Multistage analysis of emails to identify security threats

A system, comprising:

• a processor configured to:
• receive an email addressed to a recipient who is an employee of an enterprise;
• determine an identity of a sender based on an analysis of the email;
• obtain a first set of models that includes:
• (i) a first model trained using past emails sent by the sender that have been verified as non-malicious, and (ii) a second model trained using past emails received by the recipient that have been verified as non-malicious, wherein the first model is trained to identify deviations in features, content, or context that are representative of changes in behavior of the sender, and wherein the second model is trained to identify deviations in features, content, or context that are representative of changes in behavior of the recipient;
• apply the first set of models to the email to produce a first output indicative of whether the email is representative of a malicious email;
• determine, based on the first output, whether the email is a malicious email;
• in response to a determination that the email is a malicious email, apply a second set of models to the email to produce a second output indicative of whether the email is representative of a given type of malicious email;
• and
• perform an action with respect to the email based on the second output;
• and
• a memory coupled to the processor and configured to provide the processor with instructions.

A method, comprising:

• receiving an email addressed to a recipient who is an employee of an enterprise;
• determining an identity of a sender based on an analysis of the email;
• obtaining a first set of models that includes:
• (i) a first model trained using past emails sent by the sender that have been verified as non-malicious, and (ii) a second model trained using past emails received by the recipient that have been verified as non-malicious, wherein the first model is trained to identify deviations in features, content, or context that are representative of changes in behavior of the sender, and wherein the second model is trained to identify deviations in features, content, or context that are representative of changes in behavior of the recipient;
• applying the first set of models to the email to produce a first output indicative of whether the email is representative of a malicious email;
• determining, based on the first output, whether the email is a malicious email;
• in response to a determination that the email is a malicious email, applying a second set of models to the email to produce a second output indicative of whether the email is representative of a given type of malicious email;
• and
• performing an action with respect to the email based on the second output.