Method and system for determining and acting on a structured document cyber threat risk
A cyber defense system using machine learning models trained on the classification of structured documents, such as emails, in order to identify a cyber threat risk of the incoming or outgoing structured document and to cause one or more autonomous actions to be taken in relation to the structured document based on a comparison of a category the structured document is classified with, a score associated with the classification and a threshold score. For incoming structured documents, the autonomous actions of the cyber defense system may act to contain a malign nature of identified incoming structured documents. For outgoing structured documents, the autonomous actions of the cyber defense system may act to prevent the structured document from being sent to an unintended recipient.
1 . An apparatus for determining and acting on a cyber threat risk of a structured document addressed to an indicated recipient by a sender, the apparatus, including a hardware processor and one or more non-transitory storage mediums configured to store instructions executable by the hardware processor and associated with one or more machine learning modules, a classifier and an autonomous response module, comprising:
the one or more machine learning models that are trained on a classification of structured documents with one or more of a plurality of categories based on a plurality of characteristics of the structured documents;
the classifier configured to receive a first structured document addressed to the indicated recipient for analysis and to parse the first structured document to extract the plurality of characteristics of the first structured document; wherein the classifier is further configured to cooperate with the one or more machine learning models to classify the first structured document with one or more of the plurality of categories based on the extracted plurality of characteristics of the first structured document, and then to determine an associated score for the classification, where the first structured document is an outbound electronic communication from an account of the sender selected from a group consisting of an email, an instant message, a text message, or other structured electronic communication, wherein the classifier is further configured to cooperate with one or more of the one or more machine learning models that has been further trained to identify, for each recipient known to the sender, one or more indicators corresponding to characteristics that are frequently present in the plurality of structured documents sent by the sender and addressed to 1) the indicated recipient known to the sender relative to 2) those structured documents addressed to other recipients known to the sender; and thus, the determined associated score from the classifier then indicates a degree of association with between the first structured document and the indicated recipient compared to structured documents addressed to other potential recipients known to the sender;
the autonomous response module configured to, based on the comparison of the associated score with a threshold, cause one or more autonomous actions to be taken in relation to the first structured document, where when a first recipient other than the indicated recipient is determined to have a best association with respect to the extracted characteristics of the first structured document, then the autonomous response module is configured to bring this to an attention of the sender of the first structured document by displaying an alert on a user interface to the sender;
wherein the one or more machine learning models, the classifier, and the autonomous response module cooperate to improve a computing device by limiting a consumption of central processing unit (CPU) cycles, memory space, and power consumption in the computing device via generating and sending of the first structured document to an unintended recipient.
2 . The apparatus of claim 1 , further comprising a sender user interface;
wherein each category of the plurality of categories represents a respective recipient of a plurality of recipients known to the sender;
wherein the associated score represents a probability of a match between the indicated recipient and the extracted plurality of characteristics of the first structured document;
wherein the classifier is further configured to determine one or more further scores representing a respective probability of a match between the extracted plurality of characteristics and each of the other recipients known to the sender;
wherein the threshold represents a score of an alternative recipient, of the other recipients known to the sender, having a highest probability of a match; and
wherein the one or more autonomous actions comprise, when the associated score is less than the threshold, displaying the alert to the sender on the sender user interface indicating that the alternative recipient has a higher probability of a match than the indicated recipient.
3 . The apparatus of claim 2 , wherein the autonomous response module is further configured to prevent the first structured document from being sent to the indicated recipient until the alert has been acknowledged by the sender.
4 . The apparatus of claim 1 , wherein the plurality of characteristics of the first structured document comprise a stem of constituent words and/or phrases of a body text of the first structured document.
5 . The apparatus of claim 1 , wherein the plurality of characteristics of the first structured document comprise additional recipients indicated in the first structured document to be sent from the account of the sender; and wherein the one or more indicators for each respective recipient known to the sender further comprise additional recipients that are frequently present in the plurality of structured documents sent by the sender.
6 . The apparatus of claim 1 , wherein the sender is associated with an organization; wherein the classifier is further configured to classify the first structured document with one or more categories representing unknown recipients that are unknown to the sender based on unique indicators corresponding to characteristics that are uniquely present in structured documents sent to respective unknown recipients by other senders associated with the organization; and wherein the one or more autonomous actions comprise, when a score associated with the respective unknown recipient corresponds to a highest probability of a match, where the autonomous response module is further configured to display the alert to the sender on the user interface indicating that the respective unknown recipient has a higher probability of a match than the indicated recipient.
7 . The apparatus of claim 1 , wherein the autonomous response module is further configured to display, with the alert to the sender, one or more of the characteristics and/or indicators that led to the first recipient having a higher probability of a match.
8 . The apparatus of claim 1 , wherein a second structured document has been sent to a user from a given sender; wherein the one or more categories comprise one or more malign categories; and wherein, when the associated score determined for the one or more malign categories is above the threshold, the one or more autonomous actions comprise one or more actions to contain a malign nature of the sent second structured document.
9 . The apparatus of claim 8 , wherein the plurality of characteristics of the second structured document comprise one or more of: the constituent words and/or phrases of a body text of the second structured document, links in the second structured document directing to other resources, attachments of the second structured document, a format of an addressing field of the second structured document; the presence of phone numbers in the body text, the presence of email addresses in the body text, the presence of currency values in the body text, and/or derived ratio analysis of aspects of text construction of the body text in the second structured document.
10 . The apparatus of claim 9 , further comprising a language classifier with one or more language machine learning models trained to identify a language of text;
wherein the one or more of the machine learning models trained on the classification of structured documents are trained on words and/or phrases of a subset of languages;
wherein the language classifier is configured to reference the one or more language machine learning modules to identify the language of the body text of the second structured document; and wherein, if the language of the body text is determined to be a language not included in the subset of languages, the classifier is configured to classify the second structured document with one or more of the plurality of categories based on the extracted plurality of characteristics excluding the constituent words and/or phrases of a body text of the second structured document.
11 . The apparatus of claim 8 , wherein the one or more actions to contain the malign nature of the received structured document comprise one or more of: converting one or more attachments of the structured document from one file format to another file format, removing one or more attachments of the second structured document, redirecting links in the second structured document to alternative destinations, removing links from the second structured document, tagging the second structured document as junk, redirecting or copying the second structured document to another user inbox, inserting additional text into the second structured document, and/or altering the content of one or more defined fields of the second structured document.
12 . The apparatus of claim 8 , further comprising a user interface having an administrative tool for setting, by a user, which types of autonomous actions the autonomous response module is configured to perform and for setting the threshold;
wherein the autonomous response module is further configured to display, on the user interface, one or more of the characteristics of the structured document that led to the cause of the autonomous action.
13 . The apparatus of claim 8 , wherein the one or more machine learning models that are trained on the classification of structured documents comprise at least one machine learning module trained by comparing the relative frequency density of words and phrases in training data sets corresponding to each respective category.
14 . A computer implemented method for determining and acting on a cyber threat risk of a structured document addressed to an indicated recipient by a sender, the method comprising:
using one or more machine learning models that are trained on the classification of structured documents with one or more of a plurality of categories based on a plurality of characteristics of the structured documents;
receiving, at a classifier, a structured document for analysis and parsing a first structured document addressed to the indicated recipient to extract the plurality of characteristics of the first structured document, where the first structured document is an outbound electronic communication from an account of the sender selected from a group consisting of an email, an instant message, a text message, or other structured electronic communication;
classifying, at the classifier, the first structured document with one or more of the plurality of categories based on the extracted plurality of characteristics of the first structured document and referencing the one or more machine learning models, and determining an associated score for the classification of first structured document;
using one or more of the one or more machine learning models that has been further trained to identify, for each recipient known to the sender, one or more indicators corresponding to characteristics that are frequently present in the plurality of structured documents sent by the sender and addressed to 1) the indicated recipient known to the sender relative to 2) those structured documents addressed to other recipients known to the sender,
causing the determined associated score from the classifier to then indicate a degree of association with between the first structured document and the indicated recipient compared to structured documents addressed to other potential recipients known to the sender,
causing, by an autonomous response module, one or more autonomous actions to be taken in relation to the first structured document based on a comparison of the associated score with a threshold,
bringing to an attention of the sender of the first structured document, by the autonomous response module, when a first recipient other than the indicated recipient is determined to have a best association with respect to the extracted characteristics of the first structured document and displaying an alert on the first recipient on a user interface to the sender,
using the one or more machine learning models, the classifier, and the autonomous response module cooperate to improve a computing device by limiting a consumption of central processing unit (CPU) cycles, memory space, and power consumption in the computing device via preventing a generation and sending of the first structured document to an unintended recipient,
wherein any software instructions utilized by the one or more machine learning models, the classifier, and the autonomous response module are stored on one or more non-transitory storage mediums in an executable state to be executed by one or more processor units.
15 . The computer implemented method of claim 14 , wherein the structured document is to be sent from the sender to an indicated recipient;
wherein each category of the plurality of categories represents a respective recipient of a plurality of recipients known to the sender; and
wherein the associated score represents the probability of a match between the indicated recipient and the extracted plurality of characteristics; the computer implemented method further comprising:
determining, by the classifier, one or more further scores representing the respective probability of a match between the extracted plurality of characteristics and each of the other recipients known to the sender; wherein the threshold represents the score of an alternative recipient, of the other recipients known to the sender, having the highest probability of a match; and
wherein the one or more autonomous actions comprise, if the associated score is less than the threshold, displaying an alert to the sender on the sender user interface indicating that the alternative recipient has a higher probability of a match than the indicated recipient.
16 . The computer implemented method of claim 15 , wherein one or more of the machine learning models have been trained to identify, for each recipient known to the sender, one or more indicators corresponding to characteristics that are frequently present in structured documents sent by the sender and addressed to the respective recipient known to the sender relative to those addressed to other recipients known to the sender; and wherein the classifier classifies the structured document with one or more of the categories representing the plurality of recipients known to the sender by comparing the extracted plurality of characteristics with the one or more indicators for each recipient known to the sender.
17 . The computer implemented method of claim 16 , wherein the plurality of characteristics of the structured document comprise the stem of the constituent words and/or phrases of a body text of the structured document.
18 . The computer implemented method of claim 14 , wherein the structured document has been sent to the user from a given sender; wherein the one or more categories comprise one or more malign categories; and wherein, when the associated score determined for the one or more malign categories is above the threshold, the one or more autonomous actions comprise one or more actions to contain the malign nature of the sent structured document.
19 . A non-transitory computer readable medium including executable instructions that, when executed with one or more processors, cause a cyber defense system to perform the operations of claim 14 .