Retrospective campaign detection, categorization, classification, and remediation

Abstract

This disclosure describes techniques and mechanisms to retroactively identifying, classifying, categorizing, and/or remediating campaigns by an email threat defense system. The described techniques may perform a time-series analysis on record data associated with emails and identify campaigns that have bypassed threat detection mechanisms. The described techniques may extract and correlate features of the record data in order to label and determine whether a campaign is malicious. Where the email campaign is malicious, remedial action(s) can occur. Accordingly, the described techniques may remediate false negatives in a network and improve network security.