Cloudflare, Inc.

Verint Americas Inc.

Nuance Communications, Inc.

Area 1 Security, Inc.

Torsten Zeppenfeld

Lisa Guerra

Philip Syme

Anthony Rajakumar

Richard Gutierrez

Javier Castro

Umalatha Batchu

Blake Darche

Vipul Vyas

YenHsiang Chang

Brian Strope

Brian Roundtree

Pim Van Meurs

Su-Lin Wu

Ben Shahshahani

Jon Witort

Gordon Waddell

Peter Stein

Tim Shelton

Debashri Mukherjee

Joseph James Schmid

Manish Brijkishor Sharma

Mark Andrew Lazar

Paul East

N Nikki Mirghafori

Andrew S Efron

An email is received that is from an email sender. From the email, the display name of the email sender, an email address of the email sender, and an email domain of the email sender, is extracted. A score is determined for the email based on at least: the extracted display name of the email sender, the extracted email address of the email sender, and the extracted email domain of the email sender, where the score indicates a probability that the email is from a legitimate sender. Message content of the email is input into multiple classifiers each corresponding to a particular message type. The message type of the email is determined based on output of the classifiers. Based on at least the determined score for the email and the determined message type of the email, a determination is made whether the email is associated with a BEC attack.

Business email compromise detection system

A method includes receiving, from a pre-processor, an output file, the output file having been created by the pre-processor in response to input of an electronic file to the pre-processor, the electronic file being an attachment to an electronic mail message that is in-transit to a recipient computer on a network, the electronic file being a spreadsheet file, the output file containing features that are created by the pre-processor; receiving, from a machine learning-based classifier, malware classification data, the malware classification data being output by the machine learning-based classifier in response to the machine learning-based classifier determining whether the features are indicators of obfuscation, the data used to create the machine learning-based classifier including output files previously created by the pre-processor; in response to the malware classification data matching a criterion, causing the network to modify, delay, or block transmission of the electronic file to the recipient computer.

Machine learning-based malicious attachment detector

In an embodiment, a computer-implemented method includes receiving, from a pre-processor, an output file; where the output file is created by the pre-processor in response to input of an electronic file to the pre-processor; where the electronic file is an attachment to a message that is in-transit to a recipient computer on a network; where the output file contains features that are created by the pre-processor analyzing one or more sub-features of the electronic file; receiving, from a machine learning-based classifier, malware classification data that indicates whether the electronic file does or does not contain malware; where the malware classification data is output by the machine learning-based classifier in response to the machine learning-based classifier determining that the features are or are not indicators of obfuscation; where data used to create the machine learning-based classifier includes output files previously created by the pre-processor; in response to the malware classification data matching a criterion, causing the network to modify, delay, or block transmission of the electronic file to the recipient computer.

In an embodiment, the disclosed technologies monitor electronic message traffic between a network and a recipient computer system. An embodiment includes obtaining, from an electronic message received from the network, a triple of a display name, email address, and sending domain, determining a name score for triple, and determining characteristics of the electronic message. The name score of the triple and the characteristics of the electronic message may be used to determine whether the electronic message is a spoofing attack such as a business email compromise (BEC) attack. In response to determining that the electronic message is malicious, an embodiment may cause the network to at least one of modify, delay, re-route, or block transmission of the electronic message to the recipient computer system.

In an embodiment, the disclosed technologies monitor electronic message traffic between a network and a recipient computer system. An embodiment includes extracting, from an electronic message received from the network, a sending domain and message data, computing a lookalike score based on the sending domain, and assigning a message type to the electronic message based on the message data. The lookalike score and the message type may be used to determine whether the electronic message is a spoofing attack such as a business email compromise (BEC) attack. In response to determining that the electronic message is malicious, an embodiment may cause the network to at least one of modify, delay, re-route, or block transmission of the electronic message to the recipient computer system.

Message processing system with business email compromise detection

Techniques are described herein for detecting malicious program code stored on computer devices before the code can be executed to potentially compromise a computer network. In an embodiment, a method comprises receiving, at a computer device, a file containing instructions in a programming language; based on a syntax of the programming language, parsing the file to generate parsed information, and based on the parsed information, generating a syntax tree for the file; identifying one or more alphanumeric strings in the syntax tree, and based on the alphanumeric strings, generating a syntax string for the syntax tree; generating a hash digest by applying a piecewise hashing to the alphanumeric strings in the syntax string; determining whether the hash digest indicates that the file contains potentially malicious code; in response to determining that the hash digest indicates that the file contains the potentially malicious code, performing a responsive action.

Detecting malicious program code using similarity of hashed parsed trees

Enhanced diarization systems and methods of use are provided herein. Some exemplary methods may include applying one or more rules that affect separation of the call audio data into segments, the rules being associated with the at least one call schema, separating the call audio data into segments according to the one or more rules, grouping segments of call audio data associated with a speaker, and storing in a storage media an identifier and the grouped segments for the speaker.

Enhanced diarization systems, media and methods of use

Systems and methods for authenticating callers are disclosed that may obtain identifying data and a voice print, and compare the voice print to one or more stored voice prints. Further, one or more initial scores may be calculated based on the data and the comparison, and a confidence interval score may also be calculated. The systems and methods may determine whether to authenticate based on the one or more initial scores and the confidence interval score.

Systems and methods for identifying a caller

Systems, methods, and media for disambiguating call data are provided herein. Some exemplary methods include receiving, via a fraud notification system, notification of a fraud event associated with a customer account, the fraud event comprising a time stamp, determining, via a call selection module, unique voice samples or models from call events obtained within a time frame that is temporally proximate the fraud event, and generating a timeline presentation that includes each unique voice sample or model identified in the call events based upon a time stamp associated with the call events.

Systems, methods, and media for disambiguating call data to determine fraud

Systems, methods, and media for generating fused risk scores for determining fraud in call data are provided herein. Some exemplary methods include generating a fused risk score used to determine fraud from call data by generating a fused risk score for a leg of call data, via a fuser module of an analysis system, the fused risk score being generated by fusing together two or more uniquely calculated fraud risk scores, each of the uniquely calculated fraud risk scores being generated by a sub-module of the analysis system; and storing the fused risk score in a storage device that is communicatively couplable with the fuser module.

Systems, methods, and media for generating hierarchical fused risk scores

An application stored in a mobile device is provisioned using provisioning data received from remote data storage via a network. Provisioning data is obtained at no cost to a user of the mobile device. In some implementations, the provisioning data is received after the mobile device requests to establish a data channel with a data network. The data network is identified using a predetermined identifier that the network recognizes. If the network does not recognize the special identifier, no data channel is established. After a data channel is established, the mobile device requests provisioning data from the remote data storage. In some implementations, the mobile device receives a provisioning message through a predetermined port. The provisioning message either includes provisioning data or prompts the mobile device to obtain provisioning data.

No-cost mobile device messaging, such as for provisioning an application on a mobile device

A method and system for barge-in acknowledgement are disclosed. A prompt is attenuated upon detection of speech. The speech is accepted and the prompt is terminated if the speech corresponds to an allowable response.

Growing community of inventors

Emerald Hills, CA, United States of America

Torsten Zeppenfeld