Cyber threat defense system protecting email networks with machine learning models using a range of metadata from observed email communications

A method for a cyber threat defense system for a network including its email domain, comprising:

• using a first module utilizing a set of machine learning models, communicating with a cyber threat module, and configured to receive information from a set of detectors to provide at least a range of metadata from observed email communications in the email domain;
• using the cyber threat module that is configured to (i) cooperate with the first module to analyze the range of metadata from the observed email communications based on operations performed by the machine learning models trained on a normal behavior of email activity and user activity associated with the network and its email domain to determine when a deviation from the normal behavior of email activity and user activity associated with the network and its email domain occurs;
• using a mass email association detector to determine a similarity between two or more emails being i) sent from or ii) received by a collection of two or more individual users in the email domain in a prescribed simultaneous time frame, where one or more mathematical models are used to determine similarity weighing to derive a similarity score between compared emails;
• and
• using an email layout change predictor module to detect anomaly deviations by considering at least a layout of the email, wherein the email layout change predictor module utilizes one or more machine learning models trained and configured to model and store a historical norm state of the layout of the email, including at least a formatting of the email and a structure of an email body;
• wherein when software instructions are implemented in the first module, the cyber-threat module, and the one or more machine learning models, the software instructions are stored in an executable form in one or more memories and configured to be executed by one or more processors.

A non-transitory computer readable medium deployed within a computing device implemented as part of a network, comprising:

• a plurality of machine learning models, communicate with a cyber threat module;
• a plurality of detectors configured to collect a range of metadata associated with email activity from observed email communications within an email domain associated with the network;
• a cyber threat module communicatively coupled to the plurality of machine learning modules, the cyber threat module is configured to assist in conducting analytics of the range of metadata from the observed email communications, utilizing the plurality of machine learning models trained on a normal behavior of email activity and user activity associated with the network and its email domain, to determine when a deviation from the normal behavior of email activity and user activity associated with the network and its email domain occurs;
• a mass email association detector module configured to determine a similarity between a plurality of emails from the observed email communications being i) sent from or ii) received by a collection of two or more individual users in the email domain in a prescribed time frame, wherein one or more mathematical models are used to determine similarity weighing to derive a similarity score between the plurality of emails;
• an email layout change predictor module configured to detect anomaly deviations by considering at least a layout of an email of the plurality of emails, wherein the email layout change predictor module utilizes one or more machine learning models of the plurality of machine learning models that are trained to model and store a historical norm state of the layout of the email, including at least a formatting of the email and a structure of an email body;
• an image-tracking link module configured to cooperate with the email layout change predictor module to analyze properties that describe a visual style and appearance of a tracking link to detect whether the tracking link is a suspicious covert tracking link, and wherein an autonomous response module is configured to take an autonomous action to remedy the tracking link when the tracking link is determined to be the suspicious covert tracking link while allowing other emails with a tracking link to enter the email domain.