Abnormal Security Corporation

Umut Gultepe

Jeshua Alexis Bratman

Sanjay Jeyakumar

Cheng-Lin Yeh

Dmitry Chechik

Hariank Sagar Muthakana

Sanny Xiao Lang Liao

Raphael Kargon

Erin Elisabeth Edkins Ludert

Abhijit Bagri

Jeremy Kao

Rami Faris Habal

Yea So Jung

Fang Shuo Deng

Yu Zhou Lee

Michael Douglas Kralka

Micah J Zirn

Introduced here are threat detection platforms designed to discover possible instances of email account compromise in order to identify threats to an enterprise. In particular, a threat detection platform can examine the digital activities performed with the email accounts associated with employees of the enterprise to determine whether any email accounts are exhibiting abnormal behavior. Examples of digital activities include the reception of an incoming email, transmission of an outgoing email, creation of a mail filter, and occurrence of a sign-in event (also referred to as a 'login event'). Thus, the threat detection platform can monitor the digital activities performed with a given email account to determine the likelihood that the given email account has been compromised.

Discovering email account compromise through assessments of digital activities

A plurality of features associated with a message are determined. At least one feature included in the plurality of features is associated with a payload of the message. A determination is made that supplemental analysis should be performed on the message. The determination is based at least in part on performing behavioral analysis using at least some of the features included in the plurality of features. Supplemental analysis is performed.

Multi-tiered approach to payload detection for incoming communications

Introduced here are computer programs and computer-implemented techniques for building, training, or otherwise developing models of the behavior of employees across more than one channel used for communication. These models can be stored in profiles that are associated with the employees. At a high level, these profiles allow behavior to be monitored across multiple channels so that deviations can be detected and then examined. Moreover, remediation may be performed if an account is determined to be compromised based on its recent activity.

Multichannel threat detection for protecting against account compromise

Techniques for building, training, or otherwise developing models of the behavior of employees across more than one channel used for communication are disclosed. These models can be stored in profiles that are associated with the employees. Such profiles allow behavior to be monitored across multiple channels so that deviations can be detected and then examined. Remediation can be performed if an account is determined to be compromised based on its recent activity.

Growing community of inventors

Sausalito, CA, United States of America

Umut Gultepe