Patent ID: 11943193
Assignee: PROOFPOINT, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 16:
17. The method of claim 16, wherein analyzing the second email message using the user graph and the decision tree model comprises:
identifying, using the user graph, a plurality of nearest neighbor recipients for a message sender of the second email message;
identifying, using a plurality of machine learning models, a context of the second first email message;
identifying whether historical messages between the message sender of the second email message and second target recipient domain include a first level match of the context of the second email message;
based on identifying that the historical messages between the message sender of the second email message and the second target recipient domain include the context of the second email message, identifying whether the second email message violates the one or more data loss prevention rules;
based on identifying that the historical messages between the message sender of the second email message and the second target recipient domain do not include the first level match of the context of the second email message:
identifying whether the second target recipient domain corresponds to a user included in the plurality of nearest neighbor recipients;
identifying whether the context of the second email message is a second level match with a context of one or more of historical messages between the message sender of the second email message and the nearest neighbor recipients;
based on identifying that: a) the second target recipient domain corresponds to a user included in the plurality of nearest neighbor recipients, and b) the context of the first second email message is a second level match with a context of one or more of historical messages between the message sender of the second email message and the nearest neighbor recipients, sending a notification to the user device of the message sender of the second email message indicating that the second email message may be intended for a different recipient and prompting the message sender of the second email message to send the second email message or modify the second target recipient domain;
based on identifying that either: a) the second target recipient domain does not correspond to a user included in the plurality of nearest neighbor recipients, or b) the context of the second email message is not a second level match with a context of one or more of historical messages between the message sender of the second email message and the nearest neighbor recipients:
identifying, for each nearest neighbor recipient, a corresponding new plurality of nearest neighbor recipients;
identifying whether the second target recipient domain is a third level match with a user included in one or more of the new pluralities of nearest neighbor recipients;
based on identifying that the second target recipient domain is a third level match with a user included in the one or more of the new pluralities of nearest neighbor recipients, sending a notification to the user device of the message sender of the second email message indicating that the second email message may be intended for a different recipient and prompting the message sender to send the first second email message or modify the second target recipient domain;
based on identifying that the second target recipient domain is not a third level match with a user included in the one or more of the new pluralities of nearest neighbor recipients:
if the context of the second email message was identified as a second level match with a context of the one or more historical messages between the message sender of the second email message and the nearest neighbor recipients, sending a notification to the user device of the message sender of the second email message indicating that the second first email message may be intended for a different recipient and prompting the message sender of the second email message to send the second email message or modify the second target recipient domain, wherein the notification includes a spelling mistake recommendation indicating a difference between the second target recipient domain and one or more recipient domains of the approximate context match; and
if the context of the second email message was not identified as a second level match with a context of the one or more historical messages between the message sender of the second email message and the nearest neighbor recipients, sending a notification to the user device of the message sender of the second email message indicating that the second email message may be intended for a different recipient and prompting the message sender of the second email message to send the second email message or modify the second target recipient domain.