Method and System for Improving Email Security
AssigneeHeimdal Security A/S
InventorsValentin Rusu, Eugeniu Cernei
Life of this patent
Estimating the term…
Abstract
Disclosed is a computer-implemented method and system for improving email security. The method comprises receiving an email. The email comprises one or more features. The method comprises performing feature extraction of the one or more features from the email. The method comprises analyzing the one or more features to identify anomalous email behavior using an Empirical Cumulative Outlier Detection (ECOD) algorithm. The analysis comprises determining tail probabilities for each of the one or more features using a feature distribution model representing both normal and anomalous email behavior. The analysis comprises identifying anomalous email behavior based on the tail probabilities.
Claims16
A computer-implemented method for improving email security, the method comprising:
- receiving an email, wherein the email comprises one or more features;
- performing feature extraction of the one or more features of the email;
- and
- analyzing the one or more features to identify anomalous email behavior using an Empirical Cumulative Outlier Detection (ECOD) algorithm, wherein the analyzing comprises:
- determining tail probabilities for each of the one or more features using a feature distribution model that represents both normal and anomalous email behavior;
- and
- identifying the anomalous email behavior based on the tail probabilities.
An email security system comprising:
- a plugin interface that receives an email, wherein the email comprises one or more features;
- an extraction module that performs feature extraction of the one or more features of the email, wherein the extraction module comprises a search engine and a Hyper Text Transfer Protocol (HTTP) web interface, and wherein the extraction module further comprises a virtual machine;
- and
- an artificial intelligence module that analyzes the one or more features to identify anomalous email behavior using an Empirical Cumulative Outlier Detection (ECOD) algorithm.
Dependencies are inferred from the claim text.