Patent ID: 11888895
Assignee: PROOFPOINT, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 14:
15. One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:
train a neural network, wherein training the neural network comprises training the neural network using metric learning and sub-word embeddings, and wherein training the neural network using the metric learning comprises:
inputting two or more inputs into the neural network;
identifying labels corresponding to each of the two or more inputs; and
prompting the neural network to produce particular embeddings based on the identified labels;

receive forensics information corresponding to a plurality of message attachments;
generate, for each of the plurality of message attachments, a feature representation;
input the feature representations into the neural network, wherein inputting the feature representations into the neural network results in a numeric representation for each of the plurality of message attachments;
apply a clustering algorithm to cluster each of the plurality of message attachments based on the numeric representations, resulting in clustering information;
extract, from the clustering information, one or more indicators of compromise indicating that one or more of the plurality of attachments corresponds to a threat campaign; and
send, to an enterprise user device, user interface information comprising the one or more indicators of compromise, wherein sending the user interface information causes the enterprise user device to display a user interface identifying the one or more indicators of compromise.