Systems and methods of detecting email-based attacks through machine learning

1. A method comprising:

receiving an email addressed to a user;

separating the email into a plurality of email components including a first link;

analyzing, using machine-learning techniques, the first link by:

virtually navigating to an end-point of the first link;

tracking re-routing by the first link between a starting point and the end-point;

receiving any automatic download triggered by virtually navigating to the end-point;

isolating the automatic download;

analyzing the automatic download; and

analyzing a content of the end-point;

providing the analyses of the first link to a stacked ensemble analyzer; and

determining, based on an output of the stacked ensemble analyzer, that the email is potentially malicious.

2. The method of claim 1 , wherein the stacked ensemble analyzer comprises a nonparametric model.

3. The method of claim 1 , further comprising:

analyzing, using machine-learning techniques, the remainder of the plurality of email components;

wherein the plurality of email components comprises one or more of an email header, an email body, a subject line, or one or more attachments.

4. The method of claim 3 , further comprising:

analyzing at least one of the email body or the subject line using term frequency-inverse document frequency (TF-IDF) logistic regression trained with an email corpus.

5. The method of claim 3 , further comprising:

analyzing the email header using a random decision forest classifier.

6. The method of claim 3 , further comprising:

analyzing the email header by analyzing a path of delivery for the email.

7. The method of claim 1 , further comprising:

deactivating the first link in response to determining that the email is potentially malicious.

8. The method of claim 1 , further comprising:

comparing a universal resource locator (URL) of the first link with a domain of a sender of the email.

9. The method of claim 1 , further comprising:

placing a tag on the email to identify the email for supplemental analysis for maliciousness.

10. The method of claim 9 , further comprising:

identifying a quantity of emails with the tag;

determining that the quantity of emails with the tag exceeds a threshold value; and

implementing the supplemental analysis based on the quantity of emails exceeding the threshold value.

11. The method of claim 10 , wherein:

the threshold value is based on a tag type; and

the tag type comprises one or more of spear phishing, advanced persistent threat (APT), Business Email Compromise, or Executive Spoof.

12. The method of claim 11 , further comprising:

generating one or more network rules to quarantine and/or sanitize malicious emails based on the supplemental analysis.

13. A method comprising:

receiving an email addressed to a user;

separating the email into a plurality of email components;

analyzing each of the plurality of email components using machine-learning techniques;

providing the analysis of each of the plurality of email components to a stacked ensemble analyzer;

determining, based on an output of the stacked ensemble analyzer, that the email is potentially malicious;

outputting the email to a systems operations console;

receiving, from the systems operations console, an indication that the email is potentially malicious; and

updating the machine-learning techniques, responsive to the indication, by:

updating a training corpus of malicious emails to include the email; and

incrementally retraining the machine-learning techniques based on the training corpus.

14. The method of claim 13 , wherein:

the plurality of email components comprises a first link; and

determining that the email is potentially malicious comprises comparing a universal resource locator (URL) of the first link with a domain of a sender of the email.

15. The method of claim 13 , further comprising:

generating ranking data indicating a maliciousness of potentially malicious emails; and

sending the ranking data to the stacked ensemble analyzer.

16. The method of claim 15 , wherein the ranking data is based on one or more of likelihood of maliciousness, sophistication of attack, breadth of attack, or potential impact.