Patent ID: 9123027
Filing Date: 2015-09-01
Classification: G06F,G06Q,H04L

Abstract:
1. A computer-implemented method of analyzing incoming emails, the method comprising: extracting one or more non-semantic data items from an incoming email; determining whether one or more of the non-semantic data items match previously collected malicious activity information stored in a data store; if the non-semantic data items do not match the previously collected malicious activity information, then performing behavioral analysis on one or more of the non-semantic data items including connecting to a web server identified in the non-semantic data items and analyzing the server information for potentially malicious activity; quantifying any potentially malicious non-semantic information with a non-semantic data score for malicious activity; analyzing semantic data associated with the incoming email to determine whether the semantic data matches one or more semantic patterns suggestive of a social engineering attack associated with malicious emails; quantifying any matched semantic information with a semantic data score for potentially malicious activity; and identifying the incoming email as potentially suspect if the non-semantic data score or the semantic data score meets a threshold score for potentially malicious activity.