Systems and methods for intelligent identification and automated disposal of non-malicious electronic communications
A system and method for accelerating a disposition of non-malicious electronic communications includes extracting one or more corpora of feature vectors from an electronic communication based on providing the electronic communication as input to a feature extractor; computing, by a machine learning-based electronic communication classification model, an electronic communication-type classification inference that includes a probability of the electronic communication being of the target non-malicious electronic communication type in response to the machine learning-based electronic communication classification model receiving the one or more corpora of feature vectors; attributing a classification label of the target non-malicious electronic communication type to the electronic communication based on the probability of the electronic communication-type classification inference satisfying a minimum electronic communication classification threshold; and automatically routing a security alert associated with the electronic communication to an alert disposal queue based on the electronic communication having the classification label of the target non-malicious electronic communication type.
1. A method comprising:
extracting one or more corpora of feature vectors from electronic communication data associated with an electronic communication, wherein extracting the one or more corpora of feature vectors includes:
(i) extracting a first corpus of feature vectors comprising feature data indicative of whether the electronic communication is of a target type, wherein:
the target type refers to a class of electronic communications that promotes one or more products, one or more services, or one or more events, and
(ii) extracting a second corpus of feature vectors comprising feature data indicative of whether the electronic communication is a malicious electronic communication;
computing, by an electronic communication classification model, a classification inference that includes a probability of the electronic communication being of the target type based on the electronic communication classification model receiving the first corpus of feature vectors and the second corpus of feature vectors; and
automatically closing a security alert associated with the electronic communication based on the probability satisfying a predetermined minimum classification threshold.
2. The method according to claim 1 , wherein:
the class of electronic communications are non-malicious.
3. The method according to claim 1 , further comprising:
automatically attributing a classification label of the target type to the electronic communication based on the probability of the classification inference satisfying the predetermined minimum classification threshold.
4. The method according to claim 1 , further comprising:
automatically routing the security alert to an alert disposition queue based on the probability satisfying the predetermined minimum classification threshold.
5. A computer-implemented method comprising:
extracting one or more corpora of feature vectors from third-party electronic communication data associated with a third-party electronic communication, wherein extracting the one or more corpora of feature vectors includes:
(i) extracting a first corpus of feature vectors indicative of whether the third-party electronic communication is of a target non-malicious electronic communication type, wherein:
the target non-malicious electronic communication type refers to a class of electronic communications that promotes one or more products, one or more services, or one or more events, and
(ii) extracting a second corpus of feature vectors indicative of whether the third-party electronic communication is a suspected malicious electronic communication;
computing, by a machine learning-based electronic communication classification model, an electronic communication-type classification inference that includes a probability of the third-party electronic communication being of the target non-malicious electronic communication type based on the first corpus of feature vectors and the second corpus of feature vectors; and
automatically closing a security alert associated with the third-party electronic communication based on the probability satisfying a predetermined minimum classification threshold.
6. The computer-implemented method according to claim 5 , further comprising:
in response to automatically closing the security alert associated with the third-party electronic communication:
bypassing a cybersecurity investigation into the security alert, wherein the cybersecurity investigation includes executing one or more cybersecurity investigation workflows.
7. The computer-implemented method according to claim 5 , further comprising:
obtaining, from a subscriber, a request to assess a threat of the third-party electronic communication, wherein the security alert is automatically generated in response to obtaining the request from the subscriber.
8. The computer-implemented method according to claim 7 , wherein:
the security alert is routed to a security alert queue after generating the security alert, and
the security alert queue includes a plurality of security alerts, wherein each security alert of the plurality of security alerts is awaiting an alert triage.
9. The computer-implemented method according to claim 8 , further comprising:
automatically removing the security alert associated with the third-party electronic communication from the security alert queue in response to automatically closing the security alert.
10. The computer-implemented method according to claim 5 , further comprising:
obtaining a corpus of training data that includes a plurality of electronic communication training data samples, wherein the corpus of training data includes:
(a) a first set of labeled electronic communications, wherein each electronic communication of the first set of labeled electronic communications is labeled as being of the target non-malicious electronic communication type,
(b) a second set of labeled electronic communications, wherein each electronic communication of the second set of labeled electronic communications is labeled as not being of the target non-malicious electronic communication type, and
(c) a third set of unlabeled electronic communications, wherein the corpus of training data includes more unlabeled electronic communications than labeled electronic communications; and
configuring the machine learning-based electronic communication classification model based on a semi-supervised training of a machine learning classification model using the corpus of training data.
11. The computer-implemented method according to claim 5 , further comprising:
displaying, via a web-accessible user interface, a representation of the security alert that includes:
(a) a representation of the third-party electronic communication, and
(b) the probability of the third-party electronic communication being of the target non-malicious electronic communication type.
12. The computer-implemented method according to claim 5 , wherein:
one feature of the second corpus of feature vectors indicates whether a return path of the third-party electronic communication matches a sender address of the third-party electronic communication, and
the machine learning-based electronic communication classification model uses the one feature of the second corpus of feature vectors to assist with computing the probability of the third-party electronic communication being of the target non-malicious electronic communication type.
13. The computer-implemented method according to claim 5 , wherein:
one feature of the second corpus of feature vectors indicates whether a sender domain of the third-party electronic communication was involved in a previous security incident, and
the machine learning-based electronic communication classification model uses the one feature of the second corpus of feature vectors to assist with computing the probability of the third-party electronic communication being of the target non-malicious electronic communication type.
14. The computer-implemented method according to claim 5 , wherein:
one feature of the first corpus of feature vectors indicates whether a sender of the third-party electronic communication corresponds to a corporate marketing account of an organization, and
the machine learning-based electronic communication classification model uses the one feature of the first corpus of feature vectors to assist with computing the probability of the third-party electronic communication being of the target non-malicious electronic communication type.
15. The computer-implemented method according to claim 5 , wherein:
one feature of the first corpus of feature vectors indicates a combined number of terms and phrases included in a body of the third-party electronic communication that is indicative of the target non-malicious electronic communication type, and
the machine learning-based electronic communication classification model uses the one feature of the first corpus of feature vectors to assist with computing the probability of the third-party electronic communication being of the target non-malicious electronic communication type.
16. The computer-implemented method according to claim 5 , wherein:
one feature of the first corpus of feature vectors indicates a chromatic intensity of the third-party electronic communication, and
the machine learning-based electronic communication classification model uses the one feature of the first corpus of feature vectors to assist with computing the probability of the third-party electronic communication being of the target non-malicious electronic communication type.
17. The computer-implemented method according to claim 5 , wherein:
one feature of the second corpus of feature vectors indicates a domain age of a sender domain used in the third-party electronic communication, and
the machine learning-based electronic communication classification model uses the one feature of the second corpus of feature vectors to assist with computing the probability of the third-party electronic communication being of the target non-malicious electronic communication type.
18. The computer-implemented method according to claim 5 , wherein:
one feature of the first corpus of feature vectors indicates whether digital images are embedded in the third-party electronic communication, and
the machine learning-based electronic communication classification model uses the one feature of the first corpus of feature vectors to assist with computing the probability of the third-party electronic communication being of the target non-malicious electronic communication type.