Systems and methods for AIDA based grouping
The present disclosure describes systems and methods for dynamically creating groups of users based on attributes for simulated phishing campaign. A campaign controller determines one or more attributes of a plurality of users during execution of a simulated phishing campaign and creates one or more groups of users during based on the identified attributes. The campaign controller selects a template to be used to execute a portion of the simulated phishing campaign for a first group of users and then communicates one or more simulated phishing communications to the first group of users according to the template. The template may identify a list of a plurality of types of simulated phishing communications (email, text or SMS message, phone call or Internet based communication) and at least a portion of the content for the simulated phishing communication.
1. A method for identifying one or more groups of users from a plurality of users during execution of a simulated phishing campaign, the method comprising:
(a) executing, by a campaign controller, a simulated phishing campaign across a plurality of users;
(b) determining, by the campaign controller while executing the simulated phishing campaign, one or more attributes of the plurality of users;
(c) creating, by the campaign controller independent of any user creating one or more groups of users, a first group of users and a second group of users of the one or more groups of users from the plurality of users based at least on the attributes of the plurality of users;
(d) selecting, by the campaign controller responsive to a model trained by applying machine learning to at least the attributes of the plurality of users, a first template from a plurality of templates for the first group of users of the one or more groups of users and a second template from the plurality of templates for the second group of users of the one or more groups of users, the model taking as input from the campaign controller the one or more attributes of the users of the first group of users and providing as output to the campaign controller identification of the first template; and
(e) communicating, by the campaign controller, one or more simulated phishing communications to the first group of users according to the first template and to the second group of users according to the second template.
2. The method of claim 1 , wherein the first template identifies a list of a plurality of types of simulated phishing communications and at least a portion of content for the simulated phishing communications.
3. The method of claim 2 , wherein the plurality of types of simulated phishing communications comprises two or more of the following: an email, a text or SMS message, a phone call or an Internet based communication.
4. The method of claim 1 , wherein (a) further comprises executing, by the campaign controller, the simulated phishing campaign in accordance with a second template from the plurality of templates different from the first template.
5. The method of claim 1 , wherein (b) further comprises determining, by the campaign controller, the one or more attributes of the plurality of users based at least on behavior of the plurality of users with respect to simulated phishing communications.
6. The method of claim 1 , wherein (d) further comprises selecting the first template having a predetermined likelihood of the first group of users to take a predetermined action.
7. The method of claim 1 , wherein (d) further comprises selecting, by the campaign controller, the first template during execution of the simulated phishing campaign.
8. The method of claim 1 , wherein (e) further comprises communicating, during execution of the simulated phishing campaign to other users of the plurality of users, the one or more simulated phishing communications to the first group of users according to the first template.
9. The method of claim 1 , wherein the one or more attributes of the plurality of users comprises one or more of the following: a geographic region, a demographic, or an organizational level within a company.
10. The method of claim 1 , further comprising adding a user to the first group of users.
11. The method of claim 10 , further comprising adding a user to a second group of users dynamically created by the campaign controller.
12. The method of claim 1 , further comprising moving a user from a second group of users to the first group of users.
13. A system for identifying one or more groups of users from a plurality of users during execution of a simulated phishing campaign, the system comprising:
a campaign controller executable on a device comprising a processor, coupled to memory, the campaign controller configured to:
execute a simulated phishing campaign across a plurality of users;
determine, while executing the simulated phishing campaign, one or more attributes of the plurality of users;
create, independent of any user creating one or more groups of users, a first group of users and a second group of users of the one or more groups of users from the plurality of users based at least on the attributes of the plurality of users;
select, responsive to a model trained by applying machine learning to at least the attributes of the plurality of users, a first template from a plurality of templates for the first group of users of the one or more groups of users and a second template from a plurality of templates for the second group of users of the one or more groups of users; and
communicate one or more simulated phishing communications to the first group of users according to the first template and to the second group of users according to the second template; and
wherein the model takes as input from the campaign controller the one or more attributes of the users of the first group of users and provides as output to the campaign controller identification of the first template.
14. The system of claim 13 , wherein the first template identifies a list of a plurality of types of simulated phishing communications and at least a portion of content for the simulated phishing communications.
15. The system of claim 14 , wherein the plurality of types of simulated phishing communications comprises two or more of the following: an email, a text or SMS message, a phone call or an Internet based communication.
16. The system of claim 13 , wherein the campaign controller is further configured to communicate the simulated phishing campaign in accordance with a second template from the plurality of templates different from the first template.
17. The system of claim 13 , wherein the campaign controller is further configured to determine the one or more attributes of the plurality of users based at least on behavior of the plurality of users with respect to simulated phishing communications.
18. The system of claim 13 , wherein the campaign controller is further configured to select the first template with a sequence and type of simulated phishing communications having a predetermined likelihood of the first group of users to take a predetermined action.
19. The system of claim 18 , wherein the campaign controller is further configured to select the first template during execution of the simulated phishing campaign.
20. The system of claim 13 , wherein the campaign controller is further configured to communicate, during execution of the simulated phishing campaign to other users of the plurality of users, the one or more simulated phishing communications to the first group of users according to the first template.
21. The system of claim 13 , wherein the one or more attributes of the plurality of users comprises one or more of the following: a geographic region, a demographic, or an organizational level within a company.
22. The system of claim 13 , wherein the campaign controller is further configured to add a user to the first group of users.
23. The system of claim 22 , wherein the campaign controller is further configured to add a user to a second group of users dynamically created by the campaign controller.
24. The system of claim 13 , wherein the campaign controller is further configured to add move a user from a second group of users to the first group of users.