# US 11,122,074 B2 · System and method for omnichannel social engineering attack avoidance > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,122,074 B2 - Document ID: US11122074B2 - Status: Granted - Kind: B2 - Application number: 15/719,900 - Filed: 2017-09-29 - Published: 2018-04-05 - Granted: 2021-09-14 - Earliest claimed: 2016-10-03 - Assignees: Telepathy Labs, Inc. - Applicants: Telepathy Labs, Inc. - Inventors: Damien Phelan Stolarz; Johanna Dwyer; Ronald J. Pollack - Web page: https://patentgrep.com/patent/US11122074B2 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06N 3/044: Recurrent networks, e.g. Hopfield networks - G06N 3/0499: Feedforward networks - G06N 3/084: Backpropagation, e.g. using gradient descent - G06N 3/09: Supervised learning - G06N 5/02: Knowledge representation; Symbolic representation - G06N 5/043: Distributed expert systems; Blackboards - G06N 20/00: Machine learning - G10L 15/26: Speech to text systems (G10L15/08 takes precedence) - H04K 1/00: Secret communication - H04L 51/212: using filtering or selective blocking - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L 67/306: User profiles - H04W 12/08: Access security - H04W 12/12: Detection or prevention of fraud - H04L 51/18: Commands or executable codes - H04L 51/52: for supporting social networking services - H04W 4/21: for social networking applications - H04W 12/67: Risk-dependent, e.g. selecting a security level depending on risk profiles - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - G10L: SPEECH ANALYSIS TECHNIQUES OR SPEECH SYNTHESIS; SPEECH RECOGNITION; SPEECH OR VOICE PROCESSING TECHNIQUES; SPEECH OR AUDIO CODING OR DECODING - H04K: SECRET COMMUNICATION; JAMMING OF COMMUNICATION - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A method, computer program product, and computer system for identifying social engineering activity associated with at least one of a first communication and a second communication based upon, at least in part, correlation to a predetermined rule. Characteristics of the communications are compared to the predetermined rule to determine if there is a correlation. ## Claims ### Claim 1 A computer-implemented method comprising: identifying, by a computing device, a first characteristic of a first communication received on a first communication channel; identifying a second characteristic of a second communication received on a second communication channel, wherein both the first communication channel and the second communication channel are different communication platforms; comparing, with a predetermined rule, both the first characteristic of the first communication received on the first communication channel and the second characteristic of the second communication received on the second communication channel, wherein the first characteristic and the second characteristic are different characteristics; determining that both the first characteristic of the first communication received on the first communication channel and the second characteristic of the second communication received on the second communication channel correlates to the predetermined rule by performing an assessment of both similarities and differences of text for the first communication and the second communication compared to text of at least one of malicious and non-malicious communications; and identifying potential social engineering activity associated with at least one of the first communication and the second communication based upon, at least in part, correlating both the first characteristic of the first communication received on the first communication channel and the second characteristic of the second communication received on the second communication channel to the predetermined rule. ### Claim 2 (depends on 1) The computer-implemented method of claim 1 wherein the predetermined rule includes receiving the first communication and the second communication by a same user. ### Claim 3 (depends on 1) The computer-implemented method of claim 1 wherein the predetermined rule includes receiving the first communication by a first user and receiving the second communication by a user related to the first user. ### Claim 4 (depends on 1) The computer-implemented method of claim 1 wherein the predetermined rule includes a pattern between the first characteristic of the first communication received on the first communication channel and the second characteristic of the second communication received on the second communication channel. ### Claim 5 (depends on 1) The computer-implemented method of claim 1 wherein the first communication channel is a first communication platform and the second communication channel is a second communication platform. ### Claim 6 (depends on 1) The computer-implemented method of claim 1 wherein identifying at least one of the first characteristic of the first communication received on the first communication channel and the second characteristic of the second communication received on the second communication channel includes one or more of voice analysis and text analysis. ### Claim 7 (depends on 1) The computer-implemented method of claim 1 further comprising providing an indication of the potential social engineering activity to at least one of a user participating in the first communication received on the first communication channel and a third party based upon, at least in part, identifying the potential social engineering activity. ### Claim 8 A computer program product residing on a non-transitory computer readable storage medium having a plurality of instructions stored thereon which, when executed across one or more processors, causes at least a portion of the one or more processors to perform operations comprising: identifying, by a computing device, a first characteristic of a first communication received on a first communication channel; identifying a second characteristic of a second communication received on a second communication channel, wherein both the first communication channel and the second communication channel are different communication platforms; comparing, with a predetermined rule, both the first characteristic of the first communication received on the first communication channel and the second characteristic of the second communication received on the second communication channel, wherein the first characteristic and the second characteristic are different characteristics; determining that both the first characteristic of the first communication received on the first communication channel and the second characteristic of the second communication received on the second communication channel correlates to the predetermined rule by performing an assessment of both similarities and differences of text for the first communication and the second communication compared to text of at least one of malicious and non-malicious communications; and identifying potential social engineering activity associated with at least one of the first communication and the second communication based upon, at least in part, correlating both the first characteristic of the first communication received on the first communication channel and the second characteristic of the second communication received on the second communication channel to the predetermined rule. ### Claim 9 (depends on 8) The computer program product of claim 8 wherein the predetermined rule includes receiving the first communication and the second communication by a same user. ### Claim 10 (depends on 8) The computer program product of claim 8 wherein the predetermined rule includes a pattern between the first characteristic of the first communication received on the first communication channel and the second characteristic of the second communication received on the second communication channel. ### Claim 11 (depends on 8) The computer program product of claim 8 wherein the first communication channel is a first communication platform and the second communication channel is a second communication platform. ### Claim 12 (depends on 8) The computer program product of claim 8 wherein identifying at least one of the first characteristic of the first communication received on the first communication channel and the second characteristic of the second communication received on the second communication channel includes one or more of voice analysis and text analysis. ### Claim 13 (depends on 8) The computer program product of claim 8 further comprising providing an indication of the potential social engineering activity to at least one of a user participating in the first communication received on the first communication channel and a third party based upon, at least in part, identifying the potential social engineering activity. ### Claim 14 A computing system including one or more processors and one or more memories configured to perform operations comprising: identifying, by a computing device, a first characteristic of a first communication received on a first communication channel; identifying a second characteristic of a second communication received on a second communication channel, wherein both the first communication channel and the second communication channel are different communication platforms; comparing, with a predetermined rule, both the first characteristic of the first communication received on the first communication channel and the second characteristic of the second communication received on the second communication channel, wherein the first characteristic and the second characteristic are different characteristics; determining that both the first characteristic of the first communication received on the first communication channel and the second characteristic of the second communication received on the second communication channel correlates to the predetermined rule by performing an assessment of both similarities and differences of text for the first communication and the second communication compared to text of at least one of malicious and non-malicious communications; and identifying potential social engineering activity associated with at least one of the first communication and the second communication based upon, at least in part, correlating both the first characteristic of the first communication received on the first communication channel and the second characteristic of the second communication received on the second communication channel to the predetermined rule. ### Claim 15 (depends on 14) The computing system of claim 14 wherein the predetermined rule includes receiving the first communication and the second communication by a same user. ### Claim 16 (depends on 14) The computing system of claim 14 wherein the predetermined rule includes a pattern between the first characteristic of the first communication received on the first communication channel and the second characteristic of the second communication received on the second communication channel. ### Claim 17 (depends on 14) The computing system of claim 14 wherein the first communication channel is a first communication platform and the second communication channel is a second communication platform. ### Claim 18 (depends on 14) The computing system of claim 14 wherein identifying at least one of the first characteristic of the first communication received on the first communication channel and the second characteristic of the second communication received on the second communication channel includes one or more of voice analysis and text analysis. ### Claim 19 (depends on 14) The computing system of claim 14 further comprising providing an indication of the potential social engineering activity to at least one of a user participating in the first communication received on the first communication channel and a third party based upon, at least in part, identifying the potential social engineering activity. ### Claim 20 (depends on 14) The computing system of claim 14 further comprising a virtual agent for at least one of monitoring and controlling the operations.