Systems and methods for intelligent phishing threat detection and phishing threat remediation in a cyber security threat detection and mitigation platform
A system and method for accelerating a cybersecurity event detection and remediation includes extracting corpora of feature data from a suspicious electronic communication, wherein the corpora of feature data comprise at least one corpus of text data extracted from a body of the suspicious electronic communication; computing at least one text embedding value for the suspicious electronic communication; evaluating the text embedding values of the corpus of text data against an n-dimensional mapping of adverse electronic communication vectors, the n-dimensional mapping comprising a plurality of historical electronic communication vectors derived for a plurality of historical electronic communications; identifying whether the suspicious electronic communication comprises one of an adverse electronic communication based on the evaluation of the text embedding value, and accelerating a cybersecurity event detection by routing data associated with the suspicious electronic communication to one of a plurality of distinct threat mitigation routes.
1. A method for accelerating a cybersecurity event detection and remediation, the method comprising:
extracting one or more corpora of feature data from a suspicious electronic communication sourced from a subscriber, wherein the one or more corpora of feature data comprise at least one corpus of text data extracted from a body of the suspicious electronic communication;
computing, by a text embedding model, at least one text embedding value for the suspicious electronic communication based on the corpus of text data;
evaluating the at least one text embedding value of the corpus of text data against an n-dimensional mapping of a plurality of historical electronic communication vectors of the subscriber, the n-dimensional mapping comprising a plurality of historical electronic communication vectors derived for the plurality of historical electronic communications of the subscriber, wherein each of the plurality of historical electronic communications relates to a malicious electronic communication with an unlawful intent; and
identifying whether the suspicious electronic communication comprises one of an adverse electronic communication and a non-adverse electronic communication based on the evaluation of the at least one text embedding value of the corpus of text data against the n-dimensional mapping of historical electronic communication vectors,
wherein if the suspicious electronic communication comprises the adverse electronic communication, accelerating a cybersecurity event detection by routing data associated with the suspicious electronic communication to one of a plurality of distinct cybersecurity threat mitigation routes.
2. The method according to claim 1 , wherein
the evaluating the at least one text embedding value of the corpus of text data against the n-dimensional mapping of the plurality of historical electronic communication vectors includes:
identifying a subset of the plurality of historical electronic communication vectors of the plurality of historical electronic communications within a predetermined vector distance radius of the at least one text embedding value of the corpus of text data; and
calculating a vector distance between the at least one text embedding value and each distinct vector within the subset of the plurality of historical electronic communication vectors.
3. The method according to claim 2 , wherein
the identifying whether the suspicious electronic communication comprises one of the adverse electronic communication and the non-adverse electronic communication includes:
identifying one or more historical electronic communication vectors having a calculated cosine distance that is less than or equal to a phishing distance threshold, wherein the phishing distance threshold comprises a maximum cosine distance value for indicating a relatedness between at least two distinct electronic communication vectors; and
returning, via a cybersecurity interface, a distinct and historical electronic phishing communication for each of the one or more historical electronic communication vectors.
4. The method according to claim 3 , further comprising:
at the cybersecurity interface:
evaluating the suspicious communication against the distinct and historical electronic phishing communication for each of the one or more historical electronic communication vectors, and
validating the suspicious communication as the adverse electronic communication based on the evaluation via the cybersecurity interface.
5. The method according to claim 1 , wherein
the evaluating the at least one text embedding value of the corpus of text data against the n-dimensional mapping of the plurality of historical electronic communication vectors includes:
defining a plurality of distinct pairwise between the at least one text embedding value of the corpus of text data and each of the plurality of historical electronic communication vectors of the n-dimensional mapping; and
calculating a cosine distance for each of the plurality of distinct pairwise.
6. The method according to claim 5 , wherein
the identifying whether the suspicious electronic communication comprises one of the adverse electronic communication and the non-adverse electronic communication includes:
identifying one or more historical electronic communication vectors of the plurality of historical electronic communication vectors having a calculated cosine distance from the at least one text embedding value that is less than or equal to a phishing distance threshold, wherein the phishing distance threshold comprises a maximum cosine distance value for indicating a relatedness between at least two distinct electronic communication vectors; and
returning, via a cybersecurity interface, a distinct and historical electronic phishing communication for each of the one or more distinct electronic communication vectors.
7. The method according to claim 1 , wherein
the computing, by the text embedding model, the at least one text embedding value for the suspicious electronic communication based on the corpus of text data includes:
computing a distinct text embedding value for each of a plurality of distinct sentences of the corpus of text data extracted from the body of the suspicious electronic communication.
8. The method according to claim 7 , wherein
the evaluating the at least one text embedding value of the corpus of text data against the n-dimensional mapping of the plurality of historical electronic communication vectors includes:
calculating an average text embedding value for the corpus of text data based on the distinct text embedding value of each of the plurality of distinct sentences of the corpus of text data extracted from the body of the suspicious electronic communication;
defining a plurality of distinct pairwise between the average text embedding value of the corpus of text data and each of the plurality of historical electronic communication vectors of the n-dimensional mapping;
calculating a cosine distance for each of the plurality of distinct pairwise; and
identifying one or more historical electronic communication vectors of the plurality of historical electronic communication vectors having a calculated cosine distance from the average text embedding value that is less than or equal to a phishing distance threshold, wherein the phishing distance threshold comprises a maximum cosine distance value for indicating a relatedness between at least two distinct electronic communication vectors.
9. The method according to claim 1 , further comprising:
computing, by a phishing machine learning model, a cybersecurity threat inference comprising a phishing threat score based on an input of feature vectors derived from the one or more corpora of feature data from the suspicious electronic communication, wherein the phishing threat score indicates a likelihood that a target electronic communication comprises an adverse electronic communication or a malicious electronic communication.
10. The method according to claim 9 , wherein
an algorithmic structure of the phishing machine learning model comprises a plurality of distinct learnable parameters for computing the cybersecurity threat inference that map at least to feature vectors computed for each of (1) a text body of the suspicious electronic communication and a (2) web-based domain of a sender of the suspicious electronic communication.
11. The method according to claim 9 , wherein:
the routing data associated with the suspicious electronic communication to one of the plurality of distinct cybersecurity threat mitigation routes is based on the phishing threat score, wherein each of a plurality of distinct score ranges of a potential phishing threat score is associated with each of the plurality of distinct cybersecurity threat mitigation routes,
the routing includes:
evaluating the phishing threat score against the plurality of distinct score ranges of the potential phishing threat score; and
selecting a distinct cybersecurity threat mitigation route based on the phishing threat score having a score value that is within a distinct score range of the distinct cybersecurity threat mitigation route of the plurality of distinct cybersecurity threat mitigation routes.
12. The method according to claim 1 , wherein
the accelerating the cybersecurity event detection includes automatically bypassing one or more predetermined cybersecurity threat investigation steps for resolving cybersecurity threats involving one or more suspicious electronic communications.
13. The method according to claim 1 , wherein
the evaluating the at least one text embedding values of the corpus of text data against the n-dimensional mapping of the plurality of historical electronic communication vectors includes:
performing a similarity search of the n-dimensional mapping of the plurality of historical electronic communication vectors using the at least one text embedding value of the corpus of text data; and
returning, via a cybersecurity interface, one or more historical electronic communications based on the similarity search.
14. The method according to claim 1 , wherein
the evaluating the at least one text embedding values of the corpus of text data against the n-dimensional mapping of the plurality of historical electronic communication vectors includes:
identifying a cognate set of historical adverse electronic communications based on computing similarity metric values using the at least one text embedding value of the corpus of text data and the plurality of historical electronic communication vectors; and
returning, via a cybersecurity interface, the cognate set of historical adverse electronic communications.
15. The method according to claim 1 , wherein
the routing data associated with the suspicious electronic communication to one of the plurality of distinct cybersecurity threat mitigation routes is based on the evaluation of the at least one text embedding value of the corpus of text data of the suspicious electronic communication against the n-dimensional mapping of the plurality of historical electronic communication vectors of the subscriber.
16. The method according to claim 1 , further comprising:
identifying an electronic sender's address based on the one or more corpora of feature data from the suspicious electronic communication, wherein the electronic sender's address identifies a communication address of a sender of the suspicious electronic communication;
evaluating the electronic sender's address against historical sender data associated with the plurality of historical electronic communications;
bypassing one or more predetermined cybersecurity threat investigation steps for resolving cybersecurity threats involving one or more suspicious electronic communications based on the evaluation of the electronic sender's address; and
wherein routing data associated with the suspicious electronic communication to one of the plurality of distinct cybersecurity threat mitigation routes is based on the evaluation of the electronic sender's address.
17. The method according to claim 1 , wherein
identifying a corpus of historical submissions of suspicious electronic communications of the subscriber submitting the suspicious electronic communication;
evaluating the corpus of historical submissions of suspicious electronic communications;
computing an acceleration or deceleration priority for the suspicious electronic communication based on the evaluation of the corpus of historical submissions of suspicious electronic communications; and
prioritizing the suspicious electronic communication within a queue of pending suspicious electronic communications based on the computation of the acceleration or deceleration priority.
18. A system for accelerating a cybersecurity event detection and remediation, the system comprising:
a feature extractor implemented by one or more computers that extracts one or more corpora of feature data from a suspicious electronic communication provided by a subscriber to a cybersecurity service implementing the system, wherein the one or more corpora of feature data comprise at least one corpus of text data extracted from a body of the suspicious electronic communication;
a text embedding system that computes, using a text embedding model, at least one text embedding value for the suspicious electronic communication based on the corpus of text data; and
a cybersecurity event identification system implementing by one or more computers that:
evaluates the at least one text embedding value of the corpus of text data against an n-dimensional mapping of a plurality of historical electronic communication vectors, the n-dimensional mapping comprising the plurality of historical electronic communication vectors derived for a plurality of historical electronic communications of the subscriber, wherein each of the plurality of historical electronic communications relates to a malicious electronic communication having a malicious intent; and
identifies whether the suspicious electronic communication comprises one of an adverse electronic communication and a non-adverse electronic communication based on the evaluation of the at least one text embedding value of the corpus of text data against the n-dimensional mapping of adverse electronic communication vectors,
wherein if the suspicious electronic communication comprises the adverse electronic communication, accelerating a cybersecurity event detection by routing data associated with the suspicious electronic communication to one of a plurality of distinct cybersecurity threat mitigation routes.
19. The system according to claim 18 , wherein:
the computing, by the text embedding model, the at least one text embedding value for the suspicious electronic communication based on the corpus of text data includes:
computing a distinct text embedding value for each of a plurality of distinct sentences of the corpus of text data extracted from the body of the suspicious electronic communication; and
the evaluating the at least one text embedding value of the corpus of text data against the n-dimensional mapping of the plurality of historical electronic communication vectors includes:
calculating an average text embedding value for the corpus of text data based on the distinct text embedding value of each of the plurality of distinct sentences of the corpus of text data extracted from the body of the suspicious electronic communication;
defining a plurality of distinct pairwise between the average text embedding value of the corpus of text data and each of the plurality of historical electronic communication vectors of the n-dimensional mapping;
calculating a cosine distance for each of the plurality of distinct pairwise; and
identifying one or more historical electronic communication vectors of the plurality of historical electronic communication vectors having a calculated cosine distance from the average text embedding value that is less than or equal to a phishing distance threshold, wherein the phishing distance threshold comprises a maximum cosine distance value for indicating a relatedness between at least two distinct electronic communication vectors.
20. The system according to claim 18 , further comprising:
a machine learning system that:
computes, using a phishing machine learning model, a cybersecurity threat inference comprising a phishing threat score based on an input of feature vectors derived from the one or more corpora of feature data from the suspicious electronic communication, wherein the phishing threat score indicates a likelihood that a target electronic communication comprises an adverse electronic communication or a malicious electronic communication.