Method and system for email phishing attempts identification and notification through organizational cognitive solutions

A computer program product for detecting malicious email messages, the computer program product comprising a non-transitory computer readable storage having program instructions embodied therewith, the program instructions executable by a computer, to cause the computer to perform a method comprising:

• constructing a behavioral model for an organization and a behavioral model for each user in the organization based on features extracted from a plurality of email messages of the organization and of each user and based on information relating to the organization and to each user, including analyzing behavioral patterns of emails in the organization and of each user with regard to the extracted features;
• analyzing a plurality of new email messages of the organization and of each user using the behavioral model for the organization and the behavioral models for each user in the organization to determine non-binary scores representing analysis of features of the messages, including behavioral patterns of the new emails in the organization with regard to the features;
• determining whether any of the plurality of new email messages are malicious email messages based on the non-binary scores for the new email messages indicating that the new email messages deviate more than an amount of deviation needed to indicate an outlier from the behavioral patterns of emails and of each user based on the behavioral model of that user, wherein the amount of deviation needed to indicate an outlier depends upon the features of the message and the behavioral patterns in each model, wherein an outlier comprises an email subject that is untypical from a certain role as determined from modeling of typical email patterns of roles in the organization using organizational tables of roles may be accessed to identify emails that are typical between some roles, but are not typical between other roles and a non-binary phishing score that is an unlikely value for a particular role or group within the organization, wherein the value that is unlikely varies depending on behavioral characteristics of the particular role or group in within the organization, and further determining whether any of the plurality of new email messages are malicious email messages based on the non-binary scores for the new email messages indicating that the new email messages deviate from the behavioral patterns of emails in the organization based on the behavioral model of the organization;
• and
• transmitting a notification that an email message is a malicious email message.

A system for detecting malicious email messages, the system comprising a processor, memory accessible by the processor, and computer program instructions stored in the memory and executable by the processor to perform:

• constructing a behavioral model for an organization and a behavioral model for each user in the organization based on features extracted from a plurality of email messages of the organization and of each user and based on information relating to the organization and to each user, including analyzing behavioral patterns of emails in the organization and of each user with regard to the extracted features;
• analyzing a plurality of new email messages of the organization and of each user using the behavioral model for the organization and the behavioral models for each user in the organization to determine non-binary scores representing analysis of features of the messages, including behavioral patterns of the new emails in the organization with regard to the features;
• determining whether any of the plurality of new email messages are malicious email messages based on the non-binary scores for the new email messages indicating that the new email messages deviate more than an amount of deviation needed to indicate an outlier from the behavioral patterns of emails and of each user based on the behavioral model of that user, wherein the amount of deviation needed to indicate an outlier depends upon the features of the message and the behavioral patterns in each model, wherein an outlier comprises an email subject that is untypical from a certain role as determined from modeling of typical email patterns of roles in the organization using organizational tables of roles may be accessed to identify emails that are typical between some roles, but are not typical between other roles and a non-binary phishing score that is an unlikely value for a particular role or group within the organization, wherein the value that is unlikely varies depending on behavioral characteristics of the particular role or group in within the organization, and further determining whether any of the plurality of new email messages are malicious email messages based on the non-binary scores for the new email messages indicating that the new email messages deviate from the behavioral patterns of emails in the organization based on the behavioral model of the organization;
• and
• transmitting a notification that an email message is a malicious email message.