Granted Patent B2

US 12,255,861 · App. 18/426,550 · Granted Mar 18, 2025

Inventors: Shalini Kamalapuram Sundaram (Sunnyvale, CA); Chris Moores (Owen Sound, CA); Durgaprasad Velagaleti (Sunnyvale, CA); Srikanth Konjarla (Sunnyvale, CA); Harsh Doshi (Sunnyvale, CA)

Assignee: Proofpoint, Inc.

H04L51/23G06F21/606H04L51/21H04L51/42H04L51/56

Abstract

Claims (85)

1. A computing platform, comprising:

at least one processor;

a communication interface communicatively coupled to the at least one processor; and

memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:

identify, using a user graph, a plurality of nearest neighbor recipients for a message sender of a first email message;

identify, using a decision tree model, that historical messages between the message sender and a first target recipient domain, included in the first email message, do not include a first level match of a context of the first email message by:

identifying that: a) the first target recipient domain corresponds to a user included in the plurality of nearest neighbor recipients, and b) the context of the first email message is a second level match with a context of one or more historical messages between the message sender and one or more of the plurality of nearest neighbor recipients, and

identifying, in real time and prior to sending the first email message, that the first target recipient domain comprises an unintended recipient domain;

identify, in real time and prior to sending the first email message, that the first email message violates one or more data loss prevention rules; and

based on identifying that the first target recipient domain comprises an unintended recipient domain and that the first email message violates the one or more data loss prevention rules, send a notification that the first target recipient domain is flagged as an unintended recipient domain and one or more commands directing a user device of the message sender to display the notification.

2. The computing platform of claim 1 , wherein identifying that the first email message violates the one or more data loss prevention rules comprises receiving a notification from a data loss prevention system, different than the computing platform, indicating that the first email message violates the one or more data loss prevention rules.

3. The computing platform of claim 1 , wherein the one or more data loss prevention rules comprise manually input rules defining message characteristics that, if identified, cause a corresponding email message to be flagged.

4. The computing platform of claim 1 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, causes the computing platform to:

detect input of the first target recipient domain into the first email message; and

identify, in real time and prior to sending the first email message, that the first target recipient domain comprises an unintended recipient domain instead of an intended recipient domain, wherein identifying that the first target recipient domain comprises an unintended recipient domain instead of an intended recipient domain comprises analyzing, using the user graph and the decision tree model, an identity of the first target recipient domain and the context of the first email message, wherein analyzing the first email message using the user graph and the decision tree model comprises:

the identification, using the user graph, of the plurality of nearest neighbor recipients for the message sender of the first email message, and

the identification, using the decision tree model, that the historical messages between the message sender and the first target recipient domain, included in the first email message, do not include the first level match of the context of the first email message.

5. The computing platform of claim 4 , wherein identifying that the first target recipient domain comprises an unintended recipient domain instead of an intended recipient domain further comprises receiving a notification from a misdirected email system, different than the computing platform, indicating that the first target recipient domain comprises an unintended recipient domain.

6. The computing platform of claim 4 , wherein:

identifying that the first target recipient domain comprises an unintended recipient domain instead of an intended recipient domain further comprises applying one or more machine learning techniques, by the computing platform, to the first email message; and

identifying that the first email message violates the one or more data loss prevention rules comprises analyzing, by the computing platform, the first email message based on one or more data loss prevention rules stored at the computing platform.

7. The computing platform of claim 1 , wherein the memory stores additional computer readable instructions that, when executed by the at least one processor, further cause the computing platform to:

detect input of a second target recipient domain into a second email message;

identify, in real time and prior to sending the second email message, that the second target recipient domain comprises an unintended recipient domain instead of an intended recipient domain;

identify, in real time and prior to sending the second email message, that the second email message complies with each of the one or more data loss prevention rules; and

based on identifying that the second email message complies with each of the one or more data loss prevention rules, route the second email message to the unintended recipient domain.

8. The computing platform of claim 1 , wherein the memory stores additional computer readable instructions that, when executed by the at least one processor, further cause the computing platform to:

detect input of a second target recipient domain into a second email message; and

identify, in real time and prior to sending the second email message, that the second target recipient domain comprises a second unintended recipient domain instead of a second intended recipient domain, wherein identifying that the second target recipient domain comprises the second unintended recipient domain instead of the second intended recipient domain comprises analyzing, using the user graph and the decision tree model, an identity of the second target recipient domain and a context of the second email message.

9. The computing platform of claim 8 , wherein analyzing the second email message using the user graph and the decision tree model comprises:

identifying, using the user graph, a plurality of nearest neighbor recipients for a message sender of the second email message;

identifying, using a plurality of machine learning models, a context of the second email message;

identifying whether historical messages between the message sender of the second email message and second target recipient domain include a first level match of the context of the second email message;

based on identifying that the historical messages between the message sender of the second email message and the second target recipient domain include the context of the second email message, identifying whether the second email message violates the one or more data loss prevention rules;

based on identifying that the historical messages between the message sender of the second email message and the second target recipient domain do not include the first level match of the context of the second email message:

identifying whether the second target recipient domain corresponds to a user included in the plurality of nearest neighbor recipients;

identifying whether the context of the second email message is a second level match with a context of one or more of historical messages between the message sender of the second email message and the nearest neighbor recipients;

based on identifying that: a) the second target recipient domain corresponds to a user included in the plurality of nearest neighbor recipients, and b) the context of the second email message is a second level match with a context of one or more of historical messages between the message sender of the second email message and the nearest neighbor recipients, sending a notification to the user device of the message sender of the second email message indicating that the second email message may be intended for a different recipient and prompting the message sender of the second email message to send the second email message or modify the second target recipient domain;

based on identifying that either: a) the second target recipient domain does not correspond to a user included in the plurality of nearest neighbor recipients, or b) the context of the second email message is not a second level match with a context of one or more of historical messages between the message sender of the second email message and the nearest neighbor recipients:

identifying, for each nearest neighbor recipient, a corresponding new plurality of nearest neighbor recipients;

identifying whether the second target recipient domain is a third level match with a user included in one or more of the new pluralities of nearest neighbor recipients;

based on identifying that the second target recipient domain is a third level match with a user included in the one or more of the new pluralities of nearest neighbor recipients, sending a notification to the user device of the message sender of the second email message indicating that the second email message may be intended for a different recipient and prompting the message sender to send the second email message or modify the second target recipient domain;

based on identifying that the second target recipient domain is not a third level match with a user included in the one or more of the new pluralities of nearest neighbor recipients:

if the context of the second email message was identified as a second level match with a context of the one or more historical messages between the message sender of the second email message and the nearest neighbor recipients, sending a notification to the user device of the message sender of the second email message indicating that the second email message may be intended for a different recipient and prompting the message sender of the second email message to send the second email message or modify the second target recipient domain, wherein the notification includes a spelling mistake recommendation indicating a difference between the second target recipient domain and one or more recipient domains of the second level match; and

if the context of the second email message was not identified as a second level match with a context of the one or more historical messages between the message sender of the second email message and the nearest neighbor recipients, sending a notification to the user device of the message sender of the second email message indicating that the second email message may be intended for a different recipient and prompting the message sender of the second email message to send the second email message or modify the second target recipient domain.

10. The computing platform of claim 9 , wherein the plurality of machine learning models includes: latent Dirichlet allocation (LDA), named entity recognition (NER), and text summarization.

11. The computing platform of claim 10 , wherein the memory stores additional computer readable instructions that, when executed by the at least one processor, further cause the computing platform to:

identify the context of the first email message, wherein identifying the context of the first email message comprises:

identifying, using the LDA, one or more topics in the first email message,

identifying, using the NER, one or more named entities in the first email message, and

identifying, using the text summarization, a predetermined number of most frequently used keywords in the first email message.

12. A method, comprising:

at a computing platform comprising at least one processor, a communication interface, and memory:

identifying, using a user graph, a plurality of nearest neighbor recipients for a message sender of a first email message;

identifying, using a decision tree model, that historical messages between the message sender and a first target recipient domain, included in the first email message, do not include a first level match of a context of the first email message by:

identifying that: a) the first target recipient domain corresponds to a user included in the plurality of nearest neighbor recipients, and b) the context of the first email message is a second level match with a context of one or more historical messages between the message sender and one or more of the plurality of nearest neighbor recipients, and

identifying, in real time and prior to sending the first email message, that the first target recipient domain comprises an unintended recipient domain;

identifying, in real time and prior to sending the first email message, that the first email message violates one or more data loss prevention rules; and

based on identifying that the first target recipient domain comprises an unintended recipient domain and that the first email message violates the one or more data loss prevention rules, sending a notification that the first target recipient domain is flagged as an unintended recipient domain and one or more commands directing a user device of the message sender to display the notification.

13. The method of claim 12 , wherein identifying that the first email message violates the one or more data loss prevention rules comprises receiving a notification from a data loss prevention system, different than the computing platform, indicating that the first email message violates the one or more data loss prevention rules.

14. The method of claim 12 , wherein the one or more data loss prevention rules comprise manually input rules defining message characteristics that, if identified, cause a corresponding email message to be flagged.

15. The method of 12 , further comprising:

detecting input of the first target recipient domain into the first email message; and

identifying, in real time and prior to sending the first email message, that the first target recipient domain comprises an unintended recipient domain instead of an intended recipient domain, wherein identifying that the first target recipient domain comprises an unintended recipient domain instead of an intended recipient domain comprises analyzing, using the user graph and the decision tree model, an identity of the first target recipient domain and the context of the first email message, wherein analyzing the first email message using the user graph and the decision tree model comprises:

the identification, using the user graph, the plurality of nearest neighbor recipients for the message sender of the first email message, and

the identification, using the decision tree model, that the historical messages between the message sender and the first target recipient domain, included in the first email message, do not include the first level match of the context of the first email message.

16. The method of claim 15 , wherein identifying that the first target recipient domain comprises an unintended recipient domain instead of an intended recipient domain further comprises receiving a notification from a misdirected email system, different than the computing platform, indicating that the first target recipient domain comprises an unintended recipient domain.

17. The method of claim 15 , wherein:

identifying that the first target recipient domain comprises an unintended recipient domain instead of an intended recipient domain further comprises applying one or more machine learning techniques, by the computing platform, to the first email message; and

identifying that the first email message violates the one or more data loss prevention rules comprises analyzing, by the computing platform, the first email message based on one or more data loss prevention rules stored at the computing platform.

18. The method of claim 12 , further comprising:

detecting input of a second target recipient domain into a second email message;

identifying, in real time and prior to sending the second email message, that the second target recipient domain comprises an unintended recipient domain instead of an intended recipient domain;

identifying, in real time and prior to sending the second email message, that the second email message complies with each of the one or more data loss prevention rules; and

based on identifying that the second email message complies with each of the one or more data loss prevention rules, routing the second email message to the unintended recipient domain.

19. The method of claim 12 , further comprising:

detecting input of a second target recipient domain into a second email message; and

identifying, in real time and prior to sending the second email message, that the second target recipient domain comprises a second unintended recipient domain instead of a second intended recipient domain, wherein identifying that the second target recipient domain comprises the second unintended recipient domain instead of the second intended recipient domain comprises analyzing, using the user graph and the decision tree model, an identity of the second target recipient domain and a context of the second email message.

20. One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:

identify, using a user graph, a plurality of nearest neighbor recipients for a message sender of a first email message;

identify, using a decision tree model, that historical messages between the message sender and a first target recipient domain, included in the first email message, do not include a first level match of a context of the first email message by:

identifying that: a) the first target recipient domain corresponds to a user included in the plurality of nearest neighbor recipients, and b) the context of the first email message is a second level match with a context of one or more historical messages between the message sender and one or more of the plurality of nearest neighbor recipients, and

identifying, in real time and prior to sending the first email message, that the first target recipient domain comprises an unintended recipient domain;

identify, in real time and prior to sending the first email message, that the first email message violates one or more data loss prevention rules; and

based on identifying that the first target recipient domain comprises an unintended recipient domain and that the first email message violates the one or more data loss prevention rules, send a notification that the first target recipient domain is flagged as an unintended recipient domain and one or more commands directing a user device of the message sender to display the notification.

Assignments (3)

Continuity (3)

References Cited (83)