Patent ID: 11962608
Assignee: DARKTRACE HOLDINGS LIMITED
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 9:
10. The cyber threat defense system of claim 1, wherein the cyber threat module is configured to receive input from each of the following modules, which include:
the mass email association module further configured to determine a likelihood that two or more emails would be i) sent from or ii) received by a collection of users in the email domain under analysis in the prescribed time period, wherein the prescribed time period is equal to or less than a ten second difference in any of i) a time sent for each of the emails under analysis, and ii) a time received for each of the emails under analysis;
an email similarity scoring module configured to compare an incoming email, and deriving, based on a semantic similarity of multiple aspects of the incoming email to a cluster of different metrics derived from known bad emails, the similarity score between an email under analysis and the cluster of different metrics derived from known bad emails;
the email layout change predictor module further configured to analyze changes in an email layout of an email of a user corresponding to the user's email domain to assess whether malicious activity is occurring to an email account of the user, based on the changes in the email layout of the email deviating from a historical norm;
the image-tracking link module further configured to cooperate with an image-tracking link detector to analyze properties that describe the visual style and appearance of the tracking link to detect whether the tracking link is being intentionally hidden as well as a type of query requests made by the tracking link to determine whether this tracking link is a suspicious covert tracking link; and
wherein the cyber threat module is configured to utilize the input from each of these analyses above in the range of metadata from observed email communications to detect and determine when a deviation from the normal behavior of email activity and user activity associated with the network and its email domain is occurring, and then determine an action to remedy against a potentially malicious email.