Patent ID: 11962608
Assignee: DARKTRACE HOLDINGS LIMITED
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 0:
1. A cyber threat defense system for a network including an email domain, comprising a computing device communicatively coupled to a set of computing devices, the computing device comprising:
a first module configured to utilize a set of machine learning models, communicate with a cyber threat module, and receive information from a set of detectors to provide at least a range of metadata from observed email communications in the email domain, wherein the cyber threat module is configured to cooperate with the first module to (i) analyze the range of metadata from the observed email communications and (ii) analyze the machine learning models trained on a normal behavior of email activity and user activity associated with the network and its email domain to determine when a deviation from the normal behavior of email activity and the user activity associated with the network and its email domain occurs;
a mass email association detector configured to determine a similarity between two or more emails being i) sent from or ii) received by a collection of two or more individual users in the email domain in a prescribed time frame, wherein one or more mathematical models are used to determine similarity weighing to derive a similarity score between compared emails;
an email layout change predictor module configured to detect anomaly deviations by considering at least a layout of the email, wherein the email layout change predictor module utilizes one or more machine learning models that are trained to model and store a historical norm state of the layout of the email, including at least a formatting of the email and a structure of an email body;
an image-tracking link module configured to cooperate with the email layout change predictor module to analyze properties that describe the visual style and appearance of the tracking link to detect whether the tracking link is a suspicious covert tracking link, and wherein an autonomous response module is configured to take an autonomous action to remedy the tracking link when the tracking link is determined to be a suspicious covert tracking link while allowing other emails with a tracking link to enter the email domain; and
wherein when software instructions are implemented in the first module, the cyber-threat module, and the one or more machine learning models, the software instructions are stored in an executable form in one or more memories and configured to be executed by one or more processors.