Systems and methods for encrypted message filtering
The present disclosure provides new and innovative systems and methods for filtering encrypted messages. In an example, a computer-implemented method includes obtaining a message, determining sender profiling features of the message, determining enterprise graph features of the message, determining header features of the message, determining a message flag based on the sender profiling features, the enterprise graph features, and the header features, and processing the message based on the message flag.
1. A computer-implemented method, comprising:
obtaining a message;
determining sender profiling features of the message that comprise:
a number of unsolicited messages associated with a sender of the message,
a similarity score of a path field of the message to a historical path field, and
an indication of the message being a broadcast message with a single recipient;
determining enterprise graph features of the message;
determining header features of the message;
determining a message flag based on the sender profiling features, the enterprise graph features, and the header features; and
processing the message based on the message flag.
2. The computer-implemented method of claim 1 , wherein the sender profiling features, the enterprise graph features, and the header features are determined using a single machine classifier.
3. The computer-implemented method of claim 1 , wherein the enterprise graph features comprise an average page rank score of recipients of the message, a random walk relation score of the recipients of the message, and a transitive closure relation score of the recipients of the message.
4. The computer-implemented method of claim 1 , wherein the header features comprise an indication of numbers and letters in a from field of the message, a similarity of a message identifier field of the message and a helo field of the message, and a similarity of the from field of the message and the helo field of the message.
5. The computer-implemented method of claim 1 , wherein the header features comprise a percentage of white space in a subject of the message, a percentage of capital letters in the subject of the message, and an indication of a presence of non-ASCII characters in the subject of the message.
6. The computer-implemented method of claim 1 , wherein the sender profiling features are determined using a first machine classifier, the enterprise graph features are determined using a second machine classifier, and the header features are determined using a third machine classifier.
7. An apparatus, comprising:
a processor; and
a memory storing instructions that, when read by the processor, cause the apparatus to:
obtain a message;
determine sender profiling features of the message that comprise:
a number of unsolicited messages associated with a sender of the message,
a similarity score of a path field of the message to a historical path field, and
an indication of the message being a broadcast message with a single recipient;
determine enterprise graph features of the message;
determine header features of the message;
determine a message flag based on the sender profiling features, the enterprise graph features, and the header features; and
process the message based on the message flag.
8. The apparatus of claim 7 , wherein the sender profiling features are determined using a first machine classifier, the enterprise graph features are determined using a second machine classifier, and the header features are determined using a third machine classifier.
9. The apparatus of claim 7 , wherein the sender profiling features, the enterprise graph features, and the header features are determined using a single machine classifier.
10. The apparatus of claim 7 , wherein the enterprise graph features comprise an average page rank score of recipients of the message, a random walk relation score of the recipients of the message, and a transitive closure relation score of the recipients of the message.
11. The apparatus of claim 7 , wherein the header features comprise an indication of numbers and letters in a from field of the message, a similarity of a message identifier field of the message and a helo field of the message, and a similarity of the from field of the message and the helo field of the message.
12. The apparatus of claim 7 , wherein the header features comprise a percentage of white space in a subject of the message, a percentage of capital letters in the subject of the message, and an indication of a presence of non-ASCII characters in the subject of the message.
13. A non-transitory computer readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform steps comprising:
obtaining a message;
determining sender profiling features of the message that comprise:
a number of unsolicited messages associated with a sender of the message,
a similarity score of a path field of the message to a historical path field, and
an indication of the message being a broadcast message with a single recipient;
determining enterprise graph features of the message;
determining header features of the message;
determining a message flag based on the sender profiling features, the enterprise graph features, and the header features; and
processing the message based on the message flag.
14. The non-transitory computer readable medium of claim 13 , wherein the header features are selected from the group consisting of an indication of numbers and letters in a from field of the message, a similarity of a message identifier field of the message and a helo field of the message, a similarity of the from field of the message and the helo field of the message, a percentage of white space in a subject of the message, a percentage of capital letters in the subject of the message, and an indication of a presence of non-ASCII characters in the subject of the message.
15. The non-transitory computer readable medium of claim 13 , wherein the sender profiling features are determined using a first machine classifier, the enterprise graph features are determined using a second machine classifier, and the header features are determined using a third machine classifier.
16. The non-transitory computer readable medium of claim 13 , wherein the sender profiling features, the enterprise graph features, and the header features are determined using a single machine classifier.
17. The non-transitory computer readable medium of claim 13 , wherein the enterprise graph features comprise an average page rank score of recipients of the message, a random walk relation score of the recipients of the message, and a transitive closure relation score of the recipients of the message.