Method and system for processing data packages

1. A method for analysing data received by an addressed recipient of a data package, the method comprising the steps of:

receiving a data package over a data network, the data package comprising a header and payload data

temporarily storing the data package in temporary storage;

analysing, at a first time, the header of the data package to determine a plurality of characteristics, the plurality of characteristics comprising at least an identifier and a transmission time and determining, using at least one data model, at least one probability value associated with a relationship between the plurality of characteristics;

generating a risk indicator, based on the at least one probability value;

generating a handling action based on the risk indicator;

providing the payload data and the handling action to the addressed recipient; and

determining whether to update the at least one data model at the first time based at least in part on whether the risk indicator is being generated at the first time, and based on the determination:

updating the at least one data model based on the data package when it is determined that the at least one data model should be updated at the first time; and

retrieving the at least one data package from temporary storage, and updating, at a second time later than the first time, the at least one data model, when it is determined that the at least one data model should not be updated at the first time, and the risk indicator has been generated at the first time.

2. The method for analysing data received by an addressed recipient of a data package according to claim 1 , wherein the number of criteria used in the step of analysing the header is dependent on a plurality of data points associated with the identifier, such that the number of criteria used is based on at least one predefined relationship between the data points.

3. The method for analysing data received by an addressed recipient of a data package according to claim 2 , wherein the predefined relationship is based on any of Monte Carlo data generation algorithm, a k-means clustering algorithm, a machine learning model, an expert system, or a peak finding algorithm.

4. The method for analysing data received by an addressed recipient of a data package according to claim 2 , wherein if there are no data points associated with the identifier, data points relating to a domain associated with the identifier are used.

5. The method for analysing data received by an addressed recipient of a data package according to claim 1 , wherein generating the risk indicator comprises obtaining additional information from at least one additional data source and processing the additional information along with the analysis of the header.

6. The method for analysing data received by an addressed recipient of a data package according to claim 1 , wherein generating the risk indicator comprises at least one machine learning function.

7. The method for analysing data received by an addressed recipient of a data package according to claim 1 , further comprising the steps of:

determining whether the payload data of the data package is encrypted; and

decrypting the payload data based on the handling action.

8. The method for analysing data received by an addressed recipient of a data package according to claim 1 , wherein the handling action comprises a flag arranged to indicate at least the risk indicator to the addressed recipient.

9. A system for analysing data received by an addressed recipient of a data package, the system comprising:

temporary storage for storing a data package received via a data network, the data package comprising a header and payload data;

an analysis module for analysing, at a first time, the header of the data package based on a plurality of characteristics, the plurality of characteristics comprising at least an identifier and a transmission time, and for determining, using at least one data model, at least one probability value associated with a relationship between the plurality of characteristics;

a risk indication module for generating a risk indicator based on the at least one probability value;

an action generation module for generating a handling action based on the risk indicator;

an output module for providing the payload data and the handling action to the addressed recipient;

a monitoring unit for determining whether to update the at least one data model at the first time based at least in part on whether the risk indicator is being generated at the first time; and

an updating module for:

updating the at least one data model based on the data package when it is determined that the at least one data model should be updated at the first time; and

retrieving the at least one data package from the temporary storage, and updating, at a second time later than the first time, the at least one data model the generation of the risk indicator, and the risk indicator has been generated at the first time.

10. The system for analysing data received by an addressed recipient of a data package according to claim 9 , wherein the number of criteria used by the analysis module is dependent on a plurality of data points associated with the sender, such that the number of criteria used is based on at least one predefined relationship between the data points.

11. The system for analysing data received by an addressed recipient of a data package according to claim 10 , wherein if there are no data points associated with the identifier, data points relating to a domain associated with the identifier are used.

12. The system for analysing data received by an addressed recipient of a data package according to claim 9 , wherein the risk indication module obtains additional information from at least one additional data source and processes the additional information along with the analysis of the header.

13. The system for analysing data received by an addressed recipient of a data package according to claim 9 , wherein the analysis module comprises a processor.

14. The system for analysing data received by an addressed recipient of a data package according to claim 9 , wherein the processor is a machine learning processor.

15. The system for analysing data received by an addressed recipient of a data package according to claim 9 , further comprising:

an encryption detection module for detecting whether the payload data of the data package is encrypted; and

a decryption module for decrypting the payload data based on the handling action; wherein the output module provides the decrypted payload data and handling action to the addressed recipient.

16. A non-transitory computer-readable storage medium comprising a set of computer-readable instructions stored thereon which, when executed by at least one processor cause the processor to analyse data received by an addressed recipient of a data package, the instructions comprising:

receiving a data package over a data network, the data package comprising a header and payload data;

temporarily storing the data package in temporary storage;

analysing, at a first time, the header of the data package to determine a plurality of characteristics, the plurality of characteristics comprising at least an identifier and a transmission time and for determining, using a data model at least one probability value associated with a relationship between the plurality of characteristics;

generating a risk indicator based on the at least one probability value;

generating a handling action based on the risk indicator;

providing the payload data and the handling action to the addressed recipient; and

determining whether to update the at least one data model at the first time based at least in part on whether the risk indicator is being generated at the first time, and based on the determination:

updating the at least one data model based on the data package when it is determined that the at least one data model should be updated at the first time; and

retrieving the at least one data package from temporary storage, and updating, at a second time later than the first time, the at least one data model, when it is determined that the at least one data model should not be updated at the first time, and the risk indicator has been generated at the first time.