Patent ID: 11962608
Assignee: DARKTRACE HOLDINGS LIMITED
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 11:
12. The method for the cyber threat defense system of claim 11, wherein the mass email association module determines a likelihood that two or more emails that are being i) sent from or ii) received by a collection of users in the email domain under analysis in the prescribed time period, based on at least i) historical patterns of communication between those users, and ii) the rarity of the collection of users under analysis sending and/or receiving email in the prescribed time frame, where the mass email association module uses the normal behavior of email activity and user activity associated with the network and its email domain to create a map of associations between users in the email domain to generate the likelihood that the two or more users would be included in the emails determined by the mass email association detector.