Discovering email account compromise through assessments of digital activities

1. A method, comprising:

obtaining first data associated with a series of past digital communication activities performed with an email account, wherein each digital communication activity included in the series involves at least one of a reception or a transmission of a communication;

parsing the first data to discover an attribute of each past digital communication activity in the series of past digital communication activities;

generating a behavior profile for the email account by creating, in a data structure, a separate entry for each past digital communication activity in the series of past digital communication activities that specifies the corresponding attribute, wherein entries in the behavior profile are in a temporal order so as to ensure that deviations in behavior of the email account are detectable;

obtaining second data associated with a digital communication activity performed with the email account;

determining, based on an analysis of the second data, that the communication includes a link to a website and employing computer vision to compare the website to a set of known sign- on pages verified as authentic;

parsing the second data to discover an attribute of the digital communication activity;

producing a deviation metric by programmatically comparing the attribute of the digital communication activity to the behavior profile; and

determining, based on the deviation metric and also based on whether the website matches any of the known sign-on pages in the set, a likelihood that the email account is compromised.

2. The method of claim 1 , wherein the series of past digital communication activities includes receptions of incoming emails and transmissions of outgoing emails.

3. The method of claim 1 , wherein the attribute is an Internet Protocol (IP) address that identifies an electronic device with which the digital communication activity is performed.

4. The method of claim 3 , further comprising: generating an output that specifies a high likelihood of compromise responsive to a determination that the IP address identified for the digital communication activity does not match any entries in the behavior profile.

5. The method of claim 1 , further comprising: determining an appropriate remediation action based on the likelihood that the email account is compromised.

6. The method of claim 5 ,

wherein when a high likelihood of compromise exists, the appropriate remediation action includes prohibiting the email account from performing digital communication activities, and

wherein when a low likelihood of compromise exists, the appropriate remediation action includes further monitoring digital communication activities performed with the email account.

7. The method of claim 5 , wherein the appropriate remediation action is based on (i) a level of confidence in the likelihood, (ii) a type of the digital communication activity, or (iii) a threat posed if the email account is compromised.

8. The method of claim 5 , wherein the appropriate remediation action includes moving all emails generated by the email account over an interval of time into a dedicated folder for further analysis.

9. The method of claim 1 , further comprising:

acquiring a machine learning (ML) model that is trained using past communications generated by the email account to understand normal communication behavior of the email account; and

applying the ML model to the second data so as to establish a degree to which content of a communication involved in the digital communication activity deviates from the normal communication behavior of the email account.

10. A method, comprising:

obtaining first data associated with a series of past digital communication activities performed with an email account, wherein each digital communication activity included in the series involves at least one of a reception or a transmission of a communication;

parsing the first data to discover an attribute of each past digital communication activity in the series of past digital communication activities;

generating a behavior profile for the email account by creating, in a data structure, a separate entry for each past digital communication activity in the series of past digital communication activities that specifies the corresponding attribute, wherein entries in the behavior profile are in a temporal order so as to ensure that deviations in behavior of the email account are detectable;

obtaining second data associated with a digital communication activity performed with the email account

determining, based on an analysis of the second data, that the communication includes a link to a website and indexing content of the website to establish whether the communication represents an instance of phishing;

parsing the second data to discover an attribute of the digital communication activity;

producing a deviation metric by programmatically comparing the attribute of the digital communication activity to the behavior profile; and

determining, based on the deviation metric and also based on whether the communication is determined to represent an instance of phishing, a likelihood that the email account is compromised.

11. The method of claim 10 , wherein the series of past digital communication activities includes receptions of incoming emails and transmissions of outgoing emails.

12. The method of claim 10 , wherein the attribute is an Internet Protocol (IP) address that identifies an electronic device with which the digital communication activity is performed.

13. The method of claim 12 , further comprising: generating an output that specifies a high likelihood of compromise responsive to a determination that the IP address identified for the digital communication activity does not match any entries in the behavior profile.

14. The method of claim 10 , further comprising: determining an appropriate remediation action based on the likelihood that the email account is compromised.

15. The method of claim 14 ,

wherein when a high likelihood of compromise exists, the appropriate remediation action includes prohibiting the email account from performing digital communication activities, and

wherein when a low likelihood of compromise exists, the appropriate remediation action includes further monitoring digital communication activities performed with the email account.

16. The method of claim 14 , wherein the appropriate remediation action is based on (i) a level of confidence in the likelihood, (ii) a type of the digital communication activity, or (iii) a threat posed if the email account is compromised.

17. The method of claim 14 , wherein the appropriate remediation action includes moving all emails generated by the email account over an interval of time into a dedicated folder for further analysis.

18. The method of claim 10 , further comprising:

acquiring a machine learning (ML) model that is trained using past communications generated by the email account to understand normal communication behavior of the email account; and

applying the ML model to the second data so as to establish a degree to which content of a communication involved in the digital communication activity deviates from the normal communication behavior of the email account.

19. A system, comprising:

a processor configured to:

obtain first data associated with a series of past digital communication activities performed with an email account, wherein each digital communication activity included in the series involves at least one of a reception or a transmission of a communication;

parse the first data to discover an attribute of each past digital communication activity in the series of past digital communication activities;

generate a behavior profile for the email account by creating, in a data structure, a separate entry for each past digital communication activity in the series of past digital communication activities that specifies the corresponding attribute, wherein entries in the behavior profile are in a temporal order so as to ensure that deviations in behavior of the email account are detectable;

obtain second data associated with a digital communication activity performed with the email account;

determine, based on an analysis of the second data, that the communication includes a link to a website and employ computer vision to compare the website to a set of known sign-on pages verified as authentic;

parse the second data to discover an attribute of the digital communication activity;

produce a deviation metric by programmatically comparing the attribute of the digital communication activity to the behavior profile; and

determine, based on the deviation metric and also based on whether the website matches any of the known sign-on pages in the set, a likelihood that the email account is compromised; and

a memory coupled to the processor and configured to provide the processor with instructions.

20. The system of claim 19 , wherein the series of past digital communication activities includes receptions of incoming emails and transmissions of outgoing emails.

21. The system of claim 19 , wherein the attribute is an Internet Protocol (IP) address that identifies an electronic device with which the digital communication activity is performed.

22. The system of claim 21 , wherein the processor is further configured to: generate an output that specifies a high likelihood of compromise responsive to a determination that the IP address identified for the digital communication activity does not match any entries in the behavior profile.

23. The system of claim 19 , wherein the processor is further configured to: determine an appropriate remediation action based on the likelihood that the email account is compromised.

24. The system of claim 23 ,

wherein when a high likelihood of compromise exists, the appropriate remediation action includes prohibiting the email account from performing digital communication activities, and

wherein when a low likelihood of compromise exists, the appropriate remediation action includes further monitoring digital communication activities performed with the email account.

25. The system of claim 23 , wherein the appropriate remediation action is based on (i) a level of confidence in the likelihood, (ii) a type of the digital communication activity, or (iii) a threat posed if the email account is compromised.

26. The system of claim 23 , wherein the appropriate remediation action includes moving all emails generated by the email account over an interval of time into a dedicated folder for further analysis.

27. The system of claim 19 , wherein the processor is further configured to:

acquire a machine learning (ML) model that is trained using past communications generated by the email account to understand normal communication behavior of the email account; and

apply the ML model to the second data so as to establish a degree to which content of a communication involved in the digital communication activity deviates from the normal communication behavior of the email account.

28. A system, comprising:

a processor configured to:

obtain first data associated with a series of past digital communication activities performed with an email account, wherein each digital communication activity included in the series involves at least one of a reception or a transmission of a communication;

parse the first data to discover an attribute of each past digital communication activity in the series of past digital communication activities;

generate a behavior profile for the email account by creating, in a data structure, a separate entry for each past digital communication activity in the series of past digital communication activities that specifies the corresponding attribute, wherein entries in the behavior profile are in a temporal order so as to ensure that deviations in behavior of the email account are detectable;

obtain second data associated with a digital communication activity performed with the email account;

determine, based on an analysis of the second data, that the communication includes a link to a website and index content of the website to establish whether the communication represents an instance of phishing;

parse the second data to discover an attribute of the digital communication activity;

produce a deviation metric by programmatically comparing the attribute of the digital communication activity to the behavior profile; and

determine, based on the deviation metric and also based on whether the communication is determined to represent an instance of phishing, a likelihood that the email account is compromised; and

a memory coupled to the processor and configured to provide the processor with instructions.

29. The system of claim 28 , wherein the series of past digital communication activities includes receptions of incoming emails and transmissions of outgoing emails.

30. The system of claim 28 , wherein the attribute is an Internet Protocol (IP) address that identifies an electronic device with which the digital communication activity is performed.

31. The system of claim 30 , wherein the processor is further configured to: generate an output that specifies a high likelihood of compromise responsive to a determination that the IP address identified for the digital communication activity does not match any entries in the behavior profile.

32. The system of claim 28 , wherein the processor is further configured to: determine an appropriate remediation action based on the likelihood that the email account is compromised.

33. The system of claim 32 ,

wherein when a high likelihood of compromise exists, the appropriate remediation action includes prohibiting the email account from performing digital communication activities, and

wherein when a low likelihood of compromise exists, the appropriate remediation action includes further monitoring digital communication activities performed with the email account.

34. The system of claim 32 , wherein the appropriate remediation action is based on (i) a level of confidence in the likelihood, (ii) a type of the digital communication activity, or (iii) a threat posed if the email account is compromised.

35. The system of claim 32 , wherein the appropriate remediation action includes moving all emails generated by the email account over an interval of time into a dedicated folder for further analysis.

36. The system of claim 28 , wherein the processor is further configured to:

acquire a machine learning (ML) model that is trained using past communications generated by the email account to understand normal communication behavior of the email account; and

apply the ML model to the second data so as to establish a degree to which content of a communication involved in the digital communication activity deviates from the normal communication behavior of the email account.