Method and system for analyzing electronic communications and customer information to recognize and mitigate message-based attacks
A method includes receiving a message, enqueueing the message, dequeueing the message by a fraud detection service, analyzing the message using a trained machine learning model, analyzing an isolated domain name, storing the message, and causing a mitigation action. A computing system includes a transceiver, a processor, a memory storing instructions that when executed by the processor cause the system to receive a message, enqueue the message, dequeue the message, analyze the message using a machine learning model, analyze an isolated domain name, store the message, and cause a mitigation action. A non-transitory computer readable medium contains instructions that when executed, cause a computer to receive a message, enqueue the message, dequeue the message by a fraud detection service, analyze the message using a machine learning model, analyze an isolated domain name, store the message, and cause a mitigation action.
1. A computer-implemented method of detecting and mitigating message-based attacks, the method comprising:
receiving, via a computer network, an electronic message;
enqueueing, via a listener, the message in a message queue;
dequeueing the message from the message queue by a fraud detection service;
training a machine learning model to classify a message intent by analyzing a partitioned data set of fraudulent and non-fraudulent messages, wherein the training includes excluding personal messages,
analyzing the message using the trained machine learning model to determine the message intent;
analyzing a domain name isolated from the message to determine a domain name trust output;
storing, when the message intent corresponds to an order and the domain name trust output is untrusted, the message in a results store; and
causing one or more mitigation actions to occur by analyzing the message using one or more mitigation rules.
2. The method of claim 1 , wherein the electronic message is an email.
3. The method of claim 1 , wherein analyzing the message using the machine learning model trained by analyzing the partitioned data set of fraudulent and non-fraudulent messages to generate the message intent includes training the machine learning model to perform a logistic regression.
4. The method of claim 1 , wherein analyzing the domain name isolated from the message to determine the domain name trust output includes querying one or both of (1) a public WHOIS server, and (2) a private WHOIS server.
5. The method of claim 1 , wherein analyzing the domain name isolated from the message to determine the domain name trust output includes determining whether the domain name isolated from the message is a known value.
6. The method of claim 1 , wherein analyzing the domain name isolated from the message to generate the domain name trust output includes determining a weighted score corresponding to a net domain name trust output.
7. The method of claim 1 , wherein causing the one or more mitigation actions to occur by analyzing the message using the one or more mitigation rules includes executing a set of rules.
8. The method of claim 7 , further comprising:
generating, based on executing the set of rules, a notification.
9. The method of claim 7 , further comprising:
injecting, based on executing the set of rules, information into the message.
10. The method of claim 7 , further comprising:
storing, based on executing the set of rules, identifying information in the message in a blacklist database.
11. A computing system for detecting and mitigating message-based attacks includes: a transceiver; one or more processors; and one or more memories storing instructions that, when executed by the one or more processors, cause the computing system to:
receive, via the transceiver, an electronic message;
enqueue the message via a listener in a message queue;
dequeue the message from the message queue by a fraud detection service;
train a machine learning model to classify a message intent by analyzing a partitioned data set of fraudulent and non-fraudulent messages, wherein the training includes excluding personal messages,
analyze the message using the trained machine learning model to determine the message intent;
analyze a domain name isolated from the message to determine a domain name trust output;
store, when the message intent corresponds to an order and the domain name trust output is untrusted, the message in a results store; and
cause one or more mitigation actions to occur by analyzing the message using one or more mitigation rules.
12. The computing system of claim 11 , wherein the electronic message is an email.
13. The computing system of claim 11 , the one or more memories storing further instructions that, when executed by the one or more processors, cause the computing system to:
train the machine learning model to perform a logistic regression.
14. The computing system of claim 11 , the one or more memories storing further instructions that, when executed by the one or more processors, cause the computing system to:
query one or both of (1) a public WHOIS server, and (2) a private WHOIS server.
15. The computing system of claim 11 , the one or more memories storing further instructions that, when executed by the one or more processors, cause the computing system to:
determine whether the domain name isolated from the message is a known value.
16. The computing system of claim 11 , the one or more memories storing further instructions that, when executed by the one or more processors, cause the computing system to:
determine a weighted score corresponding to a net domain name trust output.
17. The computing system of claim 11 , the one or more memories storing further instructions that, when executed by the one or more processors, cause the computing system to:
execute a set of rules causing a notification to be generated.
18. A non-transitory computer readable medium containing program instructions that when executed, cause a computer to:
receive, via a computer network, an electronic message;
enqueue the message via a listener in a message queue;
dequeue the message from the message queue by a fraud detection service;
train a machine learning model to classify a message intent by analyzing a partitioned data set of fraudulent and non-fraudulent messages, wherein the training includes excluding personal messages,
analyze the message using the trained machine learning model to determine the message intent;
analyze a domain name isolated from the message to determine a domain name trust output;
store, when the message intent corresponds to an order and the domain name trust output is untrusted, the message in a results store; and
cause one or more mitigation actions to occur by analyzing the message using one or more mitigation rules.
19. The non-transitory computer readable medium of claim 18 containing further program instructions that when executed, cause a computer to:
train the machine learning model to perform a logistic regression.
20. The non-transitory computer readable medium of claim 18 containing further program instructions that when executed, cause a computer to:
determine whether the domain name isolated from the message is a known value.