval from an individual to access past email received by employees of an enterprise, a threat detection platform can download past emails to build a machine learning (ML) model that understands the norms of communication with internal contacts (e.g., other employees) and/or external contacts (e.g., vendors). By applying the ML model to incoming email, the threat detection platform can identify security threats in real time in a targeted manner.

Programmatic discovery, retrieval, and analysis of communications to identify abnormal communication activity

Introduced here are threat detection platforms designed to discover possible instances of email account compromise in order to identify threats to an enterprise. In particular, a threat detection platform can examine the digital activities performed with the email accounts associated with employees of the enterprise to determine whether any email accounts are exhibiting abnormal behavior. Examples of digital activities include the reception of an incoming email, transmission of an outgoing email, creation of a mail filter, and occurrence of a sign-in event (also referred to as a 'login event'). Thus, the threat detection platform can monitor the digital activities performed with a given email account to determine the likelihood that the given email account has been compromised.

Discovering email account compromise through assessments of digital activities

Adapting detection of security threats, including by retraining computer-implemented models is disclosed. An indication is received that a natural language processing model should be retrained. A list of training samples is generated that includes at least one synthetic training sample. The natural language processing model is retrained at least in part by using the set of generated training samples. The retrained natural language processing model is used to determine a likelihood that a message poses a risk.

Adaptive detection of security threats through retraining of computer-implemented models

Multistage analysis of emails to identify security threats

A plurality of features associated with a message are determined. At least one feature included in the plurality of features is associated with a payload of the message. A determination is made that supplemental analysis should be performed on the message. The determination is based at least in part on performing behavioral analysis using at least some of the features included in the plurality of features. Supplemental analysis is performed.

Multi-tiered approach to payload detection for incoming communications

Threat detection platforms for detecting, characterizing, and remediating email-based threats in real time

Introduced here are computer programs and computer-implemented techniques for building, training, or otherwise developing models of the behavior of employees across more than one channel used for communication. These models can be stored in profiles that are associated with the employees. At a high level, these profiles allow behavior to be monitored across multiple channels so that deviations can be detected and then examined. Moreover, remediation may be performed if an account is determined to be compromised based on its recent activity.

Multichannel threat detection for protecting against account compromise

Retrospective learning of communication patterns by machine learning models for discovering abnormal behavior

Deriving and surfacing insights regarding security threats is disclosed. A plurality of features associated with a message is determined. A plurality of facet models is used to analyze the determined features. Based at least in part on the analysis, it is determined that the message poses a security threat. A prioritized set of information is determined to be provided as output that is representative of why the message was determined to pose a security threat. At least a portion of the prioritized set of information is provided as output.

Deriving and surfacing insights regarding security threats

Techniques for detecting instances of external fraud by monitoring digital activities that are performed with accounts associated with an enterprise are disclosed. In one example, a threat detection platform determines the likelihood that an incoming email is indicative of external fraud based on the context and content of the incoming email. To understand the risk posed by an incoming email, the threat detection platform may seek to determine not only whether the sender normally communicates with the recipient, but also whether the topic is one normally discussed by the sender and recipient. In this way, the threat detection platform can establish whether the incoming email deviates from past emails exchanged between the sender and recipient.

Detection and prevention of external fraud

Techniques for identifying and processing graymail are disclosed. An electronic message store is accessed. A determination is made that a first message included in the electronic message store represents graymail, including by accessing a profile associated with an addressee of the first message. A remedial action is taken in response to determining that the first message represents graymail.

Discovering graymail through real-time analysis of incoming email

Techniques for building, training, or otherwise developing models of the behavior of employees across more than one channel used for communication are disclosed. These models can be stored in profiles that are associated with the employees. Such profiles allow behavior to be monitored across multiple channels so that deviations can be detected and then examined. Remediation can be performed if an account is determined to be compromised based on its recent activity.

Growing community of inventors

Brooklyn, NY, United States of America

Jeshua Alexis Bratman