Cyber threat defense system protecting email networks with machine learning models

A method for a cyber-threat defense system, comprising:

• using one or more machine learning models that are trained on a normal behavior of both email activity and user activity associated with an email system;
• using a cyber-threat module with one or more machine learning models trained on cyber threats in the email system to understand characteristics of cyber threats in the email system, where the cyber-threat module is further configured to reference the models that are trained on the normal behavior of both email activity and user activity associated with the email system and issue an anomaly rating value to indicate how unusual the cyber-threat module considers an email under analysis to be in comparison to a normal pattern of life for an organization and a specific user;
• determining a threat risk parameter that factors in the likelihood that a chain of one or more unusual behaviors of the email activity and user activity under analysis that fall outside of a derived normal benign behavior, and how the chain of one or more unusual behaviors of the email activity and user activity under analysis correlate to a potential cyber threat;
• using probes to collect both the user activity and the email activity and then feed that activity to the cyber-threat module to draw an understanding of the email activity and user activity in the email system;
• and
• using an autonomous response module, rather than a human taking an action, to cause one or more autonomous actions to be taken to contain the cyber-threat when the threat risk parameter from the cyber-threat module is equal to or above an actionable threshold,
• where when any software instructions are implemented in the autonomous response module, the cyber-threat module, and the one or more machine learning models, that are then the software instructions are stored in an executable form in one or more memories and are configured to be executed by one or more processors.

A non-transitory computer-readable medium including executable instructions that, when executed with one or more processors, cause a cyber defense system to perform the operations of:

• using a cyber-threat module with one or more machine learning models trained on cyber threats in the email system, where the cyber-threat module is configured to reference the models that are trained on both the normal behavior of email activity and user activity associated with the email system to understand characteristics of cyber threats in the email system and issue an anomaly rating value to indicate how unusual the cyber-threat module considers an email under analysis to be in comparison to a normal pattern of life for an organization and a specific user;
• determining a threat risk parameter that factors in a likelihood that a chain of one or more unusual behaviors of the email activity and user activity under analysis fall outside of a derived normal benign behavior, and how the chain of one or more unusual behaviors of the email activity and user activity under analysis correlate to a potential cyber threat;
• using probes to collect both the user activity and the email activity and then feed that activity to the cyber-threat module to draw an understanding of the email activity and user activity in the email system;
• and
• using an autonomous response module, rather than a human taking an action, to cause one or more autonomous actions to be taken to contain the cyber-threat when the threat risk parameter from the cyber-threat module is equal to or above an actionable threshold.