MISDIRECTED EMAIL DATA LOSS PREVENTION
Aspects of the disclosure relate to data loss prevention. A computing platform may detect input of a first target recipient domain into a first email message. The computing platform may identify, in real time and prior to sending the first email message, that the first target recipient domain is an unintended recipient domain instead of an intended recipient domain. The computing platform may identify, in real time and prior to sending the first email message, that the first email message violates one or more data loss prevention rules. Based on identifying the violation, the computing platform may send a notification that the first target recipient domain is flagged as an unintended recipient domain and one or more commands directing a user device of the message sender to display the notification.
1 . A computing platform, comprising:
at least one processor;
a communication interface communicatively coupled to the at least one processor; and
memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
identify that historical messages between a message sender and a first target recipient domain, included in a first email message, do not have a context match with the first email message;
identify, in real time and prior to sending the first email message, that the first email message violates one or more data loss prevention rules; and
based on identifying that the first email message does not include a context match with the historical messages and that the first email message violates the one or more data loss prevention rules, send a notification that the first target recipient domain is unintended and one or more commands directing a user device of the message sender to display the notification.
2 . The computing platform of claim 1 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
identify, using a user graph, a plurality of nearest neighbor recipients for the message sender of the first email message.
3 . The computing platform of claim 2 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
identify that the first target recipient domain corresponds to a user included in the plurality of nearest neighbor recipients.
4 . The computing platform of claim 3 , wherein identifying whether or not there is a context match comprises identifying whether a context of the first email message matches a context of one or more historical messages between the message sender and one or more of the plurality of nearest neighbor recipients.
5 . The computing platform of claim 4 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
identify, in real time and prior to sending the first email message, that the first target recipient domain is unintended based on the identification that the first target recipient domain corresponds to the user and that the context of the first email message does not match the context of the one or more historical messages between the message sender and the one or more of the plurality of nearest neighbor recipients.
6 . The computing platform of claim 5 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
flag the first target recipient domain as unintended, wherein the notification that the first target recipient domain is unintended is sent based on the flagging.
7 . The computing platform of claim 1 , wherein the identification that the historical messages between the message sender and the first target recipient domain do not have the context match with the first email message is performed using a decision tree model.
8 . The computing platform of claim 1 , wherein identifying that the first email message violates the one or more data loss prevention rules comprises receiving a second notification from a data loss prevention system indicating that the first email message violates the one or more data loss prevention rules.
9 . The computing platform of claim 1 , wherein the one or more data loss prevention rules comprise manually input rules defining message characteristics that cause a corresponding email message to be flagged when identified.
10 . The computing platform of claim 1 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, further cause the computing platform to:
detect input of a second target recipient domain into a second email message;
identify, in real time and prior to sending the second email message, that the second target recipient domain is unintended;
identify, in real time and prior to sending the second email message, that the second email message complies with each of the one or more data loss prevention rules; and
based on identifying that the second email message complies with each of the one or more data loss prevention rules, route the second email message to the second target recipient domain.
11 . A method comprising:
at a computing platform comprising at least one processor, a communication interface, and memory:
identifying that historical messages between a message sender and a first target recipient domain, included in a first email message, do not have a context match with the first email message;
identifying, in real time and prior to sending the first email message, that the first email message violates one or more data loss prevention rules; and
based on identifying that the first email message does not include a context match with the historical messages and that the first email message violates the one or more data loss prevention rules, sending a notification that the first target recipient domain is unintended and one or more commands directing a user device of the message sender to display the notification.
12 . The method of claim 11 , further comprising:
identifying, using a user graph, a plurality of nearest neighbor recipients for the message sender of the first email message.
13 . The method of claim 12 , further comprising:
identifying that the first target recipient domain corresponds to a user included in the plurality of nearest neighbor recipients.
14 . The method of claim 13 , wherein identifying whether or not there is a context match comprises identifying whether a context of the first email message matches a context of one or more historical messages between the message sender and one or more of the plurality of nearest neighbor recipients.
15 . The method of claim 14 , further comprising:
identifying, in real time and prior to sending the first email message, that the first target recipient domain is unintended based on the identification that the first target recipient domain corresponds to the user and that the context of the first email message does not match the context of the one or more historical messages between the message sender and the one or more of the plurality of nearest neighbor recipients.
16 . The method of claim 15 , further comprising:
flagging the first target recipient domain as unintended, wherein the notification that the first target recipient domain is unintended is sent based on the flagging.
17 . The method of claim 11 , wherein the identification that the historical messages between the message sender and the first target recipient domain do not have the context match with the first email message is performed using a decision tree model.
18 . The method of claim 11 , wherein identifying that the first email message violates the one or more data loss prevention rules comprises receiving a second notification from a data loss prevention system indicating that the first email message violates the one or more data loss prevention rules.
19 . The method of claim 11 , wherein the one or more data loss prevention rules comprise manually input rules defining message characteristics that cause a corresponding email message to be flagged when identified.
20 . One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:
identify that historical messages between a message sender and a first target recipient domain, included in a first email message, do not have a context match with the first email message;
identify, in real time and prior to sending the first email message, that the first email message violates one or more data loss prevention rules; and
based on identifying that the first email message does not include a context match with the historical messages and that the first email message violates the one or more data loss prevention rules, send a notification that the first target recipient domain is unintended and one or more commands directing a user device of the message sender to display the notification.