Systems and methods for AIDA based second chance
Methods and systems are described in which a system provides a user interface to confirm whether to review or take an action associated with an untrusted email. A driver on a device monitors the startup of any processes. Responsive to monitoring, the driver detects an application process that was created that indicates than an application was launched, and notifies a user console about the creation of the application process. The user console determines if the application process is of significance, if so, it injects a monitor library into the process. Once injected into the process, the monitor library detects if the application process receives an action of a user to access a domain that is not identified as trusted. The monitor library notifies the user console of the user's URL-access request.
1. A method comprising:
receiving, by one or more processors, information identifying that one or more users provided input via a user interface to revert back to a point in an application of one or more applications at which the one or more users requested one or more actions that were intercepted based at least on a domain associated with the one or more applications not being identified as trusted;
using, by the one or more processors, at least the information to train an artificial intelligence model configured to select a model from a plurality of models;
selecting, by the one or more processors using the artificial intelligence model, the model from a plurality of models configured to provide information on how to create a simulated phishing communication; and
using, by the one or more processors, information provided by the selected model to create the simulated phishing communication to communicate to a device of a user.
2. The method of claim 1 , further comprising receiving, by the one or more processors, information identifying that one or more users provided input via the user interface to take the one or one more actions that were based at least on the domain associated with the one or more applications not being identified as trusted.
3. The method of claim 1 , wherein the one or more actions comprises an action to access the domain via the one or more applications.
4. The method of claim 1 , wherein the information comprises one or more of the following: a type of action, a type of exploit, an identifier of an application of the one or more applications and an identifier of the domain.
5. The method of claim 1 , wherein the one or more actions are intercepted prior to accessing the domain.
6. The method of claim 1 , further comprising training, by the one or more processors, the artificial intelligence model using at least the information and one or more attributes of the one or more users.
7. The method of claim 5 , further comprising providing, by the one or more processors, one or more attributes of the user as input to the artificial intelligence model and responsive to the input, the artificial intelligence model providing as output identification of the selected model.
8. A method comprising:
receiving, by one or more processors, information identifying that one or more users provided input via a user interface to revert back to a point in an application of one or more applications at which the one or more users requested one or more actions that were intercepted based at least on a domain associated with the one or more applications not being identified as trusted;
using, by the one or more processors, at least the information to train an artificial intelligence model configured to select a template from a plurality of templates;
selecting, by the one or more processors using the artificial intelligence model, the template from a plurality of templates configured to information to create a simulated phishing communication; and
using, by the one or more processors, information provided by the selected template to create the simulated phishing communication to communicate to a device of a user.
9. The method of claim 8 , further comprising receiving, by the one or more processors, information identifying that one or more users provided input via the user interface to take the one or one more actions that were based at least on the domain associated with the one or more application not being identified as trusted.
10. The method of claim 8 , wherein the one or more actions comprises an action to access the domain via the one or more applications.
11. The method of claim 8 , wherein the information comprises one or more of the following: a type of action, a type of exploit, an identifier of an application of the one or more applications and an identifier of the domain.
12. The method of claim 8 , wherein the one or more actions are intercepted prior to accessing the domain.
13. The method of claim 8 , further comprising training, by the one or more processors, the artificial intelligence model using at least the information and one or more attributes of the one or more users.
14. The method of claim 13 , further comprising providing, by the one or more processors, one or more attributes of the user as input to the artificial intelligence model and responsive to the input, the artificial intelligence model providing as output identification of the selected template.
15. A system comprising:
one or more processors, coupled to memory and configured to:
receive information identifying that one or more users provided input via a user interface to revert back to a point in an application of one or more applications at which the one or more users requested one or more actions that were intercepted based at least on a domain associated with the one or more applications not being identified as trusted;
use at least the information to train an artificial intelligence model configured to select a model from a plurality of models or a template from a plurality of templates;
select, using the artificial intelligence model, one of the model from the plurality of models or the template from the plurality of templates; and
use information provided by one of the selected model or the selected template to create the simulated phishing communication to communicate to a device of a user.
16. The system of claim 15 , wherein the information identifies that one or more users provided input via the user interface to take the one or one more actions that were based at least on the domain associated with the one or more applications not being identified as trusted.
17. The system of claim 15 , wherein the plurality of templates are configured to specify content to use to create the simulated phishing communication.
18. The system of claim 15 , wherein the plurality of models are configured to specify how to create the simulated phishing communication.
19. The system of claim 15 , wherein the one or more processors are further configured to train the artificial intelligence model using at least the information and one or more attributes of the one or more users.
20. The system of claim 19 , wherein the one or more processors are further configured to provide, one or more attributes of the user as input to the artificial intelligence model and responsive to the input, the artificial intelligence model is configured to provide as output identification of one of the selected model or the selected template.