Detecting multi-segment malicious email attacks

A system comprising:

• one or more processors;
• and
• one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• receiving a first email from a first sender to a first receiver, wherein the first email is an incoming email;
• determining a first maliciousness prediction that indicates a first determination about whether the first email is malicious;
• based on determining that the first maliciousness prediction indicates that the first email is non-malicious, determining an overall maliciousness prediction indicating whether a temporal sequence of past related emails is malicious, wherein each of the temporal sequence of past related emails is from the first sender to the first receiver, and wherein determining the overall maliciousness prediction comprises:
• determining the temporal sequence of past related emails, the temporal sequence of past related emails comprising the first email, a second email, and a third email, and wherein the second email and the third email are past emails from the first sender to the first receiver;
• determining or receiving a second maliciousness prediction that indicates a second determination about whether the second email is malicious;
• determining or receiving a third maliciousness prediction that indicates a third determination about whether the third email is malicious;
• determining that the second email and the third email were received within a threshold period of a receipt time of the first email;
• based at least in part on the second email and the third email being received from the first sender by the first receiver within the threshold period of time, providing, to a machine learning model, input data representing:
• the first maliciousness prediction, the second maliciousness prediction, and the third maliciousness prediction,
• a first position indicator representing a first position of the first email in the temporal sequence of past related emails,
• a second position indicator representing a second position of the second email in the temporal sequence of past related emails;
• and
• a third position indicator representing a third position of the third email in the temporal sequence of past related emails;
• and
• receiving, from the machine learning model, output data representing the overall maliciousness prediction;
• and
• determining that the overall maliciousness prediction satisfies a maliciousness pattern.

One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

• receiving a first email from a first sender to a first receiver, wherein the first email is an incoming email;
• determining a first maliciousness prediction that indicates a first determination about whether the first email is malicious;
• based on determining that the first maliciousness prediction indicates that the first email is non-malicious, determining an overall maliciousness prediction indicating whether a temporal sequence of past related emails is malicious, wherein each of the temporal sequence of past related emails is from the first sender to the first receiver, and wherein determining the overall maliciousness prediction comprises:
• determining the temporal sequence of past related emails, the temporal sequence of past related emails comprising the first email, a second email, and a third email, and wherein the second email and the third email are past emails from the first sender to the first receiver;
• determining or receiving a second maliciousness prediction that indicates a second determination about whether the second email is malicious;
• determining or receiving a third maliciousness prediction that indicates a third determination about whether the third email is malicious;
• determining that the second email and the third email were received within a threshold period of a receipt time of the first email;
• based at least in part on the second email and the third email being received from the first sender by the first receiver within the threshold period of time, providing, to a machine learning model, input data representing:
• the first maliciousness prediction, the second maliciousness prediction, and the third maliciousness prediction,
• a first position indicator representing a first position of the first email in the temporal sequence of past related emails,
• a second position indicator representing a second position of the second email in the temporal sequence of past related emails;
• and
• a third position indicator representing a third position of the third email in the temporal sequence of past related emails;
• and
• receiving, from the machine learning model, output data representing the overall maliciousness prediction;
• and
• determining that the overall maliciousness prediction satisfies a maliciousness pattern.