# US 10,375,093 B1 · Suspicious message report processing and threat response > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,093 B1 - Document ID: US10375093B1 - Status: Granted - Kind: B1 - Application number: 16/418,973 - Filed: 2019-05-21 - Granted: 2019-08-06 - Earliest claimed: 2015-04-10 - Assignees: Cofense Inc - Applicants: Confense Inc - Inventors: Aaron Higbee; Rohyt Belani; Scott Greaux; William Galway; Douglas Hagen - Web page: https://patentgrep.com/patent/US10375093B1 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 16/35: Clustering; Classification - G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity - G06F 21/554: {involving event detection and direct action} - H04L 51/212: using filtering or selective blocking - H04L 63/1433: {Vulnerability analysis} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 51/08: Annexed information, e.g. attachments - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The present invention relates to methods, network devices, and machine-readable media for an integrated environment for automated processing of reports of suspicious messages, and furthermore, to a network for distributing information about detected phishing attacks. ## Claims ### Claim 1 A computerized method for suspicious message processing and incident response, comprising: providing computer-executable instructions for a messaging client, the computer-executable instructions for: receiving a user interface action by a user indicating that a message delivered in an account associated with an individual has been identified by the user as a potential security threat; determining whether the delivered message is a known simulated phishing attack based on an identifier or other message characteristic of the delivered message; if the delivered message is determined to be a known simulated phishing attack based on the identifier or other message characteristic of the delivered message, then not transmitting a copy of the delivered message to a detection platform; and if the delivered message is determined not to be a known simulated phishing attack based on the identifier or other message characteristic of the delivered message, then transmitting a copy of the delivered message to the detection platform; providing computer-executable instructions for a threat detection platform, the computer-executable instructions for: receiving the transmitted copy of the message at the threat detection platform; electronically storing a pattern as a rule for determining whether a body of the received message or an attachment of the received message contains a defined textual or binary pattern associated with a security threat; processing the received message according to the electronically stored rule to determine whether the body of the received message or an attachment of the received message contains the defined textual or binary pattern associated with the security threat; assigning a further processing action to the received message based on the determination of whether the received message contains the defined textual or binary pattern; associating the received message with a message group, the message group being defined by having at least the defined textual or binary pattern in common with the received message; and displaying a graphical representation of the message group, each of the group of messages displayed having been determined not to be a known simulated phishing attack based on the identifier or other message characteristic of the delivered message. ### Claim 2 (depends on 1) The method of claim 1, further comprising enabling access to a message server for removing messages from messaging accounts associated with multiple users. ### Claim 3 (depends on 2) The method of claim 2, further comprising generating a command to remove the received message from a user inbox. ### Claim 4 (depends on 1) The method of claim 1, further comprising removing one or more messages from messaging accounts associated with multiple users based on a matching of at least a portion of header information of the delivered message or at least a portion of metadata of the delivered message with the one or more messages from the messaging accounts associated with the multiple users. ### Claim 5 (depends on 1) The method of claim 1, further comprising executing a remedial action on a network device based on the comparison of the delivered message against stored rules for determining whether message or attachment data contains a pre-defined textual or a pre-defined binary pattern. ### Claim 6 (depends on 1) The method of claim 1, further comprising configuring an inbound mail sever to generate a command to remove one or more messages to render the delivered message inaccessible to the user. ### Claim 7 (depends on 1) The method of claim 1, further comprising performing an operation on one or more messages in the message group, wherein the operation comprises one of deleting the message from a user inbox, quarantining the message from a user inbox, classifying the message, and responding to the message. ### Claim 8 (depends on 1) The method of claim 1, wherein each message group is displayed as an active link which, when selected, displays additional information about the selected message group. ### Claim 9 (depends on 1) The method of claim 1, wherein the delivered message is classified as malicious if the delivered message is assigned to a message group having a threshold number of messages. ### Claim 10 (depends on 1) The method of claim 1, wherein the delivered message is classified as non-malicious based on a determination that the message group to which the delivered message is assigned is non-malicious. ### Claim 11 (depends on 1) The method of claim 1, further comprising executing an integration, wherein the integration comprises one or more of opening a link contained in the delivered message data in a simulated environment, opening attachment data in a simulated environment, and scanning the delivered message for malicious content, and querying a database of known threat activity with data extracted from the delivered message. ### Claim 12 (depends on 1) The method of claim 1, wherein at least a portion of a message body of the delivered message or at least a portion of header information of the delivered message or at least a portion of metadata of the delivered message is communicated for threat processing. ### Claim 13 (depends on 1) The method of claim 1, further comprising providing an interface for creating a set of executable instructions based on at least one characteristic of at least one message from a corresponding message group. ### Claim 14 (depends on 1) The method of claim 1, further comprising providing an interface for specifying one or more rules for automatically responding to a notification by a pre-configured response message. ### Claim 15 (depends on 1) The method of claim 1, wherein if the delivered message is determined to be a known simulated phishing attack, providing feedback to the individual confirming that the delivered message was a simulated phishing attack. ### Claim 16 (depends on 1) The method of claim 1, further comprising: labeling as suspicious messages that are not cleared by initial rules pattern matching processing; and grouping the messages labeled as suspicious in a group of suspicious messages. ### Claim 17 (depends on 1) The method of claim 1, further comprising automatically responding to a user with a message indicating that the delivered message is legitimate, and removing the delivered message from display in a management console. ### Claim 18 (depends on 1) The method of claim 1, wherein the at least one characteristic in common with the delivered message includes a domain of a Uniform Resource Locator in the body of the received message or a hash of an attachment to received message. ### Claim 19 A computerized system for suspicious message processing and incident response, comprising: a processor configured for executing instructions at a messaging client, the computer-executable instructions for: receiving a user interface action by a user indicating that a message delivered in an account associated with an individual has been identified by the user as a potential security threat; determining whether the delivered message is a known simulated phishing attack based on an identifier or other message characteristic of the delivered message; if the delivered message is determined to be a known simulated phishing attack based on the identifier or other message characteristic of the delivered message, then not transmitting a copy of the delivered message to a detection platform; and if the delivered message is determined not to be a known simulated phishing attack based on the identifier or other message characteristic of the delivered message, then transmitting a copy of the delivered message to the detection platform; a processor configured for executing instructions at a threat detection platform, the computer-executable instructions for: receiving the transmitted copy of the message at the threat detection platform; electronically storing a pattern as a rule for determining whether a body of the received message or an attachment of the received message contains a defined textual or binary pattern associated with a security threat; processing the received message according to the electronically stored rule to determine whether the body of the received message or an attachment of the received message contains the defined textual or binary pattern associated with a security threat; assigning a further processing action to the received message based on the determination of whether the received message contains the defined textual or binary pattern; associating the received message with a message group, the message group being defined by having at least the defined textual or binary pattern in common with the received message; and displaying a graphical representation of the message group, each of the group of messages displayed having been determined not to be a known simulated phishing attack based on the identifier or other message characteristic of the delivered message. ### Claim 20 (depends on 19) The system of claim 19, further comprising enabling access to a message server for removing messages from messaging accounts associated with multiple users. ### Claim 21 (depends on 20) The system of claim 20, further comprising generating a command to remove the received message from a user inbox. ### Claim 22 (depends on 19) The system of claim 19, further comprising removing one or more messages from messaging accounts associated with multiple users based on a matching of at least a portion of header information of the delivered message or at least a portion of metadata of the delivered message with the one or more messages from the messaging accounts associated with the multiple users. ### Claim 23 (depends on 19) The system of claim 19, further comprising executing a remedial action on a network device based on the comparison of the delivered message against stored rules for determining whether message or attachment data contains a pre-defined textual or a pre-defined binary pattern. ### Claim 24 (depends on 19) The system of claim 19, further comprising configuring an inbound mail sever to generate a command to remove one or more messages to render the delivered message inaccessible to the user. ### Claim 25 (depends on 19) The system of claim 19, further comprising performing an operation on one or more messages in the message group, wherein the operation comprises one of deleting the message from a user inbox, quarantining the message from a user inbox, classifying the message, and responding to the message. ### Claim 26 (depends on 19) The system of claim 19, wherein each message group is displayed as an active link which, when selected, displays additional information about the selected message group. ### Claim 27 (depends on 19) The system of claim 19, wherein the delivered message is classified as malicious if the delivered message is assigned to a message group having a threshold number of messages. ### Claim 28 (depends on 19) The system of claim 19, wherein the delivered message is classified as non-malicious based on a determination that the message group to which the delivered message is assigned is non-malicious. ### Claim 29 (depends on 19) The system of claim 19, further comprising executing an integration, wherein the integration comprises one or more of opening a link contained in the delivered message data in a simulated environment, opening attachment data in a simulated environment, and scanning the delivered message for malicious content, and querying a database of known threat activity with data extracted from the delivered message. ### Claim 30 (depends on 19) The system of claim 19, wherein at least a portion of a message body of the delivered message or at least a portion of header information of the delivered message or at least a portion of metadata of the delivered message is communicated for threat processing.