Network security database sorting tool

A method comprises creating a word vector from a message, wherein the word vector comprises an entry for each word of a plurality of words, and wherein each word of the plurality of words is assigned a weight. The method further comprises calculating a value for the word vector based on each entry of the word vector and the weights assigned to the plurality of words, and identifying that the message belongs to a first group by comparing the value for the word vector to a threshold. The word vector comprises an entry for each word of a plurality of words, and wherein each word of the plurality of words is assigned a weight.

TECHNICAL FIELD

This disclosure relates generally to a system for improving network security. More specifically, this disclosure relates to improving network security using a network security database sorting tool.

BACKGROUND

The security of a network may be threatened in various ways. For example, the network may be exposed to malware, viruses, malicious intrusions, hacks, etc. which may threaten the security of the network and the security of other nodes on the network. Therefore, maintaining the security of a network is important to the functioning of the network.

SUMMARY OF THE DISCLOSURE

According to one embodiment, a network security database sorting tool comprises a memory, a translation engine, and a sorting engine. The memory is configured to store a plurality of words, wherein each of the plurality of words is assigned a weight. The translation engine is configured to create a word vector from a message stored in a database, wherein the word vector comprises an entry for each word of the plurality of words, and each entry indicating a number of occurrences in the message of the word for that entry. The sorting engine is configured to calculate a value for the word vector based on each entry of the word vector and the weights assigned to the plurality of words and identify that the message belongs to a first group by comparing the value for the word vector to a threshold.

According to another embodiment, a method comprises creating a word vector from a message, wherein the word vector comprises an entry for each word of a plurality of words, and wherein each word of the plurality of words is assigned a weight. The method further comprises calculating a value for the word vector based on each entry of the word vector and the weights assigned to the plurality of words, and identifying that the message belongs to a first group by comparing the value for the word vector to a threshold. The word vector comprises an entry for each word of a plurality of words, and wherein each word of the plurality of words is assigned a weight.

According to another embodiment, one or more computer-readable non-transitory storage media embodying software that is operable when executed to create a word vector from a message, calculate a value for the word vector, and identify that the message belongs to a first group by comparing the value for the word vector to a threshold. The word vector comprises an entry for each word of a plurality of words, wherein each word of the plurality of words is assigned a weight. The value for the word vector is calculated based on each entry of the word vector and the weights assigned to the plurality of words.

Certain embodiments may provide one or more technical advantages. For example, an embodiment of the present disclosure may quickly and automatically identify possible or actual threats that may jeopardize network security. As another example, an embodiment of the present disclosure may result in a more accurate assessment of possible or actual threats to network security. Other technical advantages will be readily apparent to one skilled in the art from the following figures, descriptions, and claims. Moreover, while specific advantages have been enumerated above, various embodiments may include all, some, or none of the enumerated advantages.

DETAILED DESCRIPTION OF THE DISCLOSURE

The security of a computer network is important to the functioning of the network. If a network is not secure, any number of types of intrusions and/or malware may jeopardize the core functionality of the network or any user device on the network. As such, maintaining the security of the network is a primary concern for network operators. Generally, network operators become aware of a threat to network security only after some period of time. Although operators may work diligently to assess and resolve the security issue, in many instances, any number of users or computers on the network may be affected in the interim. This disclosure contemplates a system for improving network security by using a network security database tool. The network security database tool is configured to analyze messages submitted by users of the network and identify messages that contain information concerning the security of the network. For example, network security database tool may be configured to identify that a first user-submitted message contains information about the security of the network when the contents of the first user-submitted message indicate that the user's device has contracted a virus. Alternatively, network security database tool may be configured to identify that a second user-submitted message does not contain information about the security of the network when the text of the second user-submitted message merely recites: “The network is slow.” Accordingly, network security database tool may quickly and accurately identify possible or actual threats that may jeopardize network security.

Network security database tool may also be configured to filter user-submitted messages based on the type of threat that the network is presented with. For example, network security database tool may be able to determine the specific type of network threat (e.g., malware, viruses, malicious intrusions, hacks, etc.) indicated by the contents of a user-submitted message. In some embodiments, network security database tool may be configured to store a derivative of the user-submitted message, thereby permitting network security database tool to become more accurate over time.

By using the system, network security may be maintained and/or improved. For example, the present disclosure provides a system configured to detect possible or actual threats to network security based on user-submitted messages. Early detection of network security threats may result in more expeditious resolution of potential network problems. Accordingly, the system described in the present disclosure may improve network security. The system will be described in more detail below in reference toFIGS. 1 through 6. Specifically, the sorting function of network security database tool (also referred to as a network security database sorting tool) will be described in reference toFIGS. 1 through 3and the filtering function of network security database tool (also referred to as a network security database filtering tool) will be described in reference toFIGS. 4-6.

FIG. 1illustrates a system100for improving network security by sorting messages using a network security database tool. As illustrated inFIG. 1, system100includes one or more users105, one or more devices110, a network115, a database120, and a network security database tool125.

One or more users105may be one or more users of devices110. Device110may communicate with other components of system100. For example, device110may communicate messages130to other components of system100. In some embodiments, user105may send a message130using device110to report information about network115.

This disclosure contemplates device110being any appropriate device that can communicate over network110. For example, device110may be a computer, a laptop, a wireless or cellular telephone, an electronic notebook, a personal digital assistant, a tablet, a server, a mainframe, or any other device capable of receiving, processing, storing, and/or communicating information with other components of system100. Device110may also include a user interface, such as a display, a microphone, keypad, or other appropriate terminal equipment usable by a user. In some embodiments, an application executed by device110may perform the functions described herein.

Network115facilitates communication between and amongst components of system100. This disclosure contemplates network115being any suitable network operable to facilitate communication between the components of system100. Network115may include any interconnecting system capable of transmitting audio, video, signals, data, messages, or any combination of the preceding. Network115may include all or a portion of a public switched telephone network (PSTN), a public or private data network, a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a local, regional, or global communication or computer network, such as the Internet, a wireline or wireless network, an enterprise intranet, or any other suitable communication link, including combinations thereof, operable to facilitate communication between the components.

Database120may be configured to store a plurality of messages130. Messages130may be messages sent over network115by a user105of device110. In some embodiments, messages130may include information relevant to the security of network115. For example, a user105may use device110to send a message over network115to complain that malware has been detected on device110. Such a message130may be stored in database120.

In some embodiments, database140may also be configured to store information about a user105who submitted message130. For example, memory140may be configured to store information related to a user name of user105, contact information for user105, platform information indicating the platform that user105used to submit message130, or any other suitable information related to user105who submitted message130.

As depicted inFIG. 1, network security database tool125is configured to sort user-submitted messages130and identify which, if any, of the plurality of messages130are relevant to the security of network115. For example, network security database tool125may be used to sort messages, such as message130, into a first group170aor a second group170b. In some embodiments, first group170amay comprise messages130indicative of a network security issue and second group170bmay comprise messages130that are not indicative of a network security issue.

Network security database tool125may include a processor135and a memory140. In some embodiments, processor135is communicatively coupled to memory140. This disclosure contemplates processor135and memory140being configured to perform any of the functions of network security database tool125as described herein.

Memory140may store a plurality of words145. In some embodiments, plurality of words145may include each and every word of a particular language. For example, memory140may include every word in a dictionary (e.g., Merriam-Webster Dictionary or the Oxford English Dictionary).

Memory140may also store a plurality of weights150. In some embodiments, one of the plurality of weights150is assigned to each word of the plurality of words145. For example, the word “a” may be assigned a weight of 0. As another example, the word “inoperable” may be assigned a weight of 5. As yet another example, the word “working” may be assigned a weight of 5. In some embodiments, the value of weights150correspond to the likelihood or probability that a word is related to a network security problem. Accordingly, in some embodiments, words that suggest a threat to network115may be assigned a greater weight than a word that does not suggest a threat to network115.

In operation, network security database tool125receives a message130from database120and translates message130into a word vector155. In some embodiments, plurality of words145are used to construct word vector155. Construction of word vector155will be described in further detail in reference toFIG. 2. Network security database tool125may further be configured to calculate a value160for the word vector155. In some embodiments, value160of word vector155is calculated based on weights150. Network security database tool125may also be configured to compare calculated value160to a threshold165, and based on the comparison, sort message130into first group170aor second group170b. As described above, in some embodiments, one of the groups170may be a group for messages that are indicative of a network security issue. Accordingly, system100ofFIG. 1is configured to improve network security by identifying which, if any, messages of plurality of messages130comprise content relevant to the security of network115.

Generally,FIG. 1shows a system for improving network security by sorting user-submitted messages130of database120.FIG. 2depicts the sorting function of network security database tool125in further detail andFIG. 3illustrates one embodiment of a method for sorting user-submitted messages130using network security database tool125.

As described above,FIG. 2illustrates the sorting function of network security database tool125. In some embodiments, network security database tool125may include a translation engine205and a sorting engine210. Together, translation engine205and sorting engine210may cause the sorting of message130into a group170.

Translation engine205may be configured to translate a message (e.g., message130) into a word vector (e.g., word vector155). In some embodiments, word vector155is constructed based on plurality of words145stored in memory140. For example, word vector155may comprise an entry215for each word of plurality of words145. In some embodiments, each entry215indicates that a particular word appears in message130. In other embodiments, each entry215may indicate the number of occurrences that a particular word appears in message130. For example, in some embodiments, translation engine205may determine a word of the plurality of words145that corresponds to each entry215and indicate whether the word appears in message130. As one example, translation engine205may indicate whether a particular word appears in message130by recording a 0 in the corresponding entry if the word is not present in message130, or alternatively, entering a 1 in the corresponding entry if the word is present in message130. Accordingly, in some embodiments, word vector155may comprise a series of 1's and 0's indicating the presence or absence of each of the plurality of words145in message130. In some other embodiments, translation engine205may be configured to count the number of times that a particular word of the plurality of words145appears in message130and record the number of times the particular word actually appears in entry215.

As depicted inFIG. 2, the word vector155created from message130is: 010020301. In such an example, the second word of the plurality of words appears once, the fifth word of the plurality of words appears twice, the seventh word of the plurality of words appears three times, and the ninth word of the plurality of words appears one time in message130. Additionally, message130did not include any words corresponding to the first, third, fourth, sixth or eighth words of plurality of words145. Although this disclosure describes and depicts particular ways to create a word vector from a message, this disclosure recognizes any suitable method of creating a word vector155from message130. This disclosure contemplates word vector155including any number of entries to accommodate any number of words.

Sorting engine210may be configured to calculate a value (e.g., value160) for word vector155and compare the value to a threshold (e.g., threshold165) in order to determine whether to sort message130into first group170aor second group170b. In some embodiments, sorting engine210calculates a value160for word vector155based on weights150stored in memory140. As described above, weights150may be assigned to each of the plurality of words145. In some embodiments, words that are suggestive of a network security issue may have a greater weight than words that are not suggestive of a network security issue.

Calculating a value160for word vector155may be understood in reference to TABLES 1 and 2 below:

TABLE 1Message 130: “Help. My account has been hacked. I can't be hacked!”

TABLE 2# of Times WordWord Value inStored WordWeightAppears in Message 130Message 130account717be010been010can't010has010hacked10220help515I010my010Total Value 160 of Word Vector 15532

TABLE 1 includes message130including the following text: “Help. My account has been hacked. I can't be hacked.” TABLE 2 shows a plurality of weights150assigned to each of the plurality of words145and the number of time each of the plurality of words145appears in message130. Although message130contains nine different words, only a select few are informative of a network security issue. For example, the words “help,” “account,” and “hacked” may be suggestive of a word that is indicative of a network security issue and thus may be assigned a higher weight than other words appearing in message130. For example, as depicted in TABLE 2, the words “help,” “account,” and “hacked” are assigned a greater weight than the words “be,” “been,” “can't,” “has,” “I,” and “my.”

In the example depicted in TABLE 2, network security database tool125may calculate a word value corresponding to each word that is present in message130in order to calculate a total value160for word vector155. In some embodiments, network security database tool125may determine the number of times a particular word occurs in message130and incorporate the number of occurrences in calculating a word value. For example, in some embodiments, network security database tool125may calculate a word value using the following formula:
[weight assigned to word #*number of times word # appears in message 130]
Applying this formula to TABLE 2, network security database tool125may calculate the word value for “account” as [(7)*(1)]=7. Using this same formula, network security database tool125may calculate each word value for the words present in message130.

In some embodiments, such as depicted in TABLE 2, network security database tool125may calculate a total value160for word vector155by summing the products of each word value. For example, taking the above example of TABLE 2, network security database tool125may add 7+0+0+0+0+20+5+0+0=32. Although particular ways of calculating a value for a word vector have been described herein, this disclosure recognizes any suitable method of calculating a value160for word vector155.

Sorting engine210is further configured to compare calculated value160to a threshold (e.g., threshold165) in order to sort message130into a group170in some embodiments. Threshold165may be fixed or variable. Threshold165may also be predetermined or learned. In some embodiments, network security database tool125sorts message130into a group170in response to determining that value160is greater than threshold165. In other embodiments, network security database tool125sorts message130into a group170in response to determining that value160is greater than or equal to threshold165. For example, if threshold165of system100is30, message130of TABLE 1 above may be sorted into first group170a(wherein first group170ais a group for messages indicative of a network security issue) because the calculated value160in TABLE 2 is 32.

In some embodiments, network security database tool125may be configured to extract a portion of the text of message130. The extracted text may be a word (or words) in message130that are assigned a particular weight. In some embodiments, a word (or words) may be extracted based on a weight threshold (e.g., network security database tool125may extract a word from message130if the word has a weight greater than or equal to 4). Taking the above example depicted in TABLES 1 and 2, network security database tool125may extract the words “account,” “hacked,” and “help” because these words are assigned a weight of 5 or more. In some embodiments, the extracted text is suggestive or indicative of a problem with network115. In some embodiments, the extracted text is used to reformat message130to include a phrase425(e.g., reformatting engine515uses extracted text to create phrase425from message130). The reformatting of messages130into phrases425will be described in further detail below in reference toFIG. 5.

In some embodiments, network security database tool125may also include a transcription engine (not depicted). Because network security database tool125may only be able to sort messages130including text written in the same language as plurality of words145, it may be beneficial to transcribe message130from its original language into the language of plurality of words145. Accordingly, the transcription engine may be configured to transcribe message130from a first language to a second language. In some embodiments, plurality of words145are in the second language. Thus, in operation, network security database tool125may receive message130from database120and transcribe message130from a first language to a second language. As a result, translation engine205may be able to create a word vector155from transcribed message130and sorting engine210may be able to sort message130into first group170aor second group170b.

For example, in some embodiments, the transcription engine is configured to identify that message130is not written in the same language as plurality of words145. In some embodiments, identifying that message130is written in a language other than the language of plurality of words145is based on a failed attempt to translate message130into a word vector155using translation engine205. In some embodiments, identifying that message130is written in a different language than the language of plurality of words145is based on matching words in message130to a plurality of foreign words. The plurality of foreign words may comprise each word of every recognizable language. In some embodiments, the plurality of foreign words are stored in database120. In other embodiments, the plurality of foreign words are stored in memory140. In yet other embodiments, the plurality of foreign words are stored in an external database (not depicted).

In some embodiments, the transcription engine is configured to identify the language of message130. In some embodiments, identifying the language of message130is based on a threshold. For example, in some embodiments, the transcription engine may identify that message130is written in a first language because more than 85% of words of message130matched the plurality of foreign words in the first language. The threshold for identifying the language of message130may be fixed or variable. In some other embodiments, identifying the language of message130is based on a success rate for matching words of message130to the plurality of foreign words in each language. For example, in some embodiments, the transcription engine may perform a matching analysis of words of message130to the plurality of foreign words in each language. As an example, the transcription engine may determine that words of message130matched a first language at a rate of 85%, matched a second language at 92%, and a third language at 33%. Based on these determinations, the transcription engine may determine that message130is written in the second language. In response to identifying the language of message130, the transcription engine may be configured to transcribe message130into the language of the plurality of words145.

In some embodiments, the original message130is sorted into a group170. In other embodiments, the transcribed message is sorted into a group170. In yet other embodiments, both the original message and the transcribed message are sorted into a group170. In some embodiments, message130is in any recognizable language. The present disclosure contemplates that the transcription engine is configured to recognize that a message is written in a language different than the language of the plurality of words145and transcribe the message into the language used by the plurality of words145. Accordingly, network security database tool125may sort any message130from any user105regardless of the language that user105uses to submit message130.

In some other embodiments, network security database tool125may include an error detection engine (not depicted) and/or an error correction engine (not depicted). The error detection engine may be configured to detect errors in message130. The ability to detect errors in message130may be beneficial because network security database tool125may not be able to sort messages130containing errors. For example, network security database tool125may have trouble analyzing the contents of message130because a word having a typographical error would not appear in the plurality of words145stored in memory140. Thus, the present disclosure recognizes utilizing an error detection engine to detect errors in message130. In some embodiments, if the error detection engine detects one or more errors in message130, message130is flagged for manual review. In other embodiments, if the error detection engine detects one or more errors in message130, message130may be flagged for correction by an error correction engine. The error correction engine may be configured to correct errors in messages130. In some embodiments, the error correction engine is configured to correct errors detected by the error detection engine.

For example, in some embodiments, the error detection engine is configured to flag words in message130that do not correspond to one of the plurality of words145stored in memory140. As an example, message130may include the following text: “My computer contracted a viruss.” The error detection engine may be ensure that each word of message130appears in plurality of words145. In response to detecting that one or more of the words in message130does not appear in plurality of words145, error detection engine may flag the particular word. Taking the prior example, the error detection engine may flag the word “viruss” in message130because the word “viruss” does not appear in plurality of words145. In response to being flagged, the error correction engine may analyze the one or more flagged words in message130and make a determination as to what the flagged word should be. In some embodiments, the error correction engine analyzes a flagged word and determines one or more words that are similar to the flagged word (e.g., determining the cosine difference between the flagged word and the one or more similar words). In some embodiments, the error correction engine selects a word from plurality of words145when determining which word of the one or more similar words to substitute for the flagged word.

Turning now toFIG. 3, the method300depicts one embodiment of sorting user-submitted messages using network security database tool125. The method300may begin in step305. At step310, network security database tool125receives a message130from database120. As described above, message130may be a message sent over network115by user105on device110. In some embodiments, message130is related to a network security issue. For example, message130of user105may include a complaint that his account has been compromised or, for example, that the server is down. In some embodiments, user-submitted messages130may be stored in database120and network security database tool125receives messages130from database120. In some embodiments, method300continues to step315.

At step315, network security database tool125creates a word vector155from message130. Word vector155may be constructed from plurality of words145stored in memory140. For example, word vector155may comprise an entry215for each word of plurality of words145. In some embodiments, each entry215may indicate the number of occurrences that a particular word appears in message130. In some embodiments, the method300continues to step320.

At step320, network security database tool125calculates a value160for the word vector155. In some embodiments, value160of word vector155is based on the weights150assigned to words145stored in memory140. As an example, message130may contain the text: “Server does not work.” Memory140may assign the following weights to the words appearing in the message text: “server”—10, “does”—0, “not”—2, and “work”—5. In some embodiments, network security database tool125calculates a value for each word and then calculates a total value (e.g., value160) for message130. Taking the above example, the total value160for the message “Server does not work” is 17.

In some embodiments, the calculation of value160may account for the number of occurrences that a word appears in message130. For example, message130may contain the text: “Server is not working. Server must be down.” Memory140may assign the following weights to the words appearing in the message text: “server”—10, “is”—0, “not”—2, “working”—5, “must”—0, “be”—0, “down”—7. Given such an example, network security database tool125may calculate total value160for the message accordingly ([weight assigned to word #1*number of occurrences of word #1 in message130]+[weight assigned to word #2*number of occurrences of word #2 in message130+[ . . . etc.]). Thus, network security database tool125may calculate value160for the above example as: ([10*2]+[0*1]+[2*1]+[5*1]+[0*1]+[0*1]+[7*1]) and determine value160is 34. Although this disclosure describes particular ways of calculating value160, this disclosure contemplates any suitable method. In some embodiments, method300continues to step325.

At step325, network security database tool125compares value160to a threshold165. Threshold165may be used to determine whether a message130belongs to a first group170aor a second group170b. In some embodiments, message130belongs to a first group170A when the value160for the word vector155is greater than threshold165. In other embodiments, message130belongs to a second group170B when the value160for the word vector155is less than the threshold165. This disclosure contemplates that threshold may be fixed or variable. In some embodiments, the method300continues to a step330.

At step330, network security database tool125determines whether the value160is greater than or equal to threshold165. If network security database tool125determines that value160is greater than or equal to threshold165, method300may continue to a step335. If, however, network security database tool125determines that the value160is less than threshold165, method300may continue to a step340.

At step335, network security database tool125sorts message130into first group170a. In some embodiments, first group170A comprises messages that are relevant to the security of network115. In some embodiments, the method300continues to an end step345. If, however, network security database tool125determined that value160is less than threshold165at step330, network security database tool125sorts message130into second group170b. In some embodiments, second group170bcomprises messages that are not relevant to the security of network115. In some embodiments, method300continues to an end step345.

In some embodiments, method300may include an additional step (not depicted) wherein the user who submitted message130is notified. Notification to user105may be in response to receiving message130, sorting message130according to principles of the present disclosure, filtering message130according to principles of the present disclosure, and/or resolving the network security issue raised by message130. Although particular reasons to notify user105have been described, this disclosure recognizes notifying user105for any suitable reason. Additionally, because database120may be configured to store contact information of user105, network security database tool125may contact user105using the same platform that user105used to submit message130.

In addition to sorting user-submitted messages, network security database tool may also be configured to filter user-submitted messages. In some embodiments, messages130are filtered based on the type of threat that the network is presented with.FIG. 4illustrates this filtering function of network security database tool125.FIG. 5depicts further details of the filtering function of network security database tool125andFIG. 6illustrates one embodiment of a method for filtering messages130to determine the threat presented to network115.

As described above,FIG. 4illustrates a system for improving the security of network115by filtering messages130using network security database tool125. System400may include one or more of the same or similar components that were described and depicted in reference toFIG. 1. For example, system400may include one or more users105, one or more devices110, a network115, a database120, and a network security database tool125. Database120may include messages such as message130. Messages130may be messages sent by users105of devices110over network115. In some embodiments, message130contains information related to the security of network115.

Network security database tool125may include a processor135and a memory140. In some embodiments, processor135is communicatively coupled to memory140. This disclosure contemplates processor135and memory140being configured to perform any of the functions of network security database tool as described herein.

Memory140may be configured to store a plurality of words145and a plurality of group vectors405. As described above, network security database tool125may be configured to create a word vector155from message130based on the plurality of words145stored in memory140(e.g., using translation engine205). The plurality of group vectors405may be one or more vectors related to a particular type of network security issue. For example, one group vector of the plurality of group vectors405may be a vector for virus-related network security issues. As another example, one group vector of the plurality of group vectors405may be a vector related to compromised accounts. As yet another example, one group vector of the plurality of group vectors405may be a vector related to an irresponsive server.

Each group vector of the plurality of group vectors405may include one or more related groups410. For example, one group vector of the plurality of group vectors405may comprise one or more groups410related to a compromised account. For example, one or more groups410related to compromised accounts may include a stolen password group, an identity theft group, or a changed password group. Network security database tool125may be configured to assign message130to one of the one or more groups410related to plurality of word vectors405. Assigning message130to one of the one or more groups410will be described in further detail below in reference toFIG. 6.

Memory140may also include a preferred entry format415in some embodiments. Preferred entry format415may be used to construct a phrase425from message130. In some embodiments, phrase425may be assigned to the same group410as the word vector155associated with the same message130.

In general,FIG. 4illustrates a system400for improving the security of network400by identifying the type of threat encountered by network115. Specifically, system400identifies the threat using a filtering function of network security database tool125. As depicted inFIG. 4, network security database tool125is configured to receive message130, transcribe message130into a word vector155, and assign message130to one of the one or more groups410based on a calculated cosine difference between word vector155and each of the plurality of group vectors405.

FIG. 5illustrates the filtering function of network security database tool125(also referred to herein as network security database filtering tool). As described above, network security database tool125may be configured to determine the type of threat posed to network115by analyzing the contents of user-submitted messages130. To make this determination, network security database tool125may include a translation engine, a filtering engine, and in some embodiments, include a reformatting engine.

As described in relation toFIG. 2, translation engine205of network security database tool125may construct a word vector155from message130based on plurality of word145. In some embodiments, word vector155comprises one entry215for each word of the plurality of words145.

Filtering engine510of network security database tool125may be configured to calculate the cosine difference between word vector155and each of the plurality of group vectors405. For example, filtering engine510may calculate the cosine difference between word vector155and a first group vector405related to an irresponsive server. As another example, filtering engine510may calculate the cosine difference between word vector155and a second group vector405related to a compromised account or virus. Generally, the cosine difference420is calculated between word vector155and each of the plurality of group vectors405to determine similarity of word vector155to the plurality of group vectors405. In some embodiments, determining the cosine difference between two variables results in a number between the range of 0 and 1, wherein a calculated cosine difference420of 0 indicates that the variables are the same, and a calculated cosine difference420of 1 indicates that the variables are different. Although this disclosure describes calculating the cosine difference to determine the similarity of a word vector155to a group vector405, this disclosure contemplates determining similarity by any suitable means.

Filtering engine510may be further configured to assign word vector155to a group410for a group vector405based on the calculated cosine difference420between the word vector and the group vector405for a group410. Filtering engine510of network security database tool125may calculate a cosine difference420between word vector155and each of the group vectors405stored in memory140and assign word vector155to one of the one or more groups410based on the calculated cosine difference420.

In some embodiments, filtering engine510assigns word vector155to a group of the plurality of groups410based on a threshold. In some embodiments, filtering engine510may be configured to assign word vector155to a group of the one or more groups410when the calculated cosine difference420between a group vector405and a word vector is less than the threshold. For example, network security database tool125may include a cosine difference threshold of 0.15 and may calculate cosine differences420between word vector155and three group vectors405. For example, network security database tool125may calculate cosine difference values as depicted in TABLE 3 below:

In other embodiments, filtering engine510assigns word vector155to a particular one of the one or more groups410based on the least calculated cosine difference420. Again, taking the above example depicted in TABLE 3, filtering engine510may assign word vector155to a group410associated with Group Vector1because the cosine difference420between Group Vector1and word vector155was the least among each of the calculated cosine differences420. In this manner, word vector155may be assigned to a group410based on similarity of word vector155to each of the group vectors405.

As described above, network security database tool125may also comprise a reformatting engine515. Reformatting engine515may be configured to reformat message130to include a phrase425based on preferred entry format415stored in memory140. In some embodiments, reformatting engine515uses text extracted from message130to create phrase425. In some embodiments, phrase425is shorter than message130. In other embodiments, phrase425is longer than message130. Although specific lengths of phrase425have been described, this disclosure contemplates that phrase425may be of any length and may include any suitable number of characters. For example, reformatting engine515may reformat message130of TABLE 1: “Help. My account has been hacked. I can't be hacked!” Reformatting engine515may reformat this message, based on preferred entry format415, to include phrase425: “User reports that his/her account has been compromised.” Reformatting engine515may be configured to assign phrase425to the same group410that filtering engine510assigned word vector155to. Assigning phrase425to one of the one or more groups410may facilitate a subsequent, more accurate, filtering of messages130by network security database tool125.

Network security database tool125may further comprise an update engine (not depicted) in some embodiments. The update engine may be configured to update a group vector of the plurality of group vectors405based on the assignment of phrase425. In some embodiments, assignment of phrase425may change group vector405. For example, assignment of phrase425may change the group vector to include one or more new words145. In this manner, network security database tool125may be self-improving and may filter subsequently received messages130based on feedback. For example, network security database tool125may receive a first message130a, translate first message130ainto word vector155a, and sort word vector155ainto a first group (e.g.,410a). Subsequently, network security database tool125may receive a second message130b, translates second message130binto word vector155b, and based on the updated group vector405corresponding to first group410a, word vector155bmay be assigned to first group410a.

Turning now toFIG. 6, the method600illustrates one embodiment of filtering user-submitted messages130to identify the type of threat posed to network115. The method600begins in step605. At step610network security database tool125receives a message (e.g., message130). Message130may be retrieved from database120. As described above, the contents of message130may or may not be related to a network security issue. In some embodiments, message130has been sorted by network security database tool125(also referred to as network security database sorting tool125). In some embodiments, network security database tool125filters messages130that were sorted into one of the groups170ofFIG. 1. As such, network security database tool125may filter only those messages130that include content relevant to a network security issue. In some embodiments, method600continues to step615.

At step615, network security database tool125creates a word vector (e.g., word vector155) from the received message. Word vector155may be constructed by translation engine205as described above. In some embodiments, the method600continues to step620.

At step620, network security database tool125determines the cosine difference420between word vector155and each group vector of the plurality of group vectors405stored in memory140. In some embodiments, cosine difference420is calculated between word vector155and each of the group vectors of the plurality of group vectors405in order to determine similarity of word vector155to each of the group vectors420. In some embodiments, calculating the cosine difference between the word vector155and each group vector the plurality of group vectors405results in a value between 0 and 1. In some embodiments, the method600continues to step625.

At step625, network security database tool125assigns word vector155to one of the one or more groups410based on a calculated cosine difference420. In some embodiments, network security database tool125assigns word vector155to a group410based on a threshold. In other embodiments, network database tool125assigns word vector155to one of the one or more groups410based on the least calculated cosine difference between word vector155and each of the group vectors405. In yet other embodiments, word vector155is assigned to one of the one or more groups410using any suitable method of determining similarity.

In some embodiments, method600may include one or more additional steps such as assigning phrase425to the same group410as word vector, updating the group vector405associated with the group410that phrase425was assigned to, and/or notifying the user105that submitted message130. For example, in some embodiments, such as depicted inFIG. 6, the method600continues to step630. At step630, network security database tool reformats the contents of message130to include a phrase425based on the preferred entry format415stored to memory140. In some embodiments, extracted text is used to reformat message130(e.g., as described above in reference to TABLES 1 and 2). The method600may continue to step635in some embodiments.

At step635, network security database tool125assigns phrase425to a group410. In some embodiments, phrase425is assigned to the same group410that network security database tool125assigned word vector155to. Additionally, in some embodiments, network security database tool125updates the group vector of the plurality of group vectors405based on the assignment of the phrase425. For example, in response to assigning phrase425to a particular group410, network security database tool125updates the corresponding group vector405to reflect that phrase425has been added. In some embodiments, the method600continues to step640.

At step640, the user who submitted message130is notified. Notification to user105may be in response to receiving message130, sorting message130according to principles of the present disclosure, filtering message130according to principles of the present disclosure, and/or resolving the network security issue raised by message130. Although particular reasons to notify user105have been described, this disclosure recognizes notifying user105for any suitable reason. Additionally, because database120may be configured to store contact information of user105, this disclosure recognizes notifying user105via the same platform that user105used to submit message130. In some embodiments, the method600may continue to an end step645.