Neural networks for mitigating business email compromise (BEC) events

1 . A computer-implemented method (CIM), the CIM comprising:

training a first neural network on email behavioral characteristics drawn from a threat intelligence data lake;

training a second neural network on email technical characteristics drawn from the threat intelligence data lake;

inputting data from an Endpoint Detection and Response (EDR) system, network traffic, and email to the neural networks for causing the neural networks to analyze the data;

generating an alert related to Business Email Compromise (BEC) based on output(s) from the neural networks; and

instructing the neural networks to analyze the data,

wherein analyzing the data includes:

generating a behavioral analysis neural network diagram,

generating a technical indicators neural network diagram,

wherein the behavioral analysis neural network diagram includes a plurality of first points each representative of events associated with one of email behavioral characteristics,

wherein the technical indicators neural network diagram includes a plurality of second points each representative of events associated with one of email technical characteristics,

wherein the output is generated based on a predetermined process for analyzing the neural network diagrams,

wherein the predetermined process includes:

determining a first mathematical average of values associated with the first points, and determining a second mathematical average of values associated with the second points,

comparing the first mathematical average to a first predetermined threshold, and

comparing the second mathematical average to a second predetermined threshold.

2 . The CIM of claim 1 , wherein the first neural network is a radial-based neural network.

3 . The CIM of claim 2 , wherein the second neural network is a radial-based neural network.

4 . The CIM of claim 1 , wherein the email behavioral characteristics are selected from the group consisting of: attack patterns, email cadence, messaging forms, user-specific profiles, and advanced persistent threats.

5 . The CIM of claim 4 , wherein the email technical characteristics are selected from the group consisting of: spoofed email addresses, compromised user accounts, known malicious internet protocols (IPs) and/or domains, network scanning, and technical threat intelligence.

6 . The CIM of claim 1 , wherein the alert is generated in response to a determination that the first mathematical average exceeds the first predetermined threshold, wherein the alert is generated in response to a determination that the second mathematical average exceeds the second predetermined threshold.

7 . The CIM of claim 6 , comprising: performing tuning on the first neural network and/or the second neural network based on the output(s) from the neural networks.

8 . The CIM of claim 7 , wherein the tuning is selected from the group consisting of: changing a rate of data ingestion, changing a mathematical formula used to calculate the output(s), and changing at least one of the thresholds used to analyze the neural network diagrams.

9 . A computer program product (CPP), the CPP comprising:

a set of one or more computer-readable storage media; and

program instructions, collectively stored in the set of one or more storage media, for causing a processor set to perform the following computer operations:

train a first neural network on email behavioral characteristics drawn from a threat intelligence data lake;

train a second neural network on email technical characteristics drawn from the threat intelligence data lake;

input data from an Endpoint Detection and Response (EDR) system, network traffic, and email to the neural networks for causing the neural networks to analyze the data;

generate an alert related to Business Email Compromise (BEC) based on output(s) from the neural networks; and

instruct the neural networks to analyze the data,

wherein analyzing the data includes:

generating a behavioral analysis neural network diagram,

generating a technical indicators neural network diagram,

wherein the behavioral analysis neural network diagram includes a plurality of first points each representative of events associated with one of email behavioral characteristics,

wherein the technical indicators neural network diagram includes a plurality of second points each representative of events associated with one of email technical characteristics,

wherein the output is generated based on a predetermined process for analyzing the neural network diagrams,

wherein the predetermined process includes:

determining a first mathematical average of values associated with the first points, and determining a second mathematical average of values associated with the second points,

comparing the first mathematical average to a first predetermined threshold, and

comparing the second mathematical average to a second predetermined threshold.

10 . The CPP of claim 9 , wherein the first neural network is a radial-based neural network.

11 . The CPP of claim 10 , wherein the second neural network is a radial-based neural network.

12 . The CPP of claim 9 , wherein the email behavioral characteristics are selected from the group consisting of: attack patterns, email cadence, messaging forms, user-specific profiles, and advanced persistent threats.

13 . The CPP of claim 12 , wherein the email technical characteristics are selected from the group consisting of: spoofed email addresses, compromised user accounts, known malicious internet protocols (IPs) and/or domains, network scanning, and technical threat intelligence.

14 . The CPP of claim 9 , wherein the alert is generated in response to a determination that the first mathematical average exceeds the first predetermined threshold, wherein the alert is generated in response to a determination that the second mathematical average exceeds the second predetermined threshold.

15 . The CPP of claim 14 , the CPP comprising: program instructions, collectively stored in the set of one or more storage media, for causing the processor set to perform the following computer operations: perform tuning on the first neural network and/or the second neural network based on the output(s) from the neural networks.

16 . The CPP of claim 15 , wherein the tuning is selected from the group consisting of: changing a rate of data ingestion, changing a mathematical formula used to calculate the output(s), and changing at least one of the thresholds used to analyze the neural network diagrams.

17 . A computer system (CS), the CS comprising:

a processor set;

a set of one or more computer-readable storage media; and

program instructions, collectively stored in the set of one or more storage media, for causing the processor set to perform the following computer operations:

train a first neural network on email behavioral characteristics drawn from a threat intelligence data lake;

train a second neural network on email technical characteristics drawn from the threat intelligence data lake;

input data from an Endpoint Detection and Response (EDR) system, network traffic, and email to the neural networks for causing the neural networks to analyze the data;

generate an alert related to Business Email Compromise (BEC) based on output(s) from the neural networks; and

instruct the neural networks to analyze the data,

wherein analyzing the data includes:

generating a behavioral analysis neural network diagram,

generating a technical indicators neural network diagram,

wherein the behavioral analysis neural network diagram includes a plurality of first points each representative of events associated with one of email behavioral characteristics,

wherein the technical indicators neural network diagram includes a plurality of second points each representative of events associated with one of email technical characteristics,

wherein the output is generated based on a predetermined process for analyzing the neural network diagrams,

wherein the predetermined process includes:

determining a first mathematical average of values associated with the first points, and determining a second mathematical average of values associated with the second points,

comparing the first mathematical average to a first predetermined threshold, and

comparing the second mathematical average to a second predetermined threshold.

18 . The CS of claim 17 , wherein the first neural network is a radial-based neural network.