Discovering email account compromise through assessments of digital activities
Introduced here are threat detection platforms designed to discover possible instances of email account compromise in order to identify threats to an enterprise. In particular, a threat detection platform can examine the digital activities performed with the email accounts associated with employees of the enterprise to determine whether any email accounts are exhibiting abnormal behavior. Examples of digital activities include the reception of an incoming email, transmission of an outgoing email, creation of a mail filter, and occurrence of a sign-in event (also referred to as a “login event”). Thus, the threat detection platform can monitor the digital activities performed with a given email account to determine the likelihood that the given email account has been compromised.
1. A method for determining the likelihood that an email account belonging to an employee has been compromised, the method comprising:
obtaining first data associated with a series of past digital activities performed with an email account associated with an employee of an enterprise,
wherein the series of past digital activities includes receptions of incoming emails, transmissions of outgoing emails, creations of mail filters, and occurrences of sign-in events;
parsing the first data to discover an attribute of each past digital activity in the series of past digital activities;
generating a behavior profile for the email account by creating a separate entry for each past digital activity in the series of past digital activities that specifies the corresponding attribute,
wherein the entries in the behavior profile are in a temporal order so as to ensure that deviations in behavior of the email account are detectable;
obtaining, in real time, second data associated with a digital activity performed with the email account;
responsive to obtaining the second data,
parsing the second data to discover an attribute of the digital activity;
producing a deviation metric by programmatically comparing the attribute of the digital activity to the behavior profile;
generating an output that specifies a likelihood that the email account is compromised based on the deviation metric; and
determining whether to permit the digital activity to be performed based on the output and/or the deviation metric.
2. The method of claim 1 , wherein said producing comprises programmatically comparing the attribute of the digital activity to each entry in the behavior profile that corresponds to a same type of digital activity.
3. The method of claim 1 , wherein said obtaining the first data comprises:
establishing, via an application programming interface, a connection with a storage medium that includes the first data, and
downloading, via the application programming interface, the first data into a processing environment.
4. The method of claim 1 , wherein said producing comprises:
establishing whether the attribute of the digital activity deviates from the attribute corresponding to each past digital activity in the series of past digital activities, and
providing any deviations to a machine learning model that produces the deviation metric as output.
5. The method of claim 1 , further comprising:
examining the first data to identify information related to each past digital activity in the series of past digital activities; and
defining each past digital activity as a separate event by populating a predefined schema with the corresponding information identified in the first data.
6. The method of claim 1 , further comprising:
determining an appropriate remediation action based on the output and/or the deviation metric.
7. The method of claim 6 , further comprising:
classifying the digital activity as being indicative of a type of compromise scheme;
wherein the appropriate remediation action is based on the type of compromise scheme.