Abnormal Security Corporation

Sanjay Jeyakumar

Jeshua Alexis Bratman

Yu Zhou Lee

Cheng-Lin Yeh

Kai Jing Jiang

Dmitry Chechik

Su Li Debbie Tan

Abhijit Bagri

Jeremy Kao

Kevin Lau

Carlos Daniel Gasperi

Evan James Reiser

Sanny Xiao Lang Liao

Sanny Xiao Yang Liao

Yea So Jung

Lawrence Stockton Moore

Umut Gultepe

Rami Faris Habal

Lei Xu

Raphael Kargon

Erin Elisabeth Edkins Ludert

Hariank Sagar Muthakana

Justin Anthony Young

Sharan Dev Sankar

Dhruv Purushottam

Venkat Krishnamoorthi

Franklin X Wang

Jocelyn Mikael Raphael Beauchesne

Geng Sng

Joey Esteban Cerquera

Nishant Bhalchandra Karandikar

Fang Shuo Deng

Micah J Zirn

Michael Douglas Kralka

Oz Wasserman

Conventional email filtering services are not suitable for recognizing sophisticated malicious emails, and therefore may allow sophisticated malicious emails to reach inboxes by mistake. Introduced here are threat detection platforms designed to take an integrative approach to detecting security threats. For example, after receiving input indicative of an approval from an individual to access past email received by employees of an enterprise, a threat detection platform can download past emails to build a machine learning (ML) model that understands the norms of communication with internal contacts (e.g., other employees) and/or external contacts (e.g., vendors). By applying the ML model to incoming email, the threat detection platform can identify security threats in real time in a targeted manner.

Programmatic discovery, retrieval, and analysis of communications to identify abnormal communication activity

Techniques for producing records of digital activities that are performed with accounts associated with employees of enterprises are disclosed. Such techniques can be used to ensure that records are created for digital activities that are deemed unsafe and for digital activities that are deemed safe by a threat detection platform. At a high level, more comprehensively recording digital activities not only provides insight into the behavior of individual accounts, but also provides insight into the holistic behavior of employees across multiple accounts. These records may be stored in a searchable datastore to enable expedient and efficient review.

Investigation of threats using queryable records of behavior

Introduced here are threat detection platforms designed to discover possible instances of email account compromise in order to identify threats to an enterprise. In particular, a threat detection platform can examine the digital activities performed with the email accounts associated with employees of the enterprise to determine whether any email accounts are exhibiting abnormal behavior. Examples of digital activities include the reception of an incoming email, transmission of an outgoing email, creation of a mail filter, and occurrence of a sign-in event (also referred to as a 'login event'). Thus, the threat detection platform can monitor the digital activities performed with a given email account to determine the likelihood that the given email account has been compromised.

Discovering email account compromise through assessments of digital activities

Multistage analysis of emails to identify security threats

Selectively rewriting URLs is disclosed. An indication is received that a message has arrived at a user message box. A determination is made that the message includes a first link to a first resource. The first link is analyzed to determine whether the first link is classified as a non-rewrite link. In response to determining that the first link is not classified as a non-rewrite link, a first replacement link is generated for the first link.

URL rewriting

A plurality of features associated with a message are determined. At least one feature included in the plurality of features is associated with a payload of the message. A determination is made that supplemental analysis should be performed on the message. The determination is based at least in part on performing behavioral analysis using at least some of the features included in the plurality of features. Supplemental analysis is performed.

Multi-tiered approach to payload detection for incoming communications

Threat detection platforms for detecting, characterizing, and remediating email-based threats in real time

Retrospective learning of communication patterns by machine learning models for discovering abnormal behavior

Deriving and surfacing insights regarding security threats is disclosed. A plurality of features associated with a message is determined. A plurality of facet models is used to analyze the determined features. Based at least in part on the analysis, it is determined that the message poses a security threat. A prioritized set of information is determined to be provided as output that is representative of why the message was determined to pose a security threat. At least a portion of the prioritized set of information is provided as output.

Deriving and surfacing insights regarding security threats

Techniques for detecting instances of external fraud by monitoring digital activities that are performed with accounts associated with an enterprise are disclosed. In one example, a threat detection platform determines the likelihood that an incoming email is indicative of external fraud based on the context and content of the incoming email. To understand the risk posed by an incoming email, the threat detection platform may seek to determine not only whether the sender normally communicates with the recipient, but also whether the topic is one normally discussed by the sender and recipient. In this way, the threat detection platform can establish whether the incoming email deviates from past emails exchanged between the sender and recipient.

Detection and prevention of external fraud

Techniques for identifying and processing graymail are disclosed. An electronic message store is accessed. A determination is made that a first message included in the electronic message store represents graymail, including by accessing a profile associated with an addressee of the first message. A remedial action is taken in response to determining that the first message represents graymail.

Discovering graymail through real-time analysis of incoming email

Growing community of inventors

Berkeley, CA, United States of America

Sanjay Jeyakumar