# US 12,224,973 B2 · Misdirected email data loss prevention

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,224,973 B2
- Document ID: US12224973B2
- Status: Granted
- Kind: B2
- Application number: 18/660,423
- Filed: 2024-05-10
- Published: 2024-08-29
- Granted: 2025-02-11
- Earliest claimed: 2021-06-08
- Assignees: Proofpoint, Inc.
- Applicants: Proofpoint, Inc.
- Inventors: Shalini Kamalapuram Sundaram; Chris Moores; Durgaprasad Velagaleti; Srikanth Konjarla; Harsh Doshi
- Web page: https://patentgrep.com/patent/US12224973B2

## CPC

- H04L 51/23: Reliability checks, e.g. acknowledgments or fault reporting
- G06F 21/606: {by securing the transmission between two devices or processes}
- H04L 51/21: Monitoring or handling of messages
- H04L 51/42: Mailbox-related aspects, e.g. synchronisation of mailboxes
- H04L 51/48: Message addressing, e.g. address format or anonymous messages, aliases
- H04L 51/56: Unified messaging, e.g. interactions between e-mail, instant messaging or converged IP messaging [CPM]
- H04L 51/212: using filtering or selective blocking
- H04L 51/214: using selective forwarding
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Aspects of the disclosure relate to data loss prevention. A computing platform may detect input of a first target recipient domain into a first email message. The computing platform may identify, in real time and prior to sending the first email message, that the first target recipient domain comprises an unintended recipient domain instead of an intended recipient domain. The computing platform may send, based on the identification of the unintended recipient domain and to a user device, a notification that the first target recipient domain is flagged as an unintended recipient domain and one or more commands directing the user device to display the notification.

## Claims

### Claim 1

A computing platform, comprising:
at least one processor;
a communication interface communicatively coupled to the at least one processor; and
memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
identify, in real time and prior to sending a first email message, that a first target recipient domain comprises an unintended recipient domain instead of an intended recipient domain, wherein the identification comprises:
identifying, using a plurality of machine learning algorithms, first context information for the first email message, wherein identifying the first context information for the first email message comprises:
identifying, using latent Dirichlet allocation (LDA), one or more topics in the first email message,
identifying, using named entity recognition (NER), one or more named entities in the first email message, and
identifying, using text summarization, a predetermined number of most frequently used keywords in the first email message; and
send, based on identifying that the first context information does not match historical context information from historical messages for a sender of the first email message, a notification that the first target recipient domain is flagged as the unintended recipient domain and one or more commands directing a user device to display the notification.

### Claim 2 (depends on 1)

The computing platform of claim 1, wherein the identification further comprises:
identifying, using a user graph, a plurality of nearest neighbor recipients for a message sender.

### Claim 3 (depends on 2)

The computing platform of claim 2, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, further cause the computing platform to:
detect input of a second target recipient domain into a second email message;
identify, in real time and prior to sending the second email message, that the second target recipient domain comprises the intended recipient domain, wherein the identification comprises:
identifying, using the user graph, the plurality of nearest neighbor recipients for the message sender,
identifying, using the plurality of machine learning algorithms, context information for the second email message, and
identifying that the context information is a first level match with the historical context information from historical messages between the message sender and a message recipient, of the plurality of nearest neighbor recipients, corresponding to the second target recipient domain; and
send, based on the identification of the intended recipient domain and to a user device of the message recipient, the second email message.

### Claim 4 (depends on 2)

The computing platform of claim 2, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, further cause the computing platform to:
detect input of a second target recipient domain into a second email message;
identify, in real time and prior to sending the second email message, that the second target recipient domain comprises a potentially unintended recipient domain instead of the intended recipient domain, wherein the identification comprises:
identifying, using the user graph, the plurality of nearest neighbor recipients for the message sender,
identifying, using the plurality of machine learning algorithms, second context information for the second email message,
identifying that the second context information is not a first level match with the historical context information from historical messages between the message sender and a second message recipient corresponding to the second target recipient domain,
based on identifying that the second context information does not match the historical context information from the historical messages between the message sender and the second message recipient:
identifying whether a message recipient domain is included in the plurality of nearest neighbor recipients, and
identifying whether there is a second level match between the second context information and the historical context information from the historical messages between the message sender and the second message recipient; and
send, based on an identification that the second message recipient is included in the plurality of nearest neighbor recipients and that there is the second level match between the second context information and the historical context information from historical messages between the message sender and the second message recipient, a second notification indicating that the second email message includes a new context for the second message recipient and one or more commands directing the user device to display the second notification, wherein the notification includes an option to correct the potentially unintended recipient domain or to send the second email message.

### Claim 5 (depends on 4)

The computing platform of claim 4, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, further cause the computing platform to:
based on an identification of one or more of: a) that the second message recipient is not included in the plurality of nearest neighbor recipients, or b) that there is not the second level match between the second context information and the historical context information from the historical messages between the message sender and the second message recipient:
identify whether the second context information is a third level match with the historical context information from historical messages between the message sender and the plurality of nearest neighbor recipients; and
send, based on an identification that the second context information is the third level match with the historical context information from the historical messages between the message sender and the plurality of nearest neighbor recipients:
a third notification indicating that the second email message includes: a) the new context for the second message recipient, and b) historical messages between the message sender and at least one of the plurality of nearest neighbor recipients, different than the second message recipient, includes the new context, and
one or more commands directing the user device to display the third notification, wherein the third notification includes the option to correct the potentially unintended recipient domain or to send the second email message.

### Claim 6 (depends on 5)

The computing platform of claim 5, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, further cause the computing platform to:
based on an identification that the second context information is not the third level match with the historical context information from the historical messages between the message sender and the plurality of nearest neighbor recipients:
identify whether there is a fourth level match between the second context information and the historical context information from the historical messages between the message sender and the plurality of nearest neighbor recipients; and
based on identifying that there is the fourth level match between the second context information and the historical context information from the historical messages between the message sender and at least one of the plurality of nearest neighbor recipients:
generate a spelling mistake recommendation indicating a difference between the second target recipient domain and a domain of the at least one of the plurality of nearest neighbor recipients; and
send, to the message sender, a fourth notification indicating the spelling mistake recommendation and one or more commands directing the user device to display the fourth notification, wherein the fourth notification includes the option to correct the potentially unintended recipient domain or to send the second email message.

### Claim 7 (depends on 1)

The computing platform of claim 1, wherein identifying that the first target recipient domain comprises the unintended recipient domain instead of the intended recipient domain further comprises determining a page rank indicating a trustworthiness of the unintended recipient domain.

### Claim 8 (depends on 1)

The computing platform of claim 1, wherein the plurality of machine learning algorithms includes: the LDA, the NER, and the text summarization.

### Claim 9 (depends on 1)

The computing platform of claim 1, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, further cause the computing platform to:
detect input of the first target recipient domain into the first email message.

### Claim 10 (depends on 1)

The computing platform of claim 1, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, further cause the computing platform to:
input, into a data loss prevention model, the first email message, wherein:
the data loss prevention model includes one or more user defined rules,
inputting the first email message into the data loss prevention model causes a data loss prevention result to be output, and
the data loss prevention result indicates whether or not any of the one or more user defined rules are violated.

### Claim 11 (depends on 10)

The computing platform of claim 10, wherein the data loss prevention result indicates that at least one of the one or more user defined rules are violated, and wherein sending the notification that the first target recipient domain is flagged as the unintended recipient domain is further based on the data loss prevention result.

### Claim 12 (depends on 10)

The computing platform of claim 10, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, further cause the computing platform to:
detect input of a second target recipient domain into a second email message;
identify, in real time and prior to sending the second email message, that the second target recipient domain comprises the unintended recipient domain instead of the intended recipient domain;
determine that the data loss prevention result indicates that none of the one or more user defined rules are violated; and
based on determining that the data loss prevention result indicates that none of the one or more user defined rules are violated, route the second email message to the second target recipient domain.

### Claim 13 (depends on 1)

The computing platform of claim 1, wherein the notification includes an option to engage in email security compliance training.

### Claim 14 (depends on 2)

The computing platform of claim 2, wherein the identification further comprises:
identifying that the first context information does not match historical context information from historical messages between the message sender and the plurality of nearest neighbor recipients.

### Claim 15

A method, comprising:
at a computing platform comprising at least one processor, a communication interface, and memory:
detecting input of a first target recipient domain into a first email message;
identifying, in real time and prior to sending the first email message, that the first target recipient domain comprises an intended recipient domain, wherein the identification comprises:
identifying, using a user graph, a plurality of nearest neighbor recipients for a message sender,
identifying, using a plurality of machine learning algorithms, first context information for the first email message, wherein identifying the first context information for the first email message comprises:
identifying, using latent Dirichlet allocation (LDA), one or more topics in the first email message,
identifying, using named entity recognition (NER), one or more named entities in the first email message, and
identifying, using text summarization, a predetermined number of most frequently used keywords in the first email message, and
identifying that the first context information is a first level match with historical context information from historical messages between the message sender and a message recipient, of the plurality of nearest neighbor recipients, corresponding to the first target recipient domain; and
sending, based on the identification of the intended recipient domain and to a user device of the message recipient, the first email message.

### Claim 16 (depends on 15)

The method of claim 15, further comprising:
detecting input of a second target recipient domain into a second email message;
identifying, in real time and prior to sending the second email message, that the second target recipient domain comprises an unintended recipient domain instead of the intended recipient domain, wherein the identification comprises:
identifying, using the user graph, the plurality of nearest neighbor recipients for the message sender,
identifying, using the plurality of machine learning algorithms, first context information for the second email message, and
identifying that the first context information does not match historical context information from historical messages between the message sender and the plurality of nearest neighbor recipients; and
sending, based on the identification of the unintended recipient domain and to a user device of the message sender, a notification that the first target recipient domain is flagged as the unintended recipient domain and one or more commands directing the user device to display the notification.

### Claim 17 (depends on 15)

The method of claim 15, further comprising:
detecting input of a second target recipient domain into a second email message;
identifying, in real time and prior to sending the second email message, that the second target recipient domain comprises a potentially unintended recipient domain instead of the intended recipient domain, wherein the identification comprises:
identifying, using the user graph, the plurality of nearest neighbor recipients for the message sender,
identifying, using the plurality of machine learning algorithms, second context information for the second email message,
identifying that the second context information is not the first level match with historical context information from historical messages between the message sender and a second message recipient corresponding to the second target recipient domain,
based on identifying that the second context information does not match the historical context information from the historical messages between the message sender and the second message recipient:
identifying whether a message recipient domain is included in the plurality of nearest neighbor recipients, and
identifying whether there is a second level match between the second context information and the historical context information from the historical messages between the message sender and the second message recipient; and
sending, based on an identification that the second message recipient is included in the plurality of nearest neighbor recipients and that there is the second level match between the second context information and the historical context information from historical messages between the message sender and the second message recipient, a second notification indicating that the second email message includes a new context for the second message recipient and one or more commands directing the user device to display the second notification, wherein the notification includes an option to correct the potentially unintended recipient domain or to send the second email message.

### Claim 18 (depends on 17)

The method of claim 17, further comprising:
based on an identification of one or more of: a) that the second message recipient is not included in the plurality of nearest neighbor recipients, or b) that there is not the second level match between the second context information and the historical context information from the historical messages between the message sender and the second message recipient:
identifying whether the second context information is a third level match with the historical context information from historical messages between the message sender and the plurality of nearest neighbor recipients; and
sending, based on an identification that the second context information is the third level match with the historical context information from the historical messages between the message sender and the plurality of nearest neighbor recipients:
a third notification indicating that the second email message includes: a) the new context for the second message recipient, and b) historical messages between the message sender and at least one of the plurality of nearest neighbor recipients, different than the second message recipient, includes the new context, and
one or more commands directing the user device to display the third notification, wherein the third notification includes the option to correct the potentially unintended recipient domain or to send the second email message.

### Claim 19 (depends on 18)

The method of claim 18, further comprising:
based on an identification that the second context information is not the third level match with the historical context information from the historical messages between the message sender and the plurality of nearest neighbor recipients:
identifying whether there is a fourth level match between the second context information and the historical context information from the historical messages between the message sender and the plurality of nearest neighbor recipients; and
based on identifying that there is the fourth level match between the second context information and the historical context information from the historical messages between the message sender and at least one of the plurality of nearest neighbor recipients:
generating a spelling mistake recommendation indicating a difference between the second target recipient domain and a domain of the at least one of the plurality of nearest neighbor recipients; and
sending, to the message sender, a fourth notification indicating the spelling mistake recommendation and one or more commands directing the user device to display the fourth notification, wherein the fourth notification includes the option to correct the potentially unintended recipient domain or to send the second email message.

### Claim 20

One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:
detect input of a first target recipient domain into a first email message;
identify, in real time and prior to sending the first email message, that the first target recipient domain comprises an unintended recipient domain instead of an intended recipient domain, wherein the identification comprises:
identifying, using a user graph, a plurality of nearest neighbor recipients for a message sender,
identifying, using a plurality of machine learning algorithms, first context information for the first email message, wherein identifying the first context information for the first email message comprises:
identifying, using latent Dirichlet allocation (LDA), one or more topics in the first email message,
identifying, using named entity recognition (NER), one or more named entities in the first email message, and
identifying, using text summarization, a predetermined number of most frequently used keywords in the first email message, and
identifying that the first context information does not match historical context information from historical messages between the message sender and the plurality of nearest neighbor recipients; and
send, based on the identification of the unintended recipient domain and to a user device, a notification that the first target recipient domain is flagged as the unintended recipient domain and one or more commands directing the user device to display the notification.