Using neural networks to process forensics and generate threat intelligence information

A method comprising:

• at a computing platform comprising at least one processor, a communication interface, and memory:
• training, by the at least one processor, a neural network, wherein training the neural network comprises training the neural network using metric learning and sub-word embeddings, and wherein training the neural network using the metric learning comprises:
• inputting two or more inputs into the neural network;
• identifying labels corresponding to each of the two or more inputs;
• and
• prompting the neural network to produce particular embeddings based on the identified labels;
• receiving, by the at least one processor, forensics information corresponding to a plurality of message attachments;
• generating, by the at least one processor and for each of the plurality of message attachments, a feature representation;
• inputting, by the at least one processor, the feature representations into the neural network, wherein inputting the feature representations into the neural network results in a numeric representation for each of the plurality of message attachments;
• applying, by the at least one processor, a clustering algorithm to cluster each of the plurality of message attachments based on the numeric representations, resulting in clustering information;
• extracting, by the at least one processor and from the clustering information, one or more indicators of compromise indicating that one or more of the plurality of attachments corresponds to a threat campaign;
• and
• sending, by the at least one processor and to an enterprise user device, user interface information comprising the one or more indicators of compromise, wherein sending the user interface information causes the enterprise user device to display a user interface identifying the one or more indicators of compromise.

One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:

• train a neural network, wherein training the neural network comprises training the neural network using metric learning and sub-word embeddings, and wherein training the neural network using the metric learning comprises:
• inputting two or more inputs into the neural network;
• identifying labels corresponding to each of the two or more inputs;
• and
• prompting the neural network to produce particular embeddings based on the identified labels;
• receive forensics information corresponding to a plurality of message attachments;
• generate, for each of the plurality of message attachments, a feature representation;
• input the feature representations into the neural network, wherein inputting the feature representations into the neural network results in a numeric representation for each of the plurality of message attachments;
• apply a clustering algorithm to cluster each of the plurality of message attachments based on the numeric representations, resulting in clustering information;
• extract, from the clustering information, one or more indicators of compromise indicating that one or more of the plurality of attachments corresponds to a threat campaign;
• and
• send, to an enterprise user device, user interface information comprising the one or more indicators of compromise, wherein sending the user interface information causes the enterprise user device to display a user interface identifying the one or more indicators of compromise.