US 12,120,148 B1 · Intelligent anti-phishing management

Abstract

Systems and methods are disclosed for monitoring, evaluating protection against, improving protection against, and simulating phishing threats. Network usage information for users of an organization can be leveraged to determine user-specific network behavior information. This user-specific network behavior information can then be leveraged to better identify incoming threats as well as generate and deploy user-specific phishing lures. Phishing simulation campaigns can be conducted, including by implementing variations in how the phishing lures are presented. Such campaigns can be scored to determine how different presentation variations perform. User-specific phishing lures can be generated using user environment information collected by an agent running on the user's device. Alerts informing users of potential threats can be dynamically updated with different presentation parameters to improve performance. Digital communications identified as threats can be used to generate hashes to speedily identify subsequent digital communications that are threats.

Claims36

Dependent claims

A computer-implemented method comprising:

receiving user environment information, the user environment information collected by an agent running on a user device being used by a user, the user environment information including information about the computing environment of the user device;
analyzing the user environment information to identify digital communication review times associated with how long the user reviews digital communications prior to acting on the digital communications;
selecting an asset of a set of assets based at least in part on the digital communication review times;
generating a user-specific phishing lure based at least in part on the selected asset such that the user-specific phishing lure appears to originate from the selected asset;
and
deploying the user-specific phishing lure such that the user-specific phishing lure is presented on the user device.

3 more elements

A system comprising:

a control system including one or more processors;
and
a memory having stored thereon machine readable instructions, which when executed by at least one of the one or more processors of the control system, cause the system to perform operations including:
receiving user environment information, the user environment information collected by an agent running on a user device being used by a user, the user environment information including information about the computing environment of the user device;
analyzing the user environment information to identify digital communication review times associated with how long the user reviews digital communications prior to acting on the digital communications;
selecting an asset of a set of assets based at least in part on the digital communication review times;
generating a user-specific phishing lure based at least in part on the selected asset such that the user-specific phishing lure appears to originate from the selected asset;
and
deploying the user-specific phishing lure such that the user-specific phishing lure is presented on the user device.

6 more elements

A computer program product, embodied on a non-transitory computer readable medium, comprising instructions which, when executed by a computer, cause the computer to perform operations including:

receiving user environment information, the user environment information collected by an agent running on a user device being used by a user, the user environment information including information about the computing environment of the user device;
analyzing the user environment information to identify digital communication review times associated with how long the user reviews digital communications prior to acting on the digital communications;
selecting an asset of a set of assets based at least in part on the digital communication review times;
generating a user-specific phishing lure based at least in part on the selected asset such that the user-specific phishing lure appears to originate from the selected asset;
and
deploying the user-specific phishing lure such that the user-specific phishing lure is presented on the user device.

3 more elements

Dependencies are inferred from the claim text.

Intelligent anti-phishing management

Life of this patent

Intelligent anti-phishing management

Life of this patent

Abstract

Claims36