Abnormal Security Corporation

Su Li Debbie Tan

Kai Jing Jiang

Cheng-Lin Yeh

Sanjay Jeyakumar

Yu Zhou Lee

Jeshua Alexis Bratman

Jeremy Kao

Abhijit Bagri

Evan James Reiser

Dmitry Chechik

Kevin Lau

Carlos Daniel Gasperi

Sanny Xiao Yang Liao

Sanny Xiao Lang Liao

Yea So Jung

Lawrence Stockton Moore

Fang Shuo Deng

Geng Sng

Joey Esteban Cerquera

Nishant Bhalchandra Karandikar

Rami Faris Habal

Venkatram Krishnamoorthi

Oz Wasserman

Venkatram Kishnamoorthi

Feng Shuo Deng

Conventional email filtering services are not suitable for recognizing sophisticated malicious emails, and therefore may allow sophisticated malicious emails to reach inboxes by mistake. Introduced here are threat detection platforms designed to take an integrative approach to detecting security threats. For example, after receiving input indicative of an approval from an individual to access past email received by employees of an enterprise, a threat detection platform can download past emails to build a machine learning (ML) model that understands the norms of communication with internal contacts (e.g., other employees) and/or external contacts (e.g., vendors). By applying the ML model to incoming email, the threat detection platform can identify security threats in real time in a targeted manner.

Programmatic discovery, retrieval, and analysis of communications to identify abnormal communication activity

Multistage analysis of emails to identify security threats

Introduced here are computer programs and computer-implemented techniques for discovering malicious emails and then remediating the threat posed by those malicious emails in an automated manner. A threat detection platform may monitor a mailbox to which employees of an enterprise are able to forward emails deemed to be suspicious for analysis. This mailbox may be referred to as an 'abuse mailbox' or “phishing mailbox.” The threat detection platform can examine emails contained in the abuse mailbox and then determine whether any of those emails represent threats to the security of the enterprise. For example, the threat detection platform may classify each email contained in the abuse mailbox as being malicious or non-malicious. Thereafter, the threat detection platform may determine what remediation actions, if any, are appropriate for addressing the threat posed by those emails determined to be malicious.

Abuse mailbox for facilitating discovery, investigation, and analysis of email-based threats

Selectively rewriting URLs is disclosed. An indication is received that a message has arrived at a user message box. A determination is made that the message includes a first link to a first resource. The first link is analyzed to determine whether the first link is classified as a non-rewrite link. In response to determining that the first link is not classified as a non-rewrite link, a first replacement link is generated for the first link.

URL rewriting

Threat detection platforms for detecting, characterizing, and remediating email-based threats in real time

Retrospective learning of communication patterns by machine learning models for discovering abnormal behavior

Deriving and surfacing insights regarding security threats is disclosed. A plurality of features associated with a message is determined. A plurality of facet models is used to analyze the determined features. Based at least in part on the analysis, it is determined that the message poses a security threat. A prioritized set of information is determined to be provided as output that is representative of why the message was determined to pose a security threat. At least a portion of the prioritized set of information is provided as output.

Deriving and surfacing insights regarding security threats

Introduced here are computer programs and computer-implemented techniques for discovering malicious emails and then remediating the threat posed by those malicious emails in an automated manner. A threat detection platform may monitor a mailbox to which employees of an enterprise are able to forward emails deemed to be suspicious for analysis. This mailbox may be referred to as an 'abuse mailbox' or 'phishing mailbox.' The threat detection platform can examine emails contained in the abuse mailbox and then determine whether any of those emails represent threats to the security of the enterprise. For example, the threat detection platform may classify each email contained in the abuse mailbox as being malicious or non-malicious. Thereafter, the threat detection platform may determine what remediation actions, if any, are appropriate for addressing the threat posed by those emails determined to be malicious.

Growing community of inventors

San Mateo, CA, United States of America

Su Li Debbie Tan