Systems and methods for encrypted message filtering
The present disclosure provides new and innovative systems and methods for filtering encrypted messages. In an example, a computer-implemented method includes obtaining a message, determining sender profiling features of the message, determining enterprise graph features of the message, determining header features of the message, determining a message flag based on the sender profiling features, the enterprise graph features, and the header features, and processing the message based on the message flag.
1. A computer-implemented method, comprising:
obtaining a message;
determining sender profiling features of the message;
determining enterprise graph features of the message, wherein the enterprise graph features comprise:
an average page rank score of recipients of the message,
a random walk relation score of the recipients of the message, and
a transitive closure relation score of the recipients of the message;
determining header features of the message;
determining a message flag based on the sender profiling features, the enterprise graph features, and the header features; and
processing the message based on the message flag.
2. The computer-implemented method of claim 1 , wherein the sender profiling features comprise a number of unsolicited messages associated with a sender of the message and a similarity score of a path field of the message to a historical path field.
3. The computer-implemented method of claim 1 , wherein the sender profiling features comprise an indication of the message being a broadcast message with a single recipient.
4. The computer-implemented method of claim 1 , wherein the header features comprise an indication of numbers and letters in a from field of the message, a similarity of a message identifier field of the message and a helo field of the message, and a similarity of the from field of the message and the helo field of the message.
5. The computer-implemented method of claim 1 , wherein the header features comprise a percentage of white space in a subject of the message, a percentage of capital letters in the subject of the message, and an indication of a presence of non-ASCII characters in the subject of the message.
6. The computer-implemented method of claim 1 , wherein the sender profiling features are determined using a first machine classifier, the enterprise graph features are determined using a second machine classifier, and the header features are determined using a third machine classifier.
7. The computer-implemented method of claim 1 , wherein the sender profiling features, the enterprise graph features, and the header features are determined using a single machine classifier.
8. An apparatus, comprising:
a processor; and
a memory storing instructions that, when read by the processor, cause the apparatus to:
obtain a message;
determine sender profiling features of the message;
determine enterprise graph features of the message, wherein the enterprise graph features comprise:
an average page rank score of recipients of the message,
a random walk relation score of the recipients of the message, and
a transitive closure relation score of the recipients of the message;
determine header features of the message;
determine a message flag based on the sender profiling features, the enterprise graph features, and the header features; and
process the message based on the message flag.
9. The apparatus of claim 8 , wherein the sender profiling features comprise a number of unsolicited messages associated with a sender of the message and an indication of the message being a broadcast message with a single recipient.
10. The apparatus of claim 8 , wherein the sender profiling features comprise a similarity score of a path field of the message to a historical path field.
11. The apparatus of claim 8 , wherein the header features comprise an indication of numbers and letters in a from field of the message, a similarity of a message identifier field of the message and a helo field of the message, and a similarity of the from field of the message and the helo field of the message.
12. The apparatus of claim 8 , wherein the header features comprise a percentage of white space in a subject of the message, a percentage of capital letters in the subject of the message, and an indication of a presence of non-ASCII characters in the subject of the message.
13. The apparatus of claim 8 , wherein the sender profiling features are determined using a first machine classifier, the enterprise graph features are determined using a second machine classifier, and the header features are determined using a third machine classifier.
14. The apparatus of claim 8 , wherein the sender profiling features, the enterprise graph features, and the header features are determined using a single machine classifier.
15. A non-transitory computer readable medium storing instructions that, when executed by a processor, cause the processor to perform operations comprising:
obtaining a message;
determining sender profiling features of the message;
determining enterprise graph features of the message, wherein the enterprise graph features comprise:
an average page rank score of recipients of the message,
a random walk relation score of the recipients of the message, and
a transitive closure relation score of the recipients of the message;
determining header features of the message;
determining a message flag based on the sender profiling features, the enterprise graph features, and the header features; and
processing the message based on the message flag.
16. The non-transitory computer readable medium of claim 15 , wherein the sender profiling features comprise a similarity score of a path field of the message to a historical path field and an indication of the message being a broadcast message with a single recipient.
17. The non-transitory computer readable medium of claim 15 , wherein the sender profiling features comprise a number of unsolicited messages associated with a sender of the message.
18. The non-transitory computer readable medium of claim 15 , wherein the header features are selected from the group consisting of an indication of numbers and letters in a from field of the message, a similarity of a message identifier field of the message and a helo field of the message, a similarity of the from field of the message and the helo field of the message, a percentage of white space in a subject of the message, a percentage of capital letters in the subject of the message, and an indication of a presence of non-ASCII characters in the subject of the message.
19. The non-transitory computer readable medium of claim 15 , wherein the sender profiling features are determined using a first machine classifier, the enterprise graph features are determined using a second machine classifier, and the header features are determined using a third machine classifier.
20. The non-transitory computer readable medium of claim 15 , wherein the sender profiling features, the enterprise graph features, and the header features are determined using a single machine classifier.