Deriving and surfacing insights regarding security threats
Deriving and surfacing insights regarding security threats is disclosed. A plurality of features associated with a message is determined. A plurality of facet models is used to analyze the determined features. Based at least in part on the analysis, it is determined that the message poses a security threat. A prioritized set of information is determined to be provided as output that is representative of why the message was determined to pose a security threat. At least a portion of the prioritized set of information is provided as output.
1. A system, comprising:
a processor configured to:
establish, via an application programming interface, a connection with a storage medium that includes a series of communications received by an employee of an enterprise and obtain an email that is addressed to the employee;
determine a plurality of features associated with the obtained email;
use a plurality of facet models to analyze the determined features, wherein at least one facet model included in the plurality of facet models is a topic model that identifies a topic that is mentioned either directly or indirectly in the email;
determine, based at least in part on the analysis, that the email poses a security threat;
determine a prioritized set of information to provide as output in a report, wherein the prioritized set of information is representative of why the email was determined to pose a security threat; and
provide at least a portion of the prioritized set of information as output in an interface; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system of claim 1 , wherein the processor is further configured to associate the identified topic with the email.
3. The system of claim 1 , wherein the topic model is trained using a corpus of messages labeled as representative of a particular topic.
4. The system of claim 1 , wherein the topic model comprises a set of one or more rules for identifying a message as having a particular topic.
5. The system of claim 1 , wherein at least one facet model included in the plurality of facet models is an attack type model that identifies a type of attack of which the email is a part, wherein the attack type is derived based on a combination of other facets.
6. The system of claim 1 , wherein at least one facet model included in the plurality of facet models is an attack strategy model that identifies a strategy used in the email to perpetrate an attack.
7. The system of claim 1 , wherein at least one facet model included in the plurality of facet models is an impersonated party model that identifies an entity that a sender of the email is attempting to impersonate.
8. The system of claim 1 , wherein at least one facet model included in the plurality of facet models is an attacked party model that indicates an entity that is a target of an attack carried out by the email.
9. The system of claim 1 , wherein at least one facet model included in the plurality of facet models is an attack goal model that identifies a goal of an attack carried out by the email.
10. The system of claim 1 , wherein at least one facet model included in the plurality of facet models is an attack vector model that identifies a mechanism by which an attack is carried out by the email.
11. The system of claim 1 , wherein the prioritized set of information is determined based at least in part on an identity or group membership of a message recipient.
12. A method, comprising:
establishing, via an application programming interface, a connection with a storage medium that includes a series of communications received by an employee of an enterprise and obtaining an email that is addressed to the employee;
determining a plurality of features associated with the obtained email;
using a plurality of facet models to analyze the determined features, wherein at least one facet model included in the plurality of facet models is a topic model that identifies a topic that is mentioned either directly or indirectly in the email;
determining, based at least in part on the analysis, that the email poses a security threat;
determining a prioritized set of information to provide as output in a report, wherein the prioritized set of information is representative of why the email was determined to pose a security threat; and
providing at least a portion of the prioritized set of information as output in an interface.
13. The method of claim 12 , further comprising associating the identified topic with the email.
14. The method of claim 12 , wherein the topic model is trained using a corpus of messages labeled as representative of a particular topic.
15. The method of claim 12 , wherein the topic model comprises a set of one or more rules for identifying a message as having a particular topic.
16. The method of claim 12 , wherein at least one facet model included in the plurality of facet models is an attack type model that identifies a type of attack of which the email is a part, wherein the attack type is derived based on a combination of other facets.
17. The method of claim 12 , wherein at least one facet model included in the plurality of facet models is an attack strategy model that identifies a strategy used in the email to perpetrate an attack.
18. The method of claim 12 , wherein at least one facet model included in the plurality of facet models is an impersonated party model that identifies an entity that a sender of the email is attempting to impersonate.
19. The method of claim 12 , wherein at least one facet model included in the plurality of facet models is an attacked party model that indicates an entity that is a target of an attack carried out by the email.
20. The method of claim 12 , wherein at least one facet model included in the plurality of facet models is an attack goal model that identifies a goal of an attack carried out by the email.
21. The method of claim 12 , wherein at least one facet model included in the plurality of facet models is an attack vector model that identifies a mechanism by which an attack is carried out by the email.
22. The method of claim 12 , wherein the prioritized set of information is determined based at least in part on an identity or group membership of a message recipient.
23. A computer program product embodied in a non-transitory tangible computer readable storage medium and comprising computer instructions for:
establishing, via an application programming interface, a connection with a storage medium that includes a series of communications received by an employee of an enterprise and obtaining an email that is addressed to the employee;
determining a plurality of features associated with the obtained email;
using a plurality of facet models to analyze the determined features, wherein at least one facet model included in the plurality of facet models is a topic model that identifies a topic that is mentioned either directly or indirectly in the email;
determining, based at least in part on the analysis, that the email poses a security threat;
determining a prioritized set of information to provide as output in a report, wherein the prioritized set of information is representative of why the email was determined to pose a security threat; and
providing at least a portion of the prioritized set of information as output in an interface.