Identifying patterns in large quantities of collected emails

A system comprising:

• a memory;
• and
• a processing device, operatively coupled to the memory, to:
• receive a request for one or more emails associated with one or more keywords;
• maintain a plurality of associations between a plurality of emails and a plurality of multi-dimensional (MD) vectors of the plurality of emails, each association is between a respective email of the plurality of emails and a respective MD vector of the plurality of MD vectors that corresponds to the respective email;
• identify, based on the one or more keywords, a set of MD vectors of the plurality of MD vectors;
• select, based on the plurality of associations, a set of emails associated with the set of MD vectors;
• extract, from the set of emails, a first portion of the set of emails and a second portion of the set of emails;
• generate a set of clusters to represent patterns in the set of emails by performing a MinHash function on the first portion of the set of emails to generate a first set of numerical signatures and the second portion of the set of emails to generate a second set of numerical signatures, and selecting a first minimum numerical signature from the first set of numerical signatures and a second minimum numerical signature from the first set of numerical signatures;
• group the first minimum numerical signature into a first group based on a first similarity and the second minimum numerical signature into a second group based on a second similarity;
• generate training data by extracting a plurality of keywords from labeled data associated with a different set of emails and vectorizing the plurality of keywords by determining a frequency in which the plurality of keywords appear in the different set of emails;
• provide the plurality of emails to a classifier model trained with the training data to generate a plurality of maliciousness scores indicating likelihoods of the plurality of emails including malicious content;
• and
• update the plurality of associations between the plurality of emails and the plurality of MD vectors of the plurality of emails to further be associated with the plurality of maliciousness scores.

A non-transitory computer-readable medium storing instructions that, when execute by a processing device, cause the processing device to:

• receive a request for one or more emails associated with one or more keywords;
• maintain a plurality of associations between a plurality of emails and a plurality of multi-dimensional (MD) vectors of the plurality of emails, each association is between a respective email of the plurality of emails and a respective MD vector of the plurality of MD vectors that corresponds to the respective email;
• identify, based on the one or more keywords, a set of MD vectors of the plurality of MD vectors;
• select, based on the plurality of associations, a set of emails associated with the set of MD vectors;
• extract, from the set of emails, a first portion of the set of emails and a second portion of the set of emails;
• generate, by the processing device, based on the set of emails or the set of MD vectors, a set of clusters to represent patterns in the set of emails by performing a MinHash function on the first portion of the set of emails to generate a first set of numerical signatures and the second portion of the set of emails to generate a second set of numerical signatures, and selecting a first minimum numerical signature from the first set of numerical signatures and a second minimum numerical signature from the first set of numerical signatures;
• grouping the first minimum numerical signature into a first group based on a first similarity and the second minimum numerical signature into a second group based on a second similarity;
• generating training data by extracting a plurality of keywords from labeled data associated with a different set of emails and vectorizing the plurality of keywords by determining a frequency in which the plurality of keywords appear in the different set of emails;
• providing the plurality of emails to a classifier model trained with the training data to generate a plurality of maliciousness scores indicating likelihoods of the plurality of emails including malicious content;
• and
• updating the plurality of associations between the plurality of emails and the plurality of MD vectors of the plurality of emails to further be associated with the plurality of maliciousness scores.