Retrospective learning of communication patterns by machine learning models for discovering abnormal behavior

A non-transitory computer-readable medium with instructions stored thereon that, when executed by a processor, cause the processor to perform operations comprising:

• collecting data related to incoming emails and/or outgoing emails of a customer corresponding to a past interval of time;
• generating a communication profile for the customer based on the data;
• receiving an incoming email addressed to the customer;
• deriving one or more attributes of the incoming email;
• and
• determining whether the incoming email deviates from past email activity by comparing the one or more attributes to the communication profile.

A computer-implemented method comprising:

• obtaining first data associated with a first batch of past emails received by employees of an enterprise;
• generating a first batch of events that is representative of the first batch of past emails;
• obtaining second data associated with a second batch of past emails labeled by one or more administrators,
• wherein each past email in the second batch of past emails is associated with a label that specifies risk posed to the enterprise;
• generating a second batch of events that is representative of the second batch of past emails;
• and
• storing the first and second batches of events in a database.