Abnormal Security Corporation

Abnormal Ai, Inc.

Yu Zhou Lee

Jeshua Alexis Bratman

Sanjay Jeyakumar

Cheng-Lin Yeh

Kai Jing Jiang

Su Li Debbie Tan

Dmitry Chechik

Jeremy Kao

Abhijit Bagri

Kevin Lau

Evan James Reiser

Carlos Daniel Gasperi

Lawrence Stockton Moore

Lei Xu

Sanny Xiao Yang Liao

Rami Faris Habal

Sanny Xiao Lang Liao

Geng Sng

Joey Esteban Cerquera

Nishant Bhalchandra Karandikar

Yea So Jung

Umut Gultepe

Fang Shuo Deng

Micah J Zirn

Michael Douglas Kralka

Oz Wasserman

Introduced here are computer programs and computer-implemented techniques for generating and then managing a federated database that can be used to ascertain the risk in interacting with vendors. At a high level, the federated database allows knowledge regarding the reputation of vendors to be shared amongst different enterprises with which those vendors may interact. A threat detection platform may utilize the federated database when determining how to handle incoming emails from vendors.

Federated database for establishing and tracking risk of interactions with third parties

Conventional email filtering services are not suitable for recognizing sophisticated malicious emails, and therefore may allow sophisticated malicious emails to reach inboxes by mistake. Introduced here are threat detection platforms designed to take an integrative approach to detecting security threats. For example, after receiving input indicative of an approval from an individual to access past email received by employees of an enterprise, a threat detection platform can download past emails to build a machine learning (ML) model that understands the norms of communication with internal contacts (e.g., other employees) and/or external contacts (e.g., vendors). By applying the ML model to incoming email, the threat detection platform can identify security threats in real time in a targeted manner.

Programmatic discovery, retrieval, and analysis of communications to identify abnormal communication activity

Multistage analysis of emails to identify security threats

Selectively rewriting URLs is disclosed. An indication is received that a message has arrived at a user message box. A determination is made that the message includes a first link to a first resource. The first link is analyzed to determine whether the first link is classified as a non-rewrite link. In response to determining that the first link is not classified as a non-rewrite link, a first replacement link is generated for the first link.

URL rewriting

A plurality of features associated with a message are determined. At least one feature included in the plurality of features is associated with a payload of the message. A determination is made that supplemental analysis should be performed on the message. The determination is based at least in part on performing behavioral analysis using at least some of the features included in the plurality of features. Supplemental analysis is performed.

Multi-tiered approach to payload detection for incoming communications

Threat detection platforms for detecting, characterizing, and remediating email-based threats in real time

Retrospective learning of communication patterns by machine learning models for discovering abnormal behavior

Deriving and surfacing insights regarding security threats is disclosed. A plurality of features associated with a message is determined. A plurality of facet models is used to analyze the determined features. Based at least in part on the analysis, it is determined that the message poses a security threat. A prioritized set of information is determined to be provided as output that is representative of why the message was determined to pose a security threat. At least a portion of the prioritized set of information is provided as output.

Deriving and surfacing insights regarding security threats

Techniques for detecting instances of external fraud by monitoring digital activities that are performed with accounts associated with an enterprise are disclosed. In one example, a threat detection platform determines the likelihood that an incoming email is indicative of external fraud based on the context and content of the incoming email. To understand the risk posed by an incoming email, the threat detection platform may seek to determine not only whether the sender normally communicates with the recipient, but also whether the topic is one normally discussed by the sender and recipient. In this way, the threat detection platform can establish whether the incoming email deviates from past emails exchanged between the sender and recipient.

Detection and prevention of external fraud

Estimating risk posed by interacting with third parties through analysis of emails addressed to employees of multiple enterprises

Approaches to creating, managing, and applying a federated database to establish risk posed by third parties

Growing community of inventors

San Francisco, CA, United States of America

Yu Zhou Lee