Cyber Threat Defense System Protecting Email Networks with Machine Learning Models using a Range of Metadata from Observed Email Communications

A cyber threat defense system for a network including its email domain, comprising:

• two or more modules configured to utilize a set of machine learning models as well as communicate with a cyber threat module, where the two or more modules also are configured to receive information from a set of detectors to provide at least a range of metadata from observed email communications in the email domain;
• where the cyber threat module is configured to cooperate with the two or more modules to analyze the range of metadata from the observed email communications, where the cyber threat module analyzes with the machine learning models trained on a normal behavior of email activity and user activity associated with the network and its email domain in order to determine when a deviation from the normal behavior of email activity and user activity associated with the network and its email domain is occurring;
• and
• a mass email association detector configured to determine a similarity between two or more similar emails being i) sent from or ii) received by a collection of two or more individual users in the email domain in a substantially simultaneous time frame, where one or more mathematical models are used to determine similarity weighing in order to derive a similarity score between compared emails.