US 11,689,563 B1Granted

Discrete and aggregate email analysis to infer user behavior

AssigneeNudge Security, Inc.

InventorsRussell Spitler, Jaime Blasco

Life of this patent

Estimating the term…

Loading patent…

Abstract

Techniques for detecting emails that pertain to Internet services are disclosed. Information about such emails can be recognized by performing a discrete analysis of the email before delivering the email to the user and determining whether a corrective action is warranted. Such emails can be recognized by heuristic pattern analysis that scans incoming emails for patterns known to pertain to certain Internet services. Emails relating to other Internet services can be detected by a machine learning classifier that uses labeled training data. These accesses to Internet services can be written to a database. In many implementations, such discrete analysis is performed after an email has been classified as legitimate by one or both of a spam filter and a malware detector. An aggregate analysis, whose output can also update the database, can provide a broad picture of Internet service usage within a set of email users (e.g., by department).

Claims30

Dependent claims

A method, comprising:

accessing, by a computer system, an email addressed to an email address of an email system, wherein the email address is for a user of the email system, and wherein the email has been categorized as a legitimate email after passing through one or both of a spam filter and a malware detector;
performing, by the computer system, a discrete analysis of the email to determine behavior of the user, wherein the performing includes pattern matching based on a set of rules or classification by a machine learning model trained by a labeled data set;
in response to the discrete analysis indicating that the behavior of the user pertains to use, by the user, of an Internet service established with the email address, using content of the email to update a database that stores indications of Internet service activity of users of the email system;
determining, based on the discrete analysis, whether a corrective action for the email is to be taken;
performing, by the computer system, an aggregate analysis of behavior of multiple users of the email system, wherein the aggregate analysis takes into account the determined behavior of the user indicated by the discrete analysis of the email;
and
updating the database based on the aggregate analysis.

4 more elements

A non-transitory, computer-readable storage medium storing program instructions executable by a computer system to perform operations comprising:

accessing, by a computer system, an email addressed to a user of an email system, wherein the email has already been classified by the email system as a legitimate email after passing through one or both of a spam filter and a malware detector;
performing, by the computer system, a discrete analysis of the email to determine behavior of the user, wherein the performing includes pattern matching based on a set of rules and classification by a machine learning model trained by a labeled data set produced by the pattern matching;
in response to the discrete analysis indicating that the behavior of the user pertains to use, by the user, of an Internet service, using content of the email to update a database that stores indications of Internet service activity of users of the email system;
determining, based on the discrete analysis, whether a corrective action for the email is to be taken;
and
performing, an aggregate analysis of behavior of multiple users of the email system, wherein the aggregate analysis takes into account the determined behavior of the user as indicated by the discrete analysis of the email.

3 more elements

Dependencies are inferred from the claim text.

Facts

Application: 18/048,735Filed 21 Oct 2022 · us provisional application
Priority: 22 Oct 2021
Granted: 27 Jun 2023
Term ends: Not estimatedThe source records don’t support an estimate.

Classification4 codes

H04L 63/145
Countermeasures against malicious traffic: the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
H04L 51/212
Monitoring or handling of messages: using filtering or selective blocking
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
H04L
Digital communication