Patent ID: 11962608
Assignee: DARKTRACE HOLDINGS LIMITED
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 20:
21. A non-transitory computer readable medium deployed within a computing device implemented as part of a network, comprising:
a plurality of machine learning models, communicate with a cyber threat module;
a plurality of detectors configured to collect a range of metadata associated with email activity from observed email communications within an email domain associated with the network;
a cyber threat module communicatively coupled to the plurality of machine learning modules, the cyber threat module is configured to assist in conducting analytics of the range of metadata from the observed email communications, utilizing the plurality of machine learning models trained on a normal behavior of email activity and user activity associated with the network and its email domain, to determine when a deviation from the normal behavior of email activity and user activity associated with the network and its email domain occurs;
a mass email association detector module configured to determine a similarity between a plurality of emails from the observed email communications being i) sent from or ii) received by a collection of two or more individual users in the email domain in a prescribed time frame, wherein one or more mathematical models are used to determine similarity weighing to derive a similarity score between the plurality of emails;
an email layout change predictor module configured to detect anomaly deviations by considering at least a layout of an email of the plurality of emails, wherein the email layout change predictor module utilizes one or more machine learning models of the plurality of machine learning models that are trained to model and store a historical norm state of the layout of the email, including at least a formatting of the email and a structure of an email body;
an image-tracking link module configured to cooperate with the email layout change predictor module to analyze properties that describe a visual style and appearance of a tracking link to detect whether the tracking link is a suspicious covert tracking link, and wherein an autonomous response module is configured to take an autonomous action to remedy the tracking link when the tracking link is determined to be the suspicious covert tracking link while allowing other emails with a tracking link to enter the email domain.