Misdirected email data loss prevention
Aspects of the disclosure relate to data loss prevention. A computing platform may detect input of a first target recipient domain into a first email message. The computing platform may identify, in real time and prior to sending the first email message, that the first target recipient domain comprises an unintended recipient domain instead of an intended recipient domain. The computing platform may send, based on the identification of the unintended recipient domain and to a user device, a notification that the first target recipient domain is flagged as an unintended recipient domain and one or more commands directing the user device to display the notification.
1. A computing platform, comprising:
at least one processor;
a communication interface communicatively coupled to the at least one processor; and
memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
identify, in real time and prior to sending a first email message, that a first target recipient domain comprises an unintended recipient domain instead of an intended recipient domain, wherein the identification comprises:
identifying, using a plurality of machine learning algorithms, first context information for the first email message, wherein identifying the first context information for the first email message comprises:
identifying, using latent Dirichlet allocation (LDA), one or more topics in the first email message,
identifying, using named entity recognition (NER), one or more named entities in the first email message, and
identifying, using text summarization, a predetermined number of most frequently used keywords in the first email message; and
send, based on identifying that the first context information does not match historical context information from historical messages for a sender of the first email message, a notification that the first target recipient domain is flagged as the unintended recipient domain and one or more commands directing a user device to display the notification.
2. The computing platform of claim 1 , wherein the identification further comprises:
identifying, using a user graph, a plurality of nearest neighbor recipients for a message sender.
3. The computing platform of claim 2 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, further cause the computing platform to:
detect input of a second target recipient domain into a second email message;
identify, in real time and prior to sending the second email message, that the second target recipient domain comprises the intended recipient domain, wherein the identification comprises:
identifying, using the user graph, the plurality of nearest neighbor recipients for the message sender,
identifying, using the plurality of machine learning algorithms, context information for the second email message, and
identifying that the context information is a first level match with the historical context information from historical messages between the message sender and a message recipient, of the plurality of nearest neighbor recipients, corresponding to the second target recipient domain; and
send, based on the identification of the intended recipient domain and to a user device of the message recipient, the second email message.
4. The computing platform of claim 2 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, further cause the computing platform to:
detect input of a second target recipient domain into a second email message;
identify, in real time and prior to sending the second email message, that the second target recipient domain comprises a potentially unintended recipient domain instead of the intended recipient domain, wherein the identification comprises:
identifying, using the user graph, the plurality of nearest neighbor recipients for the message sender,
identifying, using the plurality of machine learning algorithms, second context information for the second email message,
identifying that the second context information is not a first level match with the historical context information from historical messages between the message sender and a second message recipient corresponding to the second target recipient domain,
based on identifying that the second context information does not match the historical context information from the historical messages between the message sender and the second message recipient:
identifying whether a message recipient domain is included in the plurality of nearest neighbor recipients, and
identifying whether there is a second level match between the second context information and the historical context information from the historical messages between the message sender and the second message recipient; and
send, based on an identification that the second message recipient is included in the plurality of nearest neighbor recipients and that there is the second level match between the second context information and the historical context information from historical messages between the message sender and the second message recipient, a second notification indicating that the second email message includes a new context for the second message recipient and one or more commands directing the user device to display the second notification, wherein the notification includes an option to correct the potentially unintended recipient domain or to send the second email message.
5. The computing platform of claim 4 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, further cause the computing platform to:
based on an identification of one or more of: a) that the second message recipient is not included in the plurality of nearest neighbor recipients, or b) that there is not the second level match between the second context information and the historical context information from the historical messages between the message sender and the second message recipient:
identify whether the second context information is a third level match with the historical context information from historical messages between the message sender and the plurality of nearest neighbor recipients; and
send, based on an identification that the second context information is the third level match with the historical context information from the historical messages between the message sender and the plurality of nearest neighbor recipients:
a third notification indicating that the second email message includes: a) the new context for the second message recipient, and b) historical messages between the message sender and at least one of the plurality of nearest neighbor recipients, different than the second message recipient, includes the new context, and
one or more commands directing the user device to display the third notification, wherein the third notification includes the option to correct the potentially unintended recipient domain or to send the second email message.
6. The computing platform of claim 5 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, further cause the computing platform to:
based on an identification that the second context information is not the third level match with the historical context information from the historical messages between the message sender and the plurality of nearest neighbor recipients:
identify whether there is a fourth level match between the second context information and the historical context information from the historical messages between the message sender and the plurality of nearest neighbor recipients; and
based on identifying that there is the fourth level match between the second context information and the historical context information from the historical messages between the message sender and at least one of the plurality of nearest neighbor recipients:
generate a spelling mistake recommendation indicating a difference between the second target recipient domain and a domain of the at least one of the plurality of nearest neighbor recipients; and
send, to the message sender, a fourth notification indicating the spelling mistake recommendation and one or more commands directing the user device to display the fourth notification, wherein the fourth notification includes the option to correct the potentially unintended recipient domain or to send the second email message.
7. The computing platform of claim 1 , wherein identifying that the first target recipient domain comprises the unintended recipient domain instead of the intended recipient domain further comprises determining a page rank indicating a trustworthiness of the unintended recipient domain.
8. The computing platform of claim 1 , wherein the plurality of machine learning algorithms includes: the LDA, the NER, and the text summarization.
9. The computing platform of claim 1 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, further cause the computing platform to:
detect input of the first target recipient domain into the first email message.
10. The computing platform of claim 1 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, further cause the computing platform to:
input, into a data loss prevention model, the first email message, wherein:
the data loss prevention model includes one or more user defined rules,
inputting the first email message into the data loss prevention model causes a data loss prevention result to be output, and
the data loss prevention result indicates whether or not any of the one or more user defined rules are violated.
11. The computing platform of claim 10 , wherein the data loss prevention result indicates that at least one of the one or more user defined rules are violated, and wherein sending the notification that the first target recipient domain is flagged as the unintended recipient domain is further based on the data loss prevention result.
12. The computing platform of claim 10 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, further cause the computing platform to:
detect input of a second target recipient domain into a second email message;
identify, in real time and prior to sending the second email message, that the second target recipient domain comprises the unintended recipient domain instead of the intended recipient domain;
determine that the data loss prevention result indicates that none of the one or more user defined rules are violated; and
based on determining that the data loss prevention result indicates that none of the one or more user defined rules are violated, route the second email message to the second target recipient domain.
13. The computing platform of claim 1 , wherein the notification includes an option to engage in email security compliance training.
14. The computing platform of claim 2 , wherein the identification further comprises:
identifying that the first context information does not match historical context information from historical messages between the message sender and the plurality of nearest neighbor recipients.
15. A method, comprising:
at a computing platform comprising at least one processor, a communication interface, and memory:
detecting input of a first target recipient domain into a first email message;
identifying, in real time and prior to sending the first email message, that the first target recipient domain comprises an intended recipient domain, wherein the identification comprises:
identifying, using a user graph, a plurality of nearest neighbor recipients for a message sender,
identifying, using a plurality of machine learning algorithms, first context information for the first email message, wherein identifying the first context information for the first email message comprises:
identifying, using latent Dirichlet allocation (LDA), one or more topics in the first email message,
identifying, using named entity recognition (NER), one or more named entities in the first email message, and
identifying, using text summarization, a predetermined number of most frequently used keywords in the first email message, and
identifying that the first context information is a first level match with historical context information from historical messages between the message sender and a message recipient, of the plurality of nearest neighbor recipients, corresponding to the first target recipient domain; and
sending, based on the identification of the intended recipient domain and to a user device of the message recipient, the first email message.
16. The method of claim 15 , further comprising:
detecting input of a second target recipient domain into a second email message;
identifying, in real time and prior to sending the second email message, that the second target recipient domain comprises an unintended recipient domain instead of the intended recipient domain, wherein the identification comprises:
identifying, using the user graph, the plurality of nearest neighbor recipients for the message sender,
identifying, using the plurality of machine learning algorithms, first context information for the second email message, and
identifying that the first context information does not match historical context information from historical messages between the message sender and the plurality of nearest neighbor recipients; and
sending, based on the identification of the unintended recipient domain and to a user device of the message sender, a notification that the first target recipient domain is flagged as the unintended recipient domain and one or more commands directing the user device to display the notification.
17. The method of claim 15 , further comprising:
detecting input of a second target recipient domain into a second email message;
identifying, in real time and prior to sending the second email message, that the second target recipient domain comprises a potentially unintended recipient domain instead of the intended recipient domain, wherein the identification comprises:
identifying, using the user graph, the plurality of nearest neighbor recipients for the message sender,
identifying, using the plurality of machine learning algorithms, second context information for the second email message,
identifying that the second context information is not the first level match with historical context information from historical messages between the message sender and a second message recipient corresponding to the second target recipient domain,
based on identifying that the second context information does not match the historical context information from the historical messages between the message sender and the second message recipient:
identifying whether a message recipient domain is included in the plurality of nearest neighbor recipients, and
identifying whether there is a second level match between the second context information and the historical context information from the historical messages between the message sender and the second message recipient; and
sending, based on an identification that the second message recipient is included in the plurality of nearest neighbor recipients and that there is the second level match between the second context information and the historical context information from historical messages between the message sender and the second message recipient, a second notification indicating that the second email message includes a new context for the second message recipient and one or more commands directing the user device to display the second notification, wherein the notification includes an option to correct the potentially unintended recipient domain or to send the second email message.
18. The method of claim 17 , further comprising:
based on an identification of one or more of: a) that the second message recipient is not included in the plurality of nearest neighbor recipients, or b) that there is not the second level match between the second context information and the historical context information from the historical messages between the message sender and the second message recipient:
identifying whether the second context information is a third level match with the historical context information from historical messages between the message sender and the plurality of nearest neighbor recipients; and
sending, based on an identification that the second context information is the third level match with the historical context information from the historical messages between the message sender and the plurality of nearest neighbor recipients:
a third notification indicating that the second email message includes: a) the new context for the second message recipient, and b) historical messages between the message sender and at least one of the plurality of nearest neighbor recipients, different than the second message recipient, includes the new context, and
one or more commands directing the user device to display the third notification, wherein the third notification includes the option to correct the potentially unintended recipient domain or to send the second email message.
19. The method of claim 18 , further comprising:
based on an identification that the second context information is not the third level match with the historical context information from the historical messages between the message sender and the plurality of nearest neighbor recipients:
identifying whether there is a fourth level match between the second context information and the historical context information from the historical messages between the message sender and the plurality of nearest neighbor recipients; and
based on identifying that there is the fourth level match between the second context information and the historical context information from the historical messages between the message sender and at least one of the plurality of nearest neighbor recipients:
generating a spelling mistake recommendation indicating a difference between the second target recipient domain and a domain of the at least one of the plurality of nearest neighbor recipients; and
sending, to the message sender, a fourth notification indicating the spelling mistake recommendation and one or more commands directing the user device to display the fourth notification, wherein the fourth notification includes the option to correct the potentially unintended recipient domain or to send the second email message.
20. One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:
detect input of a first target recipient domain into a first email message;
identify, in real time and prior to sending the first email message, that the first target recipient domain comprises an unintended recipient domain instead of an intended recipient domain, wherein the identification comprises:
identifying, using a user graph, a plurality of nearest neighbor recipients for a message sender,
identifying, using a plurality of machine learning algorithms, first context information for the first email message, wherein identifying the first context information for the first email message comprises:
identifying, using latent Dirichlet allocation (LDA), one or more topics in the first email message,
identifying, using named entity recognition (NER), one or more named entities in the first email message, and
identifying, using text summarization, a predetermined number of most frequently used keywords in the first email message, and
identifying that the first context information does not match historical context information from historical messages between the message sender and the plurality of nearest neighbor recipients; and
send, based on the identification of the unintended recipient domain and to a user device, a notification that the first target recipient domain is flagged as the unintended recipient domain and one or more commands directing the user device to display the notification.