Patent ID: 11863566
Assignee: PROOFPOINT, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 9:
10. A method, comprising:
at a computing platform comprising at least one processor, a communication interface, and memory:
monitoring an electronic messaging server associated with an enterprise organization;
based on monitoring the electronic messaging server associated with the enterprise organization, identifying bi-directional messaging traffic between one or more enterprise domains associated with the enterprise organization and one or more external domains not associated with the enterprise organization;
based on identifying the bi-directional messaging traffic between the one or more enterprise domains associated with the enterprise organization and the one or more external domains not associated with the enterprise organization, selecting a plurality of external domains for a conversation detection process;
computing an initial set of rank-ordered external domains by:
1) For each external domain of the plurality of external domains selected for the conversation detection process:
a) identifying a first number of messages sent from an enterprise domain of the one or more enterprise domains to the external domain;
b) identifying a second number of messages received at the one or more enterprise domains from the external domain;
c) computing a first ratio and a second ratio, wherein:
 the first ratio is the first number divided by the second number, and
 the second ratio is the second number divided by the first number;
d) identifying a difference between the first ratio and the second ratio; and
e) applying a weight value to the difference based on a quantity of messages corresponding to the first number and the second number, resulting in a weighted difference value for the external domain, wherein the weighted difference value for the external domain indicates a need for enhanced protection measures; and

2) Ranking the plurality of external domains selected for the conversation detection process based on each external domain's corresponding weighted difference value;

removing, from the initial set of rank-ordered external domains, a set of one or more known outlier domains, resulting in a final set of rank-ordered external domains;
applying a security scoring process to the final set of rank-ordered external domains to compute a weighted security score for at least one external domain of the final set of rank-ordered external domains;
determining a weighted grade for the at least one external domain based on the weighted security score for the at least one external domain; and
executing one or more enhanced protection actions associated with the at least one external domain of the final set of rank-ordered external domains based on comparison of the weighted grade to one or more enhanced protection thresholds.