Automated effective template generation
The systems and methods disclose an automated effective template generation and recommendation for selection. A semantic similarity of a plurality of messages may be identified that at least meets a similarity threshold, each of the plurality of messages reported by a plurality of users as a potentially malicious message. The plurality of messages may be indexed under a common template identifier. One or more messages of the plurality of messages indexed under the common template identifier may be determined to have a report-to-reach ratio less than a report-to-reach threshold. Responsive to the determination, the one or more messages may be identified to be used for generating one or more simulated phishing templates. A recommendation of the one or more templates may be provided to a system administrator and/or a security awareness and simulation training platform to create and deliver simulated phishing messages using the templates.
1. A method comprising:
identifying, by one or more servers, that a semantic similarity of a plurality of messages at least meets a similarity threshold, each of the plurality of messages reported by a plurality of users as a potentially malicious message;
indexing, by the one or more servers, the plurality of messages under a common template identifier;
determining, by the one or more servers, one or more messages of the plurality of messages indexed under the common template identifier has a report-to-reach ratio less than a report-to-reach threshold, wherein the report-to-reach ratio comprises a metric representing a proportion of the plurality of users that reported the potentially malicious message to a number of users that received the potentially malicious message;
identifying, by the one or more servers responsive to the determination, the one or more messages to use for a simulated phishing template under the common template identifier;
creating, by the one or more servers, the simulated phishing template based on at least one of the one or more messages;
selecting, by the one or more servers, the simulated phishing template; and
communicating, by the one or more servers based at least on the simulated phishing template, a simulated phishing communication to one or more target users.
2. The method of claim 1 , further comprising using, by the one or more servers, a semantic similarity analyzer to compare message content of the plurality of messages to determine the semantic similarity.
3. The method of claim 2 , further comprising using the semantic similarity analyzer to calculate a number of words that two messages of the plurality of messages have in common divided by the total number of words in the two messages divided by two.
4. The method of claim 1 , further comprising determining, by the one or more servers, the semantic similarity of the plurality of messages by comparing one of common words, phrases or structures in content of the plurality of messages.
5. The method of claim 1 , wherein the similarity threshold comprises a percentage value that represents that the semantic similarity between two messages of the plurality of messages that is sufficient that the two messages are categorized under the same common template identifier.
6. The method of claim 1 , further comprising determining, by the one or more servers, the report-to-reach ratio of each message of the plurality of messages based on the plurality of users that reported the potentially malicious message and the number of users that received the potentially malicious message.
7. The method of claim 1 , further comprising categorizing, by the one or more servers, the one or more messages into one or more user groups based at least on classification group criteria, the one or more user groups to be used for creating the simulated phishing template.
8. The method of claim 1 , further comprising determining, by the one or more servers based on user demographics of the one or more messages, user information to use with the one or more messages to create the simulated phishing template.
9. The method of claim 1 , further comprising identifying, by the one or more servers, the plurality of reported messages and information about the plurality of users that reported the message from one or more databases storing reported messages and user information from one of a single organization or a plurality of organizations.
10. A system comprising:
one or more servers comprising one or more processors, coupled to memory and configured to:
identify that a semantic similarity of a plurality of messages at least meets a similarity threshold, each of the plurality of messages reported by a plurality of users as a potentially malicious message;
index the plurality of messages under a common template identifier;
determine one or more messages of the plurality of messages indexed under the common template identifier has a report-to-reach ratio less than a report-to-reach threshold, wherein the report-to-reach ratio comprises a metric representing a proportion of the plurality of users that reported the potentially malicious message to a number of users that received the potentially malicious message;
identify, responsive to the determination, the one or more messages to use for a simulated phishing template under the common template identifier;
create the simulated phishing template based on at least one of the one or more messages;
select the simulated phishing template; and
communicate, based at least on the simulated phishing template, a simulated phishing communication to one or more target users.
11. The system of claim 10 , wherein the one or more servers are further configured to use a semantic similarity analyzer to compare message content of the plurality of messages to determine the semantic similarity.
12. The system of claim 11 , wherein the one or more servers are further configured to use the semantic similarity analyzer to calculate a number of words that two messages of the plurality of messages have in common divided by the total number of words in the two messages divided by two.
13. The system of claim 10 , wherein the one or more servers are further configured to determine the semantic similarity of the plurality of messages by comparing one of common words, phrases or structures in content of the plurality of messages.
14. The system of claim 10 , wherein the similarity threshold comprises a percentage value that represents that the semantic similarity between two messages of the plurality of messages that is sufficient that the two messages are categorized under the same common template identifier.
15. The system of claim 10 , wherein the one or more servers are further configured to determine the report-to-reach ratio of each message of the plurality of messages based on the plurality of users that reported the potentially malicious message and the number of users that received the potentially malicious message.
16. The system of claim 10 , wherein the one or more servers are further configured to categorize the one or more messages into one or more user groups based at least on classification group criteria, the one or more user groups to be used for creating the simulated phishing template.
17. The system of claim 10 , wherein the one or more servers are further configured to determine, based on user demographics of the one or more messages, user information to use with the one or more messages to create the simulated phishing template.
18. The system of claim 10 , wherein the one or more servers are further configured to identify the plurality of reported messages and information about the plurality of users that reported the messages from one or more databases storing reported messages and user information from one of a single organization or a plurality of organizations.