Method for detecting financial attacks in emails

method of claim 1:

• wherein correlating the first sequence of words, in the email, with the financial signal comprises:
• accessing a first natural language processing model trained on a financial services and financial transaction lexicon;
• based on the first natural language processing model, identifying the first sequence of words, related to financial transactions, in the email;
• normalizing the first sequence of words to a first standard financial transaction language concept;
• and
• representing the first standard financial transaction language concept in the financial signal;
• wherein correlating the second sequence of words, in the email, with the action request signal comprises:
• accessing a second natural language processing model trained on an action request and prompt lexicon;
• based on the second natural language processing model, identifying the second sequence of words, describing an action request, in the email;
• normalizing the second sequence of words to a standard action request language concept;
• and
• representing the standard action request language concept in the action request signal;
• further comprising:
• accessing a third natural language processing model trained on an urgency and deadline lexicon;
• based on the third natural language processing model, identifying a third sequence of words, describing urgency of the standard action request, in the email;
• normalizing the third sequence of words to a standard urgency language concept;
• representing the standard urgency language concept in an urgency data signal;
• and
• annotating the third sequence of words in the email according to a third visual highlighting scheme associated with the urgency signal, the third visual highlighting scheme different from the first visual highlighting scheme and the second visual highlighting scheme;
• and
• wherein calculating the risk for the email comprises calculating the risk for the email based on the combination of the financial signal, the action request signal, and the urgency signal detected in the email.

method of claim 1:

• wherein accessing the email comprises intercepting the email inbound to the recipient address within an email domain;
• further comprising:
• accessing a corpus of past emails inbound to recipients within the email domain, the corpus of past emails comprising a first subset of past emails labeled as malicious and a second subset of past emails labeled as benign;
• detecting financial signals and action request signals in the corpus of past emails;
• and
• training a risk model based on the first subset of past emails labeled as malicious, the second subset of past emails labeled as benign, and financial signals and action request signals detected in emails in the corpus of past emails, the risk model configured to return a risk score based on financial signals and action request signals detected in an inbound email;
• and
• wherein calculating the risk for the email comprises inserting the financial signal and the action request signal, extracted from the email, into the risk model to calculate the risk for the email.

The method of claim 11, wherein calculating the risk for the email comprises:

• aggregating the financial signal, the action request signal, and the urgency signal into a target vector;
• accessing a corpus of stored vectors representing and labeled with known email-based attack types;
• identifying a particular vector, in the corpus of stored vectors, nearest the target vector in a multi-dimensional feature space;
• characterizing a distance between the particular vector and the target vector in the multi-dimensional feature space;
• and
• calculating the risk for the email inversely proportional to the distance.

The method of claim 16, wherein training the risk model comprises:

• initializing the risk model based on the first subset of past emails labeled as malicious, the second subset of past emails labeled as benign, and financial signals and action request signals detected in the corpus of past emails;
• selecting a third subset of past emails, in the corpus of past emails, excluding malicious and benign labels;
• for each past email in the third subset of past emails:
• scanning a past body of the past email for language signals;
• and
• inserting language signals, extracted from the past email, into the risk model to calculate a past risk for the past email;
• identifying a fourth subset of past emails, from the third subset of past emails, associated with past risks exceeding the threshold risk;
• for each past email in the fourth subset of past emails:
• generating a prompt to investigate the past email;
• serving the prompt to an administrator;
• and
• labeling the past email according to a response supplied by the administrator;
• and
• retraining the risk model based on the first subset of past emails, the second subset of past emails, the fourth subset of past emails, and financial signals and action request signals detected in emails in the corpus of past emails.

A method for detecting financial attacks in emails comprising:

• intercepting an email inbound to a recipient address;
• scanning a body of the email for a set of language signals;
• correlating a first sequence of words, in the email, with a financial signal in the set of language signals;
• correlating a second sequence of words, in the email, with an action request signal in the set of language signals;
• correlating a third sequence of words, in the email, with an urgency signal in the set of language signals;
• calculating a risk for the email representing a financial attack based on a combination of the financial signal, the action request signal, and the urgency signal detected in the email;
• and
• in response to the risk exceeding a threshold risk:
• annotating the first sequence of words in the email according to a first visual highlighting scheme associated with the financial signal;
• annotating the second sequence of words in the email according to a second visual highlighting scheme associated with the action request signal, the second visual highlighting scheme different from the first visual highlighting scheme;
• annotating the third sequence of words in the email according to a third visual highlighting scheme associated with the urgency signal, the third visual highlighting scheme different from the first visual highlighting scheme and the second visual highlighting scheme;
• and
• redirecting the email away from an email inbox associated with the recipient address.

A method for detecting financial attacks in emails comprising:

• intercepting an email inbound to a recipient address;
• scanning a body of the email for a set of language signals;
• correlating a first sequence of words, in the email, with a first signal in the set of language signals;
• correlating a second sequence of words, in the email, with a second signal in the set of language signals;
• calculating a risk for the email representing a financial attack based on a combination of the first signal and the second signal detected in the email;
• in response to the risk exceeding a threshold risk:
• annotating the first sequence of words in the email according to a first visual highlighting scheme associated with the financial signal;
• annotating the second sequence of words in the email according to a second visual highlighting scheme associated with the action request signal, the second visual highlighting scheme different from the first visual highlighting scheme;
• and
• redirecting the email away from an email inbox associated with the recipient address;
• and
• in response to selection of the email within an email viewer, rendering the email with the first sequence of words highlighted according to the first visual highlighting scheme and with the second sequence of words highlighted according to the second visual highlighting scheme.