公开(公告)号：US20240291834A1

公开(公告)日：2024-08-29

申请号：US18617282

申请日：2024-03-26

Applicant: Abnormal Security Corporation

Inventor： Sanjay Jeyakumar ,  Jeshua Alexis Bratman ,  Dmitry Chechik ,  Abhijit Bagri ,  Evan Reiser ,  Sanny Xiao Lang Liao ,  Yu Zhou Lee ,  Carlos Daniel Gasperi ,  Kevin Lau ,  Kai Jing Jiang ,  Su Li Debbie Tan ,  Jeremy Kao ,  Cheng-Lin Yeh

IPC: H04L9/40 ,  G06F16/951 ,  G06F16/955 ,  G06F16/958 ,  G06N20/00 ,  G06Q10/107

CPC classification number: H04L63/1416 ,  G06F16/951 ,  G06F16/9558 ,  G06F16/986 ,  G06N20/00 ,  G06Q10/107 ,  H04L63/1483

Abstract: Access to emails delivered to an employee of an enterprise is received. An incoming email addressed to the employee is acquired. A primary attribute is extracted from the incoming email by parsing at least one of: (1) content of the incoming email or (2) metadata associated with the incoming email. It is determined whether the incoming email deviates from past email activity, at least in part by determining, as a secondary attribute, a mismatch between a previous value for the primary attribute and a current value for the primary attribute, using a communication profile associated with the employee, and providing a measured deviation to at least one machine learning model.

公开(公告)号：US11381581B2

公开(公告)日：2022-07-05

申请号：US16927427

申请日：2020-07-13

Applicant: Abnormal Security Corporation

Inventor： Sanjay Jeyakumar ,  Jeshua Alexis Bratman ,  Dmitry Chechik ,  Abhijit Bagri ,  Evan James Reiser ,  Sanny Xiao Yang Liao ,  Yu Zhou Lee ,  Carlos Daniel Gasperi ,  Kevin Lau ,  Kai Jing Jiang ,  Su Li Debbie Tan ,  Jeremy Kao ,  Cheng-Lin Yeh

IPC: H04L29/06 ,  G06F16/958 ,  G06N20/00 ,  G06F16/951 ,  G06Q10/10 ,  G06F16/955 ,  H04L9/40

Abstract: Conventional email filtering services are not suitable for recognizing sophisticated malicious emails, and therefore may allow sophisticated malicious emails to reach inboxes by mistake. Introduced here are threat detection platforms designed to take an integrative approach to detecting security threats. For example, after receiving input indicative of an approval from an individual to access past email received by employees of an enterprise, a threat detection platform can download past emails to build a machine learning (ML) model that understands the norms of communication with internal contacts (e.g., other employees) and/or external contacts (e.g., vendors). By applying the ML model to incoming email, the threat detection platform can identify security threats in real time in a targeted manner.

公开(公告)号：US20210266294A1

公开(公告)日：2021-08-26

申请号：US17094801

申请日：2020-11-10

Applicant: Abnormal Security Corporation

Inventor： Dmitry Chechik ,  Umut Gultepe ,  Raphael Kargon ,  Jeshua Alexis Bratman ,  Cheng-Lin Yeh ,  Sanny Xiao Lang Liao ,  Erin Elisabeth Edkins Ludert ,  Sanjay Jeyakumar

IPC: H04L29/06 ,  H04L12/58

Abstract: Introduced here are threat detection platforms designed to discover possible instances of email account compromise in order to identify threats to an enterprise. In particular, a threat detection platform can examine the digital activities performed with the email accounts associated with employees of the enterprise to determine whether any email accounts are exhibiting abnormal behavior. Examples of digital activities include the reception of an incoming email, transmission of an outgoing email, creation of a mail filter, and occurrence of a sign-in event (also referred to as a “login event”). Thus, the threat detection platform can monitor the digital activities performed with a given email account to determine the likelihood that the given email account has been compromised.

公开(公告)号：US11831661B2

公开(公告)日：2023-11-28

申请号：US17831335

申请日：2022-06-02

Applicant: Abnormal Security Corporation

Inventor： Yu Zhou Lee ,  Micah J. Zirn ,  Umut Gultepe ,  Jeshua Alexis Bratman ,  Michael Douglas Kralka ,  Cheng-Lin Yeh ,  Dmitry Chechik ,  Sanjay Jeyakumar

IPC: H04L9/40 ,  H04L51/212 ,  H04L51/08

CPC classification number: H04L63/1416 ,  H04L51/08 ,  H04L51/212 ,  H04L63/145 ,  H04L63/20

Abstract: A plurality of features associated with a message are determined. At least one feature included in the plurality of features is associated with a payload of the message. A determination is made that supplemental analysis should be performed on the message. The determination is based at least in part on performing behavioral analysis using at least some of the features included in the plurality of features. Supplemental analysis is performed.

公开(公告)号：US20220286432A1

公开(公告)日：2022-09-08

申请号：US17751261

申请日：2022-05-23

Applicant: Abnormal Security Corporation

Inventor： Dmitry Chechik ,  Umut Gultepe ,  Raphael Kargon ,  Jeshua Alexis Bratman ,  Cheng-Lin Yeh ,  Sanny Xiao Lang Liao ,  Erin Elisabeth Edkins Ludert ,  Sanjay Jeyakumar ,  Hariank Sagar Muthakana

IPC: H04L9/40 ,  H04L51/212 ,  H04L51/222

Abstract: Introduced here are threat detection platforms designed to discover possible instances of email account compromise in order to identify threats to an enterprise. In particular, a threat detection platform can examine the digital activities performed with the email accounts associated with employees of the enterprise to determine whether any email accounts are exhibiting abnormal behavior. Examples of digital activities include the reception of an incoming email, transmission of an outgoing email, creation of a mail filter, and occurrence of a sign-in event (also referred to as a “login event”). Thus, the threat detection platform can monitor the digital activities performed with a given email account to determine the likelihood that the given email account has been compromised.

公开(公告)号：US11431738B2

公开(公告)日：2022-08-30

申请号：US16927427

申请日：2020-07-13

Applicant: Abnormal Security Corporation

Inventor： Sanjay Jeyakumar ,  Jeshua Alexis Bratman ,  Dmitry Chechik ,  Abhijit Bagri ,  Evan James Reiser ,  Sanny Xiao Yang Liao ,  Yu Zhou Lee ,  Carlos Daniel Gasperi ,  Kevin Lau ,  Kai Jing Jiang ,  Su Li Debbie Tan ,  Jeremy Kao ,  Cheng-Lin Yeh

IPC: H04L29/06 ,  G06F16/958 ,  G06N20/00 ,  G06F16/951 ,  G06Q10/10 ,  G06F16/955 ,  H04L9/40

Abstract: Conventional email filtering services are not suitable for recognizing sophisticated malicious emails, and therefore may allow sophisticated malicious emails to reach inboxes by mistake. Introduced here are threat detection platforms designed to take an integrative approach to detecting security threats. For example, after receiving input indicative of an approval from an individual to access past email received by employees of an enterprise, a threat detection platform can download past emails to build a machine learning (ML) model that understands the norms of communication with internal contacts (e.g., other employees) and/or external contacts (e.g., vendors). By applying the ML model to incoming email, the threat detection platform can identify security threats in real time in a targeted manner.

公开(公告)号：US11336666B2

公开(公告)日：2022-05-17

申请号：US16927427

申请日：2020-07-13

Applicant: Abnormal Security Corporation

Inventor： Sanjay Jeyakumar ,  Jeshua Alexis Bratman ,  Dmitry Chechik ,  Abhijit Bagri ,  Evan James Reiser ,  Sanny Xiao Yang Liao ,  Yu Zhou Lee ,  Carlos Daniel Gasperi ,  Kevin Lau ,  Kai Jing Jiang ,  Su Li Debbie Tan ,  Jeremy Kao ,  Cheng-Lin Yeh

IPC: H04L29/06 ,  G06F16/958 ,  G06N20/00 ,  G06F16/951 ,  G06Q10/10 ,  G06F16/955

Abstract: Conventional email filtering services are not suitable for recognizing sophisticated malicious emails, and therefore may allow sophisticated malicious emails to reach inboxes by mistake. Introduced here are threat detection platforms designed to take an integrative approach to detecting security threats. For example, after receiving input indicative of an approval from an individual to access past email received by employees of an enterprise, a threat detection platform can download past emails to build a machine learning (ML) model that understands the norms of communication with internal contacts (e.g., other employees) and/or external contacts (e.g., vendors). By applying the ML model to incoming email, the threat detection platform can identify security threats in real time in a targeted manner.

公开(公告)号：US20220394047A1

公开(公告)日：2022-12-08

申请号：US17831335

申请日：2022-06-02

Applicant: Abnormal Security Corporation

Inventor： Yu Zhou Lee ,  Micah J. Zirn ,  Umut Gultepe ,  Jeshua Alexis Bratman ,  Michael Douglas Kralka ,  Cheng-Lin Yeh ,  Dmitry Chechik ,  Sanjay Jeyakumar

IPC: H04L9/40 ,  H04L51/08 ,  H04L51/212

Abstract: A plurality of features associated with a message are determined. At least one feature included in the plurality of features is associated with a payload of the message. A determination is made that supplemental analysis should be performed on the message. The determination is based at least in part on performing behavioral analysis using at least some of the features included in the plurality of features. Supplemental analysis is performed.

公开(公告)号：US20210297444A1

公开(公告)日：2021-09-23

申请号：US17341200

申请日：2021-06-07

Applicant: Abnormal Security Corporation

Inventor： Sanjay Jeyakumar ,  Jeshua Alexis Bratman ,  Dmitry Chechik ,  Abhijit Bagri ,  Evan James Reiser ,  Sanny Xiao Yang Liao ,  Yu Zhou Lee ,  Carlos Daniel Gasperi ,  Kevin Lau ,  Kai Jing Jiang ,  Su Li Debbie Tan ,  Jeremy Kao ,  Cheng-Lin Yeh

IPC: H04L29/06 ,  G06Q10/10 ,  G06F16/901 ,  H04L12/24 ,  H04L12/58

Abstract: Conventional email filtering services are not suitable for recognizing sophisticated malicious emails, and therefore may allow sophisticated malicious emails to reach inboxes by mistake. Introduced here are threat detection platforms designed to take an integrative approach to detecting security threats. For example, after receiving input indicative of an approval from an individual to access past email received by employees of an enterprise, a threat detection platform can download past emails to build a machine learning (ML) model that understands the norms of communication with internal contacts (e.g., other employees) and/or external contacts (e.g., vendors). By applying the ML model to incoming email, the threat detection platform can identify security threats in real time in a targeted manner.

公开(公告)号：US11050793B2

公开(公告)日：2021-06-29

申请号：US16927335

申请日：2020-07-13

Applicant: Abnormal Security Corporation

Inventor： Sanjay Jeyakumar ,  Jeshua Alexis Bratman ,  Dmitry Chechik ,  Abhijit Bagri ,  Evan James Reiser ,  Sanny Xiao Yang Liao ,  Yu Zhou Lee ,  Carlos Daniel Gasperi ,  Kevin Lau ,  Kai Jing Jiang ,  Su Li Debbie Tan ,  Jeremy Kao ,  Cheng-Lin Yeh

IPC: H04L29/06 ,  G06N20/00

Abstract: Conventional email filtering services are not suitable for recognizing sophisticated malicious emails, and therefore may allow sophisticated malicious emails to reach inboxes by mistake. Introduced here are threat detection platforms designed to take an integrative approach to detecting security threats. For example, after receiving input indicative of an approval from an individual to access past email received by employees of an enterprise, a threat detection platform can download past emails to build a machine learning (ML) model that understands the norms of communication with internal contacts (e.g., other employees) and/or external contacts (e.g., vendors). By applying the ML model to incoming email, the threat detection platform can identify security threats in real time in a targeted manner.