Patent ID: 11962608
Assignee: DARKTRACE HOLDINGS LIMITED
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 10:
11. A method for a cyber threat defense system for a network including its email domain, comprising:
using a first module utilizing a set of machine learning models, communicating with a cyber threat module, and configured to receive information from a set of detectors to provide at least a range of metadata from observed email communications in the email domain;
using the cyber threat module that is configured to (i) cooperate with the first module to analyze the range of metadata from the observed email communications based on operations performed by the machine learning models trained on a normal behavior of email activity and user activity associated with the network and its email domain to determine when a deviation from the normal behavior of email activity and user activity associated with the network and its email domain occurs;
using a mass email association detector to determine a similarity between two or more emails being i) sent from or ii) received by a collection of two or more individual users in the email domain in a prescribed simultaneous time frame, where one or more mathematical models are used to determine similarity weighing to derive a similarity score between compared emails; and
using an email layout change predictor module to detect anomaly deviations by considering at least a layout of the email, wherein the email layout change predictor module utilizes one or more machine learning models trained and configured to model and store a historical norm state of the layout of the email, including at least a formatting of the email and a structure of an email body;
wherein when software instructions are implemented in the first module, the cyber-threat module, and the one or more machine learning models, the software instructions are stored in an executable form in one or more memories and configured to be executed by one or more processors.