System and method for deep learning on attack energy vectors
A method, computer program product, and computer system for identifying potential social engineering activity associated with two or more communications on two or more communication channels of a plurality of communication channels. Identification may be based on a determination that a current score for the two or more communication channels is greater than a threshold score for a user profile.
1. A computer-implemented method comprising:
identifying a profile with a user for a plurality of communication channels;
determining a current score for each communication exchanged on two or more communication channels of the plurality of communication channels, wherein the current score is based upon, at least in part, a first current score for a first communication exchanged on a first communication channel of the two or more communication channels and a second current score for a second communication exchanged on a second communication channel of the two or more communication channels;
determining that the current score for the first and second communications exchanged on the two or more communication channels is greater than a threshold score for the profile;
identifying potential social engineering activity for the first and second communications exchanged on the two or more communication channels based upon, at least in part, determining that the current score for the first and second communications exchanged on the two or more communication channels is greater than the threshold score for the profile; and
performing, by a computing device and after identifying potential social engineering activity based upon the current score for the first and second communications exchanged on the two or more communication channels, at least one of text, audio, and visual analysis on at least a portion of content in the first and second communications exchanged on the two or more communication channels based upon, at least in part, identifying potential social engineering activity.
2. The computer-implemented method of claim 1 wherein at least one of the first current score and the second current score is a weighted score.
3. The computer-implemented method of claim 1 wherein each communication channel in the profile includes a respective historical score, and wherein the threshold score is generated based upon, at least in part, machine learning from the respective historical score.
4. The computer-implemented method of claim 1 wherein each communication channel in the profile includes a respective historical score, and wherein the threshold score is updated based upon, at least in part, one or more temporal factors.
5. The computer-implemented method of claim 1 wherein at least one of the first current score and the second current score is a normalized score.
6. The computer-implemented method of claim 1 further comprising determining a pattern between at least a portion of the plurality of communication channels.
7. The computer-implemented method of claim 6 further comprising using the pattern for future identification of social engineering activity.
8. A computer program product residing on a non-transitory computer readable storage medium having a plurality of instructions stored thereon which, when executed across one or more processors, causes at least a portion of the one or more processors to perform operations comprising:
identifying a profile with a user for a plurality of communication channels;
determining a current score for each communication exchanged on two or more communication channels of the plurality of communication channels, wherein the current score is based upon, at least in part, a first current score for a first communication exchanged on a first communication channel of the two or more communication channels and a second current score for a second communication exchanged on a second communication channel of the two or more communication channels;
determining that the current score for the first and second communications exchanged on the two or more communication channels is greater than a threshold score for the profile;
identifying potential social engineering activity for the first and second communications exchanged on the two or more communication channels based upon, at least in part, determining that the current score for the first and second communications exchanged on the two or more communication channels is greater than the threshold score for the profile; and
performing, by a computing device and after identifying potential social engineering activity based upon the current score for the first and second communications exchanged on the two or more communication channels, at least one of text, audio, and visual analysis on at least a portion of content in the first and second communications exchanged on the two or more communication channels based upon, at least in part, identifying potential social engineering activity.
9. The computer program product of claim 8 wherein at least one of the first current score and the second current score is a weighted score.
10. The computer program product of claim 8 wherein each communication channel in the profile includes a respective historical score, and wherein the threshold score is generated based upon, at least in part, machine learning from the respective historical score.
11. The computer program product of claim 8 wherein each communication channel in the profile includes a respective historical score, and wherein the threshold score is updated based upon, at least in part, one or more temporal factors.
12. The computer program product of claim 8 further comprising determining a pattern between at least a portion of the plurality of communication channels.
13. The computer program product of claim 12 further comprising using the pattern for future identification of social engineering activity.
14. A computing system including one or more processors and one or more memories configured to perform operations comprising:
identifying a profile with a user for a plurality of communication channels;
determining a current score for each communication exchanged on two or more communication channels of the plurality of communication channels, wherein the current score is based upon, at least in part, a first current score for a first communication exchanged on a first communication channel of the two or more communication channels and a second current score for a second communication exchanged on a second communication channel of the two or more communication channels;
determining that the current score for the first and second communications exchanged on the two or more communication channels is greater than a threshold score for the profile;
identifying potential social engineering activity for the first and second communications exchanged on the two or more communication channels based upon, at least in part, determining that the current score for the first and second communications exchanged on the two or more communication channels is greater than the threshold score for the profile; and
performing, by a computing device and after identifying potential social engineering activity based upon the current score for the first and second communications exchanged on the two or more communication channels, at least one of text, audio, and visual analysis on at least a portion of content in the first and second communications exchanged on the two or more communication channels based upon, at least in part, identifying potential social engineering activity.
15. The computing system of claim 14 wherein at least one of the first current score and the second current score is a weighted score.
16. The computing system of claim 14 wherein each communication channel in the profile includes a respective historical score, and wherein the threshold score is generated based upon, at least in part, machine learning from the respective historical score.
17. The computing system of claim 14 wherein each communication channel in the profile includes a respective historical score, and wherein the threshold score is updated based upon, at least in part, one or more temporal factors.
18. The computing system of claim 14 further comprising determining a pattern between at least a portion of the plurality of communication channels.
19. The computing system of claim 18 further comprising using the pattern for future identification of social engineering activity.
20. The computing system of claim 14 further comprising a virtual agent for at least one of monitoring and controlling the operations.