Proofpoint Patente

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Systems, methods and products for determining the trustworthiness of anonymous sensors, including a sensor health check (102), a data ballpark check (104), a reputation comparison (106), and optional "last resort" procedures (108). The sensor health check (102) examines sensor operating parameters to see if they fall within an envelope of expected values. If not, the sensor is unhealthy and is not trusted. The data ballpark check (104) determines whether the sensor's traffic data falls within a predefined envelope of values. If the sensor is healthy and the traffic is within expected ranges, the sensor is trusted. If the traffic data is outside expected ranges, the reputation comparison (106), determines whether IP addresses, domains or other IOCs in the traffic data are found in the reputation list which may corroborate the traffic as trustworthy because it represents malicious or not-in-the-wild traffic. "Last resort" procedures (108) may include applying safelists/blocklists, signature controls etc. to verify sensor/data trustworthiness.

A message-hold decision maker system (102) used with an electronic mail processing system that processes electronic messages for a protected computer network improves the electronic mail processing system's performance by increasing the throughput performance of the system. The improvements are achieved by providing an electronic mail processing gateway (104) with additional logic that makes fast and intelligent decisions on whether to hold, block, allow, or sandbox electronic messages in view of potential threats such as viruses or URL-based threats. A message hold decision maker (106) uses current and stored information from a plurality of specialized classification engines (108, 110) to quickly make the decisions. In some examples, the message hold decision maker (106) will instruct an email gateway (104) to hold an electronic mail message while the classification engines (108, 110) perform further analysis.

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Aspects of the disclosure relate to detecting and protecting against cybersecurity attacks using unprintable tracking characters. A computing platform may receive (605) a character-limited message sent to a user device. Subsequently, the computing platform may detect (610) that the character-limited message sent to the user device includes suspicious content. Then, the computing platform may generate (615) a modified character-limited message by inserting one or more special characters into the character-limited message and cause (620) transmission of the modified character-limited message to the user device. Next, the computing platform may receive (625), from the user device, a spam report that includes the modified character-limited message. Then, the computing platform may identify (630) a presence of the one or more special characters included in the modified character-limited message and adjust (635) one or more filters based on the identification.

Aspects of the disclosure relate to anomaly detection in cybersecurity training modules. A computing platform may receive (510) information defining a training module. The computing platform may capture (530) a plurality of screenshots corresponding to different permutations of the training module. The computing platform may input (540), into an auto-encoder, the plurality of screenshots corresponding to the different permutations of the training module, wherein inputting the plurality of screenshots corresponding to the different permutations of the training module causes the auto-encoder to output (545) a reconstruction error value. The computing platform may execute an outlier detection algorithm on the reconstruction error value, which may cause the computing platform to identify (550) an outlier permutation of the training module. The computing platform may generate (555) a user interface comprising information identifying the outlier permutation of the training module. The computing platform may send the user interface to at least one user device.

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Aspects of the disclosure relate to providing secure shortened URLs in character-limited messages. A computing platform may receive (805) one or more character-limited messages sent to a user device. The computing platform may detect (810) a URL within the one or more character-limited messages for replacement and generate (815) a shortened URL corresponding to the detected URL, wherein a domain of the shortened URL is hosted by the message security system. The computing platform may then modify the one or more character-limited messages by replacing (820) the URL with the shortened URL, and then cause (825) transmission of the modified one or more character-limited messages to the user device. Next, the computing platform may receive (830), from the user device, a request to access the shortened URL, and redirect (845) the user device to the detected URL corresponding to the shortened URL.

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Aspects of the disclosure relate to providing commercial and/or spam messaging detection and enforcement. A computing platform may receive (305) a plurality of text messages from a sender. It may then tokenize (315) the plurality of text messages to yield a plurality of tokens. The computing platform may then match (320) one or more tokens of the plurality of tokens in the plurality of text messages to one or more bulk string tokens. Next, it may detect (325) one or more homoglyphs in the plurality of text messages, and then detect (330) one or more URLs in the plurality of text messages. The computing platform may flag (345) the sender based at least on the one or more matching tokens, the one or more detected homoglyphs, and the one or more detected URLs. Based on flagging (345) the sender, the computing platform may block (350) one or more messages from the sender.

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Aspects of the disclosure relate to dynamic and automated spear phishing management. A computing platform may identify users to receive a simulated spear phishing message. In some instances, the computing platform may receive (515) a very attacked persons (VAP) list and may identify (520) the users to receive the simulated spear phishing message based on the VAP list. Based on historical message data associated with a first user, the computing platform may identify (525) message features associated with the first user. Using a predetermined template and for a first user account linked to the first user, the computing platform may generate (545, 550) a first spear phishing message based on the message features. The computing platform may then send (555), to the first user account, the first spear phishing message.

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Aspects of the disclosure relate to detecting impersonation in email body content using machine learning. Based on email data received from user accounts, a computing platform may generate (510) user identification models that are each specific to one of the user accounts. The computing platform may intercept (515) a message from a first user account to a second user account and may apply (520) a user identification model, specific to the first user account, to the message, so as to calculate feature vectors for the message. The computing platform then may apply impersonation algorithms to the feature vectors and may determine that the message is impersonated. Based on results of the impersonation algorithms, the computing platform may modify (540, 550, 560, 565) delivery of the message.

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

A rules engine is adapted for analyzing each match produced by a domain discovery system as matching a seed domain. Utilizing a natural language processing (NLP) library, the rules engine determines (310) segments from the match, assigns (320) a lexical category to each segment based on the context in how a seed domain string is used, and compares the lexical category of the segment that is closest to the seed domain string with a lexical category of the seed domain string. Based on the comparing, the rules engine determines whether the match is relevant to the seed domain and, if not, the match produced by the domain discovery system is identified as a false positive and automatically removed (330) from a set of matches produced by the domain discovery system for the seed domain.