Algorithm to detect malicious emails of pretending brands

Abstract

Techniques for an email security system to screen emails, extract information from emails, analyze information, assign probability scores to emails, and classify emails as likely to be fraudulent or non-fraudulent. The system may analyze the user's email and identify fraudulent emails by analyzing the content of the email. The system may evaluate the content of the email to determine probability score (s), which may further determine an overall probability score. The system may then classify the email as fraudulent or non-fraudulent, and may perform actions including shielding the email, allowing the email, tagging the email, etc. In some examples, the screened email may include legitimate brand domain addresses, names, images, URL (s), etc. However, the screened email may contain a reply domain address that matches the free email service provider domain. In this example, the email security system may assign a probability score indicating that the screened email is fraudulent.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. Patent Application No. 17 / 867,464 filed on July 18, 2022, which claims priority to Indian Provisional Patent Application No. 202241020887 filed on April 7, 2022, the entire contents of which are incorporated herein by reference. Technical Field

[0003] The present disclosure generally relates to techniques for an email security system to detect malicious emails impersonating a brand. Background Art

[0004] Electronic mail or "email" continues to be the primary method of exchanging messages between users of electronic devices. A number of email service providers have emerged that provide users with various email platforms to facilitate the communication of email via email servers that accept, forward, deliver and store messages for users. Email continues to be an important and fundamental method of communication between users of electronic devices because email provides users with an inexpensive, fast, accessible, efficient and effective way to transmit all kinds of electronic data. Email is well established as an everyday, dedicated means of communication for business communications, marketing communications, social communications, educational communications and many other types of communications.

[0005] Due to the widespread use and necessity of email, scammers and other malicious entities use email as a primary channel to attack users, such as through business email compromise (BEC) attacks, malware attacks, and malware-free attacks. These malicious entities continue to employ more frequent and sophisticated social engineering techniques to conduct deception and impersonation (e.g., phishing, spoofing, etc.). As users continue to become more recognizable to malicious attacks on email communications, malicious entities similarly continue to evolve and improve attack methods.

[0006] Therefore, email security platforms are provided by email service providers (and / or third-party security service providers) that attempt to identify and eliminate attacks on email communication channels. For example, cloud email services offer secure email gateways (SEGs) that monitor emails and implement pre-delivery protection by shielding email-based threats before they reach the mail server. These SEGs can scan incoming, outgoing, and internal communications for signs of malicious or harmful content, signs of social engineering attacks (such as phishing or compromised business emails), signs of data loss for compliance and data management, and other potentially harmful data communications. However, with the rapid increase in the frequency and sophistication of attacks, email service providers have difficulty maintaining their security mechanisms at the same rate as the rapidly changing scenarios of malicious attacks on email communications. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] The detailed description is given below with reference to the accompanying drawings. In the drawings, the leftmost (one or more) digits of a reference number indicate the drawing in which the reference number first appears. The same reference numerals are used in different drawings to indicate similar or identical items. The systems depicted in the drawings are not drawn to scale, and the components within the drawings may not be drawn to scale with each other.

[0008] Figure 1 A system architecture diagram of an example email security system that detects, assigns probability scores to, and classifies emails that indicate the likelihood of being fraudulent emails is shown.

[0009] Figure 2 A component diagram of an example email security system that detects, assigns probability scores to, and classifies emails that indicate the likelihood of being fraudulent emails is shown.

[0010] FIG. 3A to FIG. 3D A flow chart of an example method for an email security system to detect emails, assign probability scores, and use the probability scores to classify the emails as authentic emails or fraudulent emails is shown.

[0011] Figure 4 An example impersonation email probability determination sequence used by an email security system to detect fraudulent emails is shown.

[0012] Figure 5 An example of a fraudulent email detected by an email security system is shown.

[0013] Figure 6A flow chart is shown of an example method for an email security system to screen emails, analyze their content, and assign a probability score and classification indicating the probability of whether the screened emails are fraudulent.

[0014] Figure 7 is a computer architecture diagram showing an illustrative computer hardware architecture for implementing a computing device that can be used to implement aspects of the various techniques presented herein. DETAILED DESCRIPTION

[0015] Overview

[0016] Various aspects of the invention are set out in the independent claims and preferred features are set out in the dependent claims. Features of one aspect may be applicable to each aspect alone or in combination with the other aspects.

[0017] The present disclosure describes a technique for an email security system to detect an email and assign a probability score to the email, the probability score indicating the likelihood that the email is a fraudulent impersonation of a brand. A method for performing the technique described herein includes obtaining an email sent from a sending device to a receiving device at an email security system. The method may also include extracting from the email a first data representing a sender field of the email, a second data representing a uniform resource locator (URL) in the email, and a third data representing a reply address. In addition, the method may include determining a first probability value using the first data, the first probability value indicating a first likelihood that the sender field of the email impersonates a brand. In addition, the method may include determining a second probability value using the second data, the second probability value indicating a second likelihood that the URL in the email impersonates a brand. In addition, the method may include determining a third probability value using the third data, the third probability value indicating a third likelihood that the reply address in the email impersonates a brand; and determining an overall probability value using the first probability value, the second probability value, and the third probability value, the overall probability value indicating the overall likelihood that the email is a malicious email impersonating a brand.

[0018] Additionally, the techniques described herein may be performed by a system and / or device having a non-transitory computer-readable medium storing computer-executable instructions that, when executed by one or more processors, perform the methods described above.

[0019] Example Embodiments

[0020] The present disclosure describes a technique for an email security system to detect emails and assign a probability score to the email, which indicates the likelihood that the email is a fraudulent impersonation of a brand. The email security system can use rule-based analysis, discriminative analysis, probabilistic analysis, machine learning (ML) models, etc., to analyze the information contained in the email for the user by analyzing the metadata and / or content of the email, and identify fraudulent emails. The email security system can then assign a probability score of the filtered email indicating fraud based at least in part on the extracted and analyzed information. The email security system can then classify the filtered email as fraudulent or non-fraudulent based at least in part on the assigned probability score. The assigned probability score can be compared to a predetermined threshold value, which indicates a high likelihood of a fraudulent impersonation of a brand. In this way, the email security system is able to classify emails as fraudulent or authentic, and prevent potential malicious attacks on users.

[0021] Therefore, the email security system can monitor emails transmitted between users of the email platform or service to detect fraudulent emails, phishing emails, and / or other malicious emails. The email security system can screen the emails for monitoring and extract information for analysis. The email security system can extract meaningful metadata from the email to determine whether the email is a fraudulent email or a malicious email. Meaningful metadata may include, for example, the "From Field" address and / or brand name of the email, the "URL" address contained in the email, the "Reply-To Field" address and / or brand name of the email, the date / time the email was transmitted, the attachment of the email and / or the hash of the attachment, the URL in the email body and / or associated with the unsubscribe action, etc. In some instances, the metadata may additionally or alternatively include the content contained in the email body, the actual attachment of the email, and / or other data of the email that may be private or confidential. In addition, the metadata extracted from the email can generally be any verification information used by the email security platform to determine whether the email is potentially malicious.

[0022] The email security system may be configured to identify fraudulent emails, which are typically designed to impersonate a legitimate brand and are sent from an attacker to facilitate fraud. For example, an initial email may be sent from an attacker that includes a request for a target user to perform an action based on the type of fraud. For example, the initial email may request a gift card code, may request a wire transfer, may request a salary deposit into a different bank account, a list of unpaid invoices, W-2 details of (one or more) employees, sensitive information of customers, etc. Therefore, it may be necessary to process impersonated (e.g., fraudulent) emails to determine the legitimacy of the email.

[0023] In some instances, processing of the extracted metadata may be initiated to analyze the extracted metadata to determine a first probability score indicating the likelihood of a scam email, a phishing email, and / or other malicious email. The processing may include determining a display name from the “from field” of the email. Any determined display name may be further determined to be identified with a person and / or a legitimate brand (e.g., an organization). In addition, the processing may determine any personal and / or legitimate brand names contained within the image text in the associated file of the image from any extracted image metadata. The email security system may then determine from the extracted metadata whether a legitimate brand is found and whether the display name from the email matches a redundant legitimate brand name. In addition, the email security system may determine an address domain from the “from field” of the email. The processing performed by the email security system may determine whether the address domain matches a free email service. The address domain may also be compared to a legitimate brand name to determine similarity. In addition, the processing may make these determinations and combine them into a first probability score. These determinations may be equally weighted when considered together to determine the first probability score, or may have different weights.

[0024] In some other instances, processing of the extracted metadata may be initiated to analyze the extracted metadata to determine a second probability score indicating the likelihood of a scam email, a phishing email, and / or other malicious email. The processing may include determining a domain name from a "reply-to field" of the email. The domain name may be compared to a free email service to determine any similarities. Additionally, the domain name from the "reply-to field" may be compared to the address domain from the "from field" to determine any similarities. Furthermore, the processing may make these determinations and combine them into a second probability score. These determinations may be equally weighted when considered together to determine the second probability score, or may have different weights.

[0025] In some other instances, processing of the extracted metadata may be initiated to analyze the extracted metadata to determine a third probability score indicating the likelihood of a fraudulent email, a phishing email, and / or other malicious email. The processing may include determining any "URL" contained within the email. The processing may also include comparing the URL contained within the email with the address domain from the "from field" to determine any similarities. In addition, the processing may include determining any URL associated with an unsubscribe action contained within the email. Any URL associated with the unsubscribe action may be further compared with the URL found within the email, the address domain from the "from field", and any URL associated with the image text from the "from field" to determine any matches. In addition, the processing may make these determinations and combine them into a third probability score. These determinations may be equally weighted when considered together to determine the third probability score, or may have different weights.

[0026] In some other instances, processing of the extracted metadata may be initiated to analyze the extracted metadata to determine a fourth probability score indicating the likelihood of a fraudulent email, a phishing email, and / or other malicious email. The processing may include determining any owner (e.g., registrant, etc.) and / or legal brand associated with the WHOIS and / or (one or more) certificates obtained from the extracted metadata of the email. The processing may include locating any corresponding WHOIS and / or certificates from the extracted metadata. In addition, the processing may include determining any associated owner from the corresponding WHOIS and / or certificates. In addition, the processing may determine any legal brand associated with the determined owner. In addition, the processing may compare the extracted metadata with any determined legal brand associated with the owner, and determine any similarities. In addition, the processing may make these determinations and combine them into a fourth probability score. These determinations may be equally weighted when considered together to determine the fourth probability score, or may have different weights.

[0027] The email security system can be configured to process one or more probability scores to determine a final probability score. The final probability score can be determined by weighting one or more probability scores equally, or assigning different weights to them, to consider together and determine the final probability score. The final probability score can then be assigned a classification indicating that the email is a fraudulent email or a malicious email. In this way, the classification can be based on exceeding a predetermined threshold. For example, the predetermined threshold can be assigned a threshold probability value of 0.75. In this way, the final probability score that exceeds the threshold probability score can present the classification of fraudulent emails to the processed emails.

[0028] The processing described above is merely an example of one possible method for determining a final probability score. In some instances, (one or more) machine learning (ML) models may be trained and used to determine the final probability score from the extracted metadata. In some other instances, the processing may compare the extracted metadata to a store of (one or more) valid domains, saved brand probabilities, (one or more) saved past fraudulent emails, etc. Additionally, the foregoing should not be construed as limiting, and it is understood that additional processing methods may be apparent to those skilled in the art.

[0029] After initially classifying the fraudulent emails based on the final probability scores, the email security system can further classify the fraudulent emails into different categories from a set of fraudulent email categories. For example, the fraudulent emails can be classified into one or more of the following: gift card fraud category, wire transfer fraud category, payroll account fraud category, invoice fraud category, account acquisition fraud category, phone fraud category, W-2 fraud category, aging report fraud category, mergers and acquisitions fraud category, executive forgery fraud category, attorney fraud category, tax client fraud, initial solicitation or rapport fraud category, etc. The email security system can utilize a secondary classification scan using email policies.

[0030] Once a fraudulent email is detected and classified into its corresponding category, it will be isolated and not sent to the target user's inbox. In addition, metadata extracted from the fraudulent email can be placed in a storage device. For example, the fraudulent email can be stored in a storage device that saves (one or more) past fraudulent emails. In addition, the metadata and / or subsequent processing can be used to train (one or more) ML models. In addition, at least a portion of the metadata extracted from the email can be retained (e.g., saved) to the storage device. For example, the impostor brand name extracted from the email can be stored in the saved brand possibilities. In some other instances, (one or more) legitimate domains extracted from the email can be stored in a storage device under a valid domain. In addition, other information from the metadata can be stored in a series of different ways, which are the same and / or similar to those described and implied herein, and / or are obvious to those skilled in the art.

[0031] The fraudulent email is quarantined, and the email security system can block any further communications received from the sender and / or further communications that share similarities with the fraudulently classified filtered email. The email security system can implement various additional remedial actions. Remedial actions can include collecting attacker information for additional detection rules, blocking fraudulent emails, reporting attacker information to authorities, etc.

[0032] Although the systems and techniques described herein are generally applied to any type of malicious, impersonated emails, fraudulent emails (typically BEC attacks) are significant threats that can be detected and mitigated according to the techniques described herein. BEC fraudulent emails include various types or categories, such as wire transfer fraud, gift card fraud, salary fraud, invoice fraud, acquisition fraud, aging report fraud, telephone fraud, W-2 fraud categories, aging report fraud categories, merger and acquisition fraud categories, executive forgery fraud categories, lawyer fraud categories, tax client fraud, initial inducement or rapport fraud categories, etc. In some instances, fraudulent attacks cause the attacked organization or individual to lose money or other financial resources. Additionally or alternatively, the attacked organization or individual may lose valuable information, such as trade secrets or other information. These types of fraud are typically multi-stage attacks. Typically, in the first stage, the attacker sends a fake email to the victim, who is typically a manager or employee in the organization. The fake email can impersonate a real person, who is also a legitimate employee of the organization, to establish a rapport and official tone to the message. The fake emails may accordingly or alternatively impersonate the brand, and the emails themselves may be complex structures including real domains and / or hyperlinks that lead to the actual brand in an attempt to legitimize the email while requesting actions that lead to the fraudulent domains and / or hyperlinks. Once the victim succumbs to the fraud and follows the instructions found in the fraudulent email, the victim transfers money to the attacker either in the form of a transfer to a bank account or a gift card voucher sent to an email address.

[0033] The term "brand" as used and implied herein may be interchangeable with the terms "organization," "legal business," etc. Brand may also mean "business," "collaboration," "government," "agency," "organization of any type of people," "entity representing a group of people," etc. In addition, brand may also mean an intangible marketing and / or business concept that helps individuals identify the legitimacy of the brand, company, person, collaboration, etc., with which the brand is associated.

[0034] Some of the techniques described herein refer to fraudulent emails. However, these techniques are generally applicable to any type of malicious email. As described herein, the term "malicious" can be applied to data, actions, attackers, entities, emails, etc., and the term "malicious" can generally correspond to spam, phishing, deception, malware, viruses, and / or any other type of data, entity, or action that can be considered or viewed as unwanted, negative, harmful, etc. to a recipient and / or destination email address associated with an email communication.

[0035] Certain embodiments and examples of the present disclosure will now be described more fully below with reference to the accompanying drawings, in which various aspects are shown. However, various aspects may be implemented in many different forms and may not be understood to be limited to the embodiments set forth herein. As described herein, the present disclosure encompasses variations of the embodiments. Similar reference numerals refer to similar elements throughout.

[0036] Figure 1 A system architecture diagram 100 of an example email security system 102 is shown that detects, assigns probability scores to, and classifies emails that indicate the likelihood of being fraudulent emails.

[0037] In some instances, the email security system 102 may be a scalable service including devices housed or located in one or more data centers and / or running on the devices, which may be located in different physical locations. In some examples, the email security system 102 may be included in an email platform and / or associated with a secure email gateway platform. The email security system 102 and the email platform may be supported by a network of devices in a public cloud computing platform, a dedicated / enterprise computing platform, and / or any combination thereof. One or more data centers may be physical facilities or buildings located in a geographic area that are designated to store networked devices that are part of and / or support the email security system 102. The data center may include: various networked devices, as well as redundant or backup components and infrastructure for power supply, data communication connections, environmental control, and various security devices. In some examples, the data center may include one or more virtual data centers, which are cloud infrastructure resource pools or collections designed specifically for enterprise needs and / or cloud-based service provider needs. In general, a (physical and / or virtual) data center may provide basic resources such as processors (CPUs), memory (RAM), storage devices (disks), and networking (bandwidth).

[0038] The email security system 102 can be associated with an email service platform, which can generally include any type of email service provided by any provider, including public email service providers (e.g., Google Gmail, Microsoft Outlook, Yahoo! Mail, AIL, etc.), and a dedicated email service platform maintained and / or operated by a dedicated entity or enterprise. In addition, the email service platform can include a cloud-based email service platform (e.g., Google G Suite, Microsoft Office 365, etc.) that hosts email services. However, the email service platform can generally include any type of platform for managing email communications between clients or users. The email service platform can generally include a delivery engine behind the email communication, and includes software and hardware necessary for delivering email communications between users. For example, an entity can operate and maintain the software and / or hardware of the email service platform to allow users to send and receive emails, store and view emails in an inbox, manage and segment contact lists, establish email templates, manage and modify inboxes and folders, schedule, and / or any other operation performed using the email service platform.

[0039] The email security system 102 may be included in or associated with the email service platform. For example, the email security system 102 may provide security analysis for emails transmitted by the email service platform (e.g., as a secure email gateway). In addition, the second computing infrastructure may include different domains and / or resource pools for hosting the email service platform.

[0040] The email service platform can provide one or more email services to users of user devices to enable user devices to transmit emails. The sending device 104 can communicate with the receiving device 106 through one or more networks 108 (e.g., the Internet). In some instances, (one or more) networks 108 generally may include one or more networks implemented by any feasible communication technology (e.g., wired and / or wireless methods and / or technologies). (One or more) networks 108 may include any combination of the following items that are centralized and / or distributed: personal area network (PAN), local area network (LAN), school area network (CAN), metropolitan area network (MAN), extranet, intranet, Internet, short-range wireless communication network (e.g., ZigBee, Bluetooth, etc.), wide area network (WAN), and / or may include any combination, arrangement and / or aggregation of these items. (One or more) networks 108 may include devices, virtual resources or other nodes that relay packets from one device to another device.

[0041] As shown, the user device may include a sending device 104 for sending an email and a receiving device 106 for receiving an email. The sending device 104 and the receiving device 106 may include any type of electronic device capable of communicating using email communications. For example, the device 104 / 106 may include one or more different personal user devices, such as a desktop computer, a laptop computer, a phone, a tablet, a wearable device, an entertainment device (e.g., a television), and / or any other type of computing device. Therefore, the user device 104 / 106 may communicate using an email service platform using an email address domain name system based email according to techniques known in the art.

[0042] The email service platform can receive emails destined for a receiving device 106, which can access an inbox associated with a destination email address managed or provided by the email service platform. That is, emails (including allowed emails 110) are transmitted to one or more recipient servers of the email service platform via (one or more) networks 108, and the email service platform determines which registered user the email is for based on the email information (e.g., "To", "Cc", "Bcc", etc.). In instances where the user of the receiving device 106 has registered to use the email security system 102, the organization that manages the user device 104 / 106 has registered to use the email security system 102, and / or the email service platform itself has registered to use the email security system 102, the email service platform can provide appropriate emails to the front end for pre-processing of the security analysis process.

[0043] In general, the email security system 102 can perform at least metadata extraction techniques on the email, and in some instances can also perform content pre-classification techniques on the email. The types of metadata that can be scanned for and extracted by the email security system 102 include an indication of the "reply-to field" email address(es), the "from field" email address(es), the "image" information of the email, the "subject" of the email, the date / time associated with the communication of the email, the uniform resource locator (URL) or other link in the email, the attachment file, the hash of the attachment, the fuzzy hash extracted from the message body of the email, the indication of the content from the email body, etc. In general, users of the email service platform and / or email security platform can define what information is permitted to be scanned and / or extracted from the email, and what information is too private or confidential to be scanned and / or extracted from the email.

[0044] When extracting metadata (or "features") from emails to be used for security analysis, the email security system 102 can perform security analysis on the email metadata using techniques such as security policies defined for the email security platform. The security policy can be defined or created by the email security system 102 for detecting potential malicious emails, and / or defined and / or created by an administrator or other user of the email security system 102. The email security system 102 can analyze the email metadata with reference to the security policy to determine whether the email metadata violates one or more security policies indicating that the corresponding email is potentially malicious. In some instances, a fake email probability ranking can be developed to identify malicious emails based on different words, patterns, and / or other information included in the email. As another example, emails can be used to train (one or more) ML models, where malicious emails are marked as malicious, and benign or normal emails are marked as benign. (One or more) ML models and / or fake email probability rankings can output the probability that the email is malicious, or can simply output a positive or negative result as to whether the email is malicious.

[0045] Email security system 102 can analyze and detect non-malicious or allowed emails 110 and permit allowed emails 110 to be transmitted between user devices 104 / 106. In some instances, email security system 102 analyzes an email and detects that the email is actually a malicious email, such as a fraudulent email.

[0046] As shown, the email security system 102 can initiate a fraud detection process 112 to detect a filtered email 114 sent from a sending device 104 (e.g., an attacker) to a receiving device 106 (e.g., a target, a victim, etc.) at "1". After detecting the filtered email 114, the email security system 102 can extract information from the "sender field", any "URL" information, information from the "reply field", etc. of the filtered email 114 from the filtered email 114 at "2". The email security system can utilize a secondary classification scan using an email policy. The filtered email 114 can be tested at "3" according to an algorithm (e.g., a model) (e.g., (one or more) natural language processing (NLP) models) to classify the filtered email 114 into a specific category. (One or more) NLP models analyze the collected information of the fraudulent email and assign a probability score to the fraudulent email at "4".

[0047] In the example shown, the filtered email 114 is a request to send a monetary payment in the amount of $149.99 to the target user. The attacker may have impersonated the name of an "actual brand" that the victim may be familiar with and is permitted to request this type of payment, and pretended to act on behalf of the brand, in this case, directing the victim to pay via a reply to a "PAY NOW" domain. As shown, the reply address associated with the "PAY NOW" call to action appears legitimate and contains elements (e.g., words) associated with the impersonated brand.

[0048] As shown, the email security system 102 can calculate (one or more) probability scores associated with the email at "4". After testing the collected information using the algorithm at "3", one or more probability scores can be determined. For example, probability scores can be independently determined for information collected from the "Sender Field", any "URL" information, information from the "Reply Field", etc. In some instances, multiple independently assigned probability scores can be further combined into a "final probability score" that represents the overall probability score of the email. The "final probability score" can be an average of one or more probability scores, a weighted average, and / or any other combination method that can be understood by those skilled in the art.

[0049] In the example shown, four separate probability scores are assigned to the filtered email 114. After analyzing the "From Field", a probability score of 0.80 is determined by the algorithm at "3". Additionally, the algorithm determines a probability score of 1.0 for the "URL" at "3", a score of 0.80 for the "Reply Field", and a score of 0.87 as the "Final Probability Score".

[0050] After calculating the probability score at "4" and assigning it to the filtered email 114, the email security system 102 can classify the filtered email 114 as fraudulent or non-fraudulent at "5". Classifying the filtered email 114 as fraudulent can be achieved by comparing the probability score (e.g., the "final probability score") to a predetermined threshold. In some examples, the predetermined threshold can be assigned a value of 0.75. In such an example, a probability score that exceeds the threshold can result in the email being classified as fraudulent. In this way, the classification as fraudulent can ensure that the email 114 is not sent to the receiving device 106 on which the victim is reading the email.

[0051] In the example shown, the filtered email 114 receives a "Final Probability Score" of 0.87 as the average of the probability scores determined for the "From Field," "URL," and "Reply-To Field." Thus, the "Final Probability Score" of 0.87 exceeds the threshold of 0.75, and the filtered email 114 is classified as a fraudulent email at "5."

[0052] Figure 2 A component diagram 200 of an example email security system 102 for detecting emails indicating the likelihood of fraudulent emails, assigning probability scores thereto, and classifying them is shown. As shown, the email security system 102 may include one or more hardware processors 202 (processors), one or more devices configured to execute one or more stored instructions. The (one or more) processors 202 may include one or more cores. In addition, the email security system 102 may include one or more network interfaces 204, which are configured to provide communication between the email security system 102 and other devices (e.g., (one or more) sending devices 104, receiving devices 106, and / or other systems or devices associated with an email service that provides email communications). The network interface 204 may include a device configured to couple to a personal area network (PAN), a wired and wireless local area network (LAN), a wired and wireless wide area network (WAN), etc. For example, the network interface 204 may include a device compatible with Ethernet, Wi-Fi™, etc.

[0053] The email security system 102 may also include a computer readable medium 206 storing various executable components (e.g., software-based components, firmware-based components, etc.). The computer readable medium 206 may store components for implementing the functionality described herein. Although not shown, the computer readable medium 206 may store one or more operating systems for controlling the operation of one or more devices including the email security system 102. According to one example, the operating system includes a LINUX operating system. According to another example, the operating system(s) include a UNIX operating system from MICROSOFT Corporation of Redmond, Washington. SERVER operating system. According to further embodiments, the operating system(s) may include a UNIX operating system or one of its variants. It should be understood that other operating systems may also be utilized.

[0054] The computer-readable medium 206 may include portions or components that configure the email security system 102 to perform various operations described herein. For example, when executed by (one or more) processors 202, the sender field analysis component 208 may be configured to perform various techniques for analyzing specific email information to determine a probability score indicating fraud. The sender field analysis component 208 may utilize policies or rules to analyze email metadata to determine whether the corresponding email is malicious. The sender field analysis component 208 may perform various types of security analysis techniques, such as determining whether one or more of the following "display name" and "sender (From)", "recipient (To)", "copy (Cc)" and / or "blind copy (Bcc)" email addresses are associated with a legitimate brand name, email address and / or email domain and / or a free email service email address and / or email domain.

[0055] The computer-readable medium 206 may also include a URL analysis component 210 that configures the email security system 102 to perform various operations described herein. For example, when executed by the processor(s) 202, the URL analysis component 210 may be configured to perform various techniques for analyzing specific email information to determine a probability score indicating fraud. The URL analysis component 210 may utilize policies or rules to analyze email metadata to determine whether a corresponding email is malicious. The URL analysis component 210 may perform various types of security analysis techniques, such as determining whether one or more of the following "URLs" and / or "Unsubscribe URLs" are associated with (one or more) legitimate brand URLs.

[0056] The computer-readable medium 206 may also include a reply analysis component 212 that configures the email security system 102 to perform various operations described herein. For example, when executed by the processor(s) 202, the reply analysis component 212 may be configured to perform various techniques for analyzing a particular email message to determine a probability score indicative of fraud. The reply analysis component 212 may utilize policies or rules to analyze email metadata to determine whether a corresponding email is malicious. The reply analysis component 212 may perform various types of security analysis techniques, such as determining whether the "to" email address(es) is associated with a legitimate brand name, email address and / or email domain, and / or a free email service email address and / or email domain.

[0057] The computer-readable medium 206 may also include a WHOIS / certificate analysis component 214 that configures the email security system 102 to perform various operations described herein. For example, when executed by the processor(s) 202, the WHOIS / certificate analysis component 214 may be configured to perform various techniques for analyzing specific email information to determine a probability score indicating fraud. The WHOIS / certificate analysis component 214 may utilize policies or rules to analyze email metadata to determine whether a corresponding email is malicious. The WHOIS / certificate analysis component 214 may perform various types of security analysis techniques, such as cross-referencing associated WHOIS and / or certificate information via a name, email address, and / or email domain to determine whether one or more of the following "display name" and "from," "to," "cc," "bcc," "reply-to field" information, URL(s) contained within the email, domain contained within the email, and / or email address contained within the email is associated with a legitimate brand owner.

[0058] The computer-readable medium 206 may also include an image analysis component 216 that configures the email security system 102 to perform various operations described herein. For example, when executed by the processor(s) 202, the image analysis component 216 may be configured to perform various techniques for analyzing specific email information to determine a probability score indicative of fraud. The image analysis component 216 may utilize policies or rules to analyze email metadata to determine whether a corresponding email is malicious. The image analysis component 216 may perform various types of security analysis techniques, such as determining whether one or more of the extracted metadata associated with an image included in an email is associated with a legitimate brand name, email address, and / or email domain.

[0059] The computer-readable medium 206 may also include a final probability and classification component 218 that configures the email security system 102 to perform various operations described herein. For example, when executed by the processor(s) 202, the final probability and classification component 218 may be configured to perform various techniques for averaging the probability scores determined from the components 208 to 216 to determine a final probability score indicating fraud. The final probability and classification component 218 may utilize any of different types of averaging methods including determining a mean, a median, a weighted average, a mode, etc. The final probability and classification component 218 may then compare the resulting final probability score to a predetermined threshold to classify the email as likely to be fraudulent. As described and suggested herein, a final probability score that exceeds the predetermined threshold may indicate a fraudulent email classification.

[0060] The above component list and its corresponding processing are merely exemplary, and other types of security policies may be used to analyze email metadata. The final probability and classification component 218 may then use the (one or more) policies stored in the storage device 220 to generate result data indicating the security analysis results of the email metadata.

[0061] In addition, the email security system 102 may include a storage device 220, which may include one or more repositories or other storage locations for permanently storing and managing data collections such as databases, simple files, binary data, and / or any other data. The storage device 220 may include one or more storage locations that may be managed by one or more storage / database management systems.

[0062] As shown, storage 220 may include valid domain(s) 222, ML model(s) 224, stored brand likelihoods 226, impersonated email probabilities 228, and stored fraudulent email(s) 230. It should be understood that the above list is merely exemplary and that storage 220 may include additional elements that will be apparent to one skilled in the art.

[0063] The valid domain(s) 222 may include a database of domains determined to be valid (e.g., non-fraudulent domains). For example, domains associated with allowed emails 110 may be included in the valid domain(s) 222. The valid domain(s) 222 may include manually entered domains, domains determined to not meet a predetermined threshold, domains associated with legitimate brands, domains determined by the ML model(s) 224, and the like.

[0064] The ML model(s) 224 may include a database of machine learning algorithms. The ML model(s) may include one or more algorithms including supervised, semi-supervised, unsupervised, and / or brute-force. In some examples, the processor(s) 202 trains the email security system 102 using machine learning techniques, statistical analysis, or any other means by which the system can be trained to output fraudulent email detections based on input associated with the filtered email 114 information, established operating parameters from the computer-readable medium 206, and / or production data associated with the storage device 220.

[0065] The saved brand possibilities 226 may include a database of domains and / or lists of executives (e.g., owners, CEO(s), executives, etc.) found to be associated with legitimate brands. The database may be formed as a historical compilation of legitimate brands found from historical use of the email security system 102.

[0066] The fake email probability 228 can store the results and / or timeline of events from the final probability and classification component 218. Additionally or alternatively, the fake email probability 228 can be a database of historical calculation results. In this way, the final probability and classification component 218 can use the fake email probability 228 during its operation.

[0067] The saved fraudulent email(s) 230 may be a database of saved historically classified fraudulent email(s). Thus, the final probability and classification component 218 may use the saved fraudulent email(s) 230 during its operation. For example, the final probability and classification component 218 may reference the saved fraudulent email(s) 230 to determine the similarity between the filtered email 114 and the previously classified fraudulent email.

[0068] As described and suggested herein, the final probability and classification component 218 can classify the email as fraudulent by comparing with a threshold, where the probability score exceeds the threshold. In some instances, the email determined to be fraudulent can also be stored in (one or more) saved fraudulent emails 230 of the storage device 220.

[0069] Figure 3A A flow chart of an example method 300 for extracting information and / or data from a "from field" of a screened email 114 of an email security system that is also configured to detect emails, assign probability scores, and classify the emails as authentic emails or fraudulent emails using the probability scores. The email security system 102 can monitor emails transmitted between users of an email platform or service to detect fraudulent emails, phishing emails, and / or other malicious emails.

[0070] At 302, a sender field analysis component (hereinafter referred to as "FF component") 208 can identify sender field information of a scanned email 114. The FF component 208 can use text recognition, (one or more) NLP models, predetermined field analysis, etc. to identify the sender field information.

[0071] At 304, the FF component 208 can determine a display name from the scanned email 114. For example, the FF component 208 can be directed to a portion of the scanned email 114 detailing a display name associated with the scanned email 114. In some other examples, the FF component 208 can determine a display name of a From field of the scanned email 114 using text recognition and / or NLP model(s).

[0072] At 306, FF component 208 can determine whether the display name is a person. For example, FF component 208 can compare the display name to a name lookup table contained in storage device 220, and / or can perform an Internet search to determine the CEO name. In some other instances, FF component 208 can utilize (one or more) ML model 224 to determine whether the display name is a person. In some other instances, FF component 208 can compare the display name to saved brand possibilities 226, where a match can indicate that the display name is not a person.

[0073] If it is determined that the display name is a person (ie, “yes” at operation 306 ), the method 300 may proceed to operation 308 .

[0074] At 308, FF component 208 can determine whether the display name matches the CEO. For example, FF component 208 can compare the display name to a lookup table of CEO names contained in storage device 220, and / or can perform an Internet search to determine the CEO name. In some other instances, FF component 208 can utilize (one or more) ML models 224 to determine whether the display name matches the CEO of a legitimate brand. In some other instances, FF component 208 can compare the display name to saved brand possibilities 226, where the CEO name can be stored, and where a match can indicate that the display name matches the associated CEO.

[0075] If it is determined that the display name is not a person (i.e., "No" at operation 306), method 300 may proceed to operation 310. Additionally, if it is determined that the display name matches a CEO name associated with a legitimate brand (i.e., "Yes" at operation 308), method 300 may also proceed to operation 310.

[0076] At 310, the FF component 208 and / or the image analysis component (hereinafter referred to as the "IA component") 216 can determine any organizations (i.e., brand name(s)) from the display name determined at operation 304. In some instances, the FF component 208 and / or the IA component 216 can determine any organizations from the CEO name match determined at operation 308. The FF component 208 and / or the IA component 216 can also determine any organizations contained within any image file text found within the filtered email 114. The FF component 208 and / or the IA component 216 can use text recognition and / or (one or more) NLP models to determine text associated with the organization name. In other instances, the FF component 208 and / or the IA component 216 can compare the image file text to the valid domain 222 contained within the storage device 220, the (one or more) ML model(s), and / or the saved brand likelihood 226. In some other instances, the FF component 208 and / or the IA component 216 may utilize the network 108 to compare the image file text to a lookup table, an organizational search match, an Internet search, or the like.

[0077] At 312 , method 300 may determine whether an organization name has been found from the determination and / or information found at operation 310 .

[0078] If it is determined that the organization is not found (ie, “NO” at operation 312 ), the method 300 may proceed to operation 314 .

[0079] At 314, the FF component 208 can determine any (one or more) image files. The FF component 208 can identify images contained in the filtered email 114 and access files associated with the images. In some instances, one or more images may be contained in the filtered email 114. In this way, the FF component 208 can determine the file of the image. In some other instances, the filtered email 114 may not contain an image. In this way, the FF component 208 can determine that there is no image file and can move to the next operation. In some instances, at operation 314, the FF component 208 can determine (one or more) image files, one image file at a time. In some other instances, the FF component 208 can determine an image file and move to the next operation before returning to determine any subsequent image files contained in the filtered email 114.

[0080] At 316, the FF component 208 can determine whether the image(s) within the filtered email 114 have been checked and whether any image(s) remain unchecked. For example, as described and suggested herein, the method 300 can determine any image(s) contained within the filtered email 114 one at a time. In some other instances, the method 300 can determine any image(s) contained within the filtered email 114 at a time. In any case, at operation 316, the method 300 can determine whether the FF component 208 has checked each image within the filtered email 114.

[0081] If it is determined that at least one image within the filtered email 114 has not yet been examined (ie, “NO” at operation 316 ), the method 300 may proceed to operation 318 .

[0082] At 318, the FF component 208 can determine the text (txt) contained in the image file determined at operation 314. For example, the FF component 208 can use Tesseract OCR software to perform optical character recognition (OCR) on the text corpus. In some other instances, the FF component 208 can use TensorFlow, OpenCV, Google Cloud Vision API, Amazon Rekognition, and / or any other suitable method for determining the txt contained in any image file. The method 300 can return to operation 310 from operation 318.

[0083] At 320, the FF component 208 can determine the sender address field. For example, the FF component 208 can be directed to a portion of the scanned email 114 that details a display name associated with the scanned email 114. In some other examples, the FF component 208 can use text recognition and / or NLP to determine the display name of the sender field of the scanned email 114.

[0084] After operation 320, the method 300 may proceed to operation 322. Additionally, if it is determined that the CEO check does not match the individual identified within the display name (ie, "no" at operation 308), the method 300 may proceed to operation 322.

[0085] At 322, the FF component 208 can compare the sender address domain determined at operation 320 to determine whether the sender field domain address matches any free email service domain. For example, the FF component 208 can determine at operation 320 that the sender address domain is "from@realbrand.com". The FF component 208 can determine at operation 322 that the domain (i.e., "@realbrand.com") does not match any free email service domain (e.g., "@gmail.com", "@yahoo.com", "@hotmail.com", etc.). In addition, the method 300 can compare the name and / or display name of the individual determined not to match the CEO at operation 308 in a manner similar and / or the same as described and implied above to determine whether the display name matches any free email service domain. In this way, the method 300 can proceed to the next operation.

[0086] Determining that the sender address domain determined at operation 320 does not match any free email service domain (ie, “no” at operation 322 ) may cause method 300 to proceed to operation 324 .

[0087] At 324, the FF component 208 of the method 300 can determine whether the information matches any marketing email service domains and / or names from the information used at operation 322. For example, the method can compare the information to email marketing services including "HubSpot", "Omnisend", "AWeber", "Drip", etc.

[0088] If it is determined that the compared information at operation 324 does not match any marketing email services (ie, "No" at operation 324), method 300 may proceed to operations 326, 328, and 334 (discussed in further detail below).

[0089] At 326, the FF component 208 can determine the associated whois database from the information collected at operations 304 and / or 320. The FF component 208 can collect the registrant organization name and whois age data from the whois database.

[0090] At 328, the FF component 208 may determine an associated secure socket layer (SSL) certificate from the information collected at operations 304 and / or 320. The FF component 208 may collect the organization name details from the SSL certificate.

[0091] At 330, the FF component 208 may determine any organization (i.e., brand name(s)) from the display name determined at operation 304 and / or the address domain determined at 320 and the whois information determined at operation 326 and / or the certificate information determined at operation 328. The FF component 208 may use text recognition and / or NLP model(s) to determine the text associated with the organization name. In other examples, the FF component 208 may compare the information collected at operations 304, 320, 326, and / or 328 to the valid domain 222, ML model(s), and / or saved brand likelihood 226 contained in the storage device 220. In some other examples, the FF component may compare the information collected at operations 304, 320, 326, and / or 328 to a lookup table, an organization search match, an Internet search, etc. using the network 108.

[0092] After completing operation 330, method 300 may proceed to operation 332. Additionally, if it is determined that the tissue is found (ie, "yes" at operation 312), method 300 may also proceed to operation 332.

[0093] At 332, the FF component 208 can determine by comparison whether the information that naturally progresses from operations 304 and 320 matches the organization name. For example, the method 300 determines at operation 312 that the organization is found. Thus, the FF component 208 can search the saved brand possibilities 226 and determine whether the organization found at operation 312 matches the legitimate brand. In some other instances, the FF component 208 can compare the organization found at operation 312 with the valid domain 222, (one or more) ML models 224, the impostor email probability 228, and / or the saved fraudulent email 230. In some other instances, the FF component 208 can perform an Internet search to determine whether the organization determined at operation 312 matches the legitimate brand. In addition, at operation 332, the method 300 can determine whether the organization name determined at operation 330 matches the legitimate brand. Thus, the FF component 208 can determine whether a match exists using the same and / or similar process as described and suggested above and / or herein and / or apparent to those skilled in the art.

[0094] If it is determined that the organization name does not match a legitimate brand (i.e., "No" at operation 332), method 300 may continue to operation 334. Additionally, if it is determined that the compared information at operation 324 does not match any marketing email service (i.e., "No" at operation 324), method 300 may proceed to operation 334.

[0095] At 334, the FF component 208 can perform a whitelist check on the sender address domain that was determined at operation 320 and determined to not be associated with a free email service or a marketing email service at operations 322 and 324, respectively. For example, the whitelist can include a list of email addresses, IP addresses, domain names, applications, etc. that are designated as approved. In this way, the whitelist can automatically block and / or mark any of the above-mentioned list items.

[0096] At 336, the FF component 208 can determine the similarity between the sender address domain and the whitelist entry. The FF component 208 can use similarity logic, which can include (one or more) ML models 224, mathematical probabilistic similarity logic (PSL), etc., or similarity logic that is obvious to those skilled in the art.

[0097] At 338, the FF component 208 can determine the domain name randomness. For example, the FF component 208 can use (one or more) ML models 224, detection algorithms, etc. For example, the FF component 208 can utilize a high entropy Domain Name System (DNS) query using a URL Toolbox Shannon Entropy Calculator, etc. In this way, the calculator can determine an entropy score for a given query. In addition, a predetermined entropy score can be set, wherein an entropy score for a given query exceeding a predetermined entropy score can indicate an algorithmically generated domain address (e.g., indicating a domain address generated in a fraudulent manner).

[0098] After operation 338, method 300 may proceed to Figure 3D Operation 356 is described in more detail in .

[0099] Accordingly or alternatively, another operation may intervene in the process to operation 356, where the brand (i.e., organization) name(s) determined to this point may be saved. In some instances, the brand name(s) may be saved to the saved brand possibilities 226 of the storage device 220. In some other instances, the brand name(s) may be saved to a cloud storage device, other computing device, other storage device, etc., and may be transmitted to any such device via the network 108. In some other instances, the determined brand name(s) may be used to train the ML model(s).

[0100] Figure 3BA flow chart of an example method 300 for extracting information and / or data from a "reply-to field" of a screened email 114 of an email security system that is also configured to detect emails, assign probability scores, and classify the emails as authentic emails or fraudulent emails using the probability scores. The email security system 102 can monitor emails transmitted between users of an email platform or service to detect fraudulent emails, phishing emails, and / or other malicious emails.

[0101] At 340, the reply field analysis component (hereinafter referred to as "RT component") 212 can identify reply field information of the scanned email 114. The RT component 212 can use text recognition, NLP model(s), predetermined field analysis, etc. to identify the reply information.

[0102] At 342, the RT component 212 can determine a reply domain. For example, the RT component 212 can be directed to a portion of the scanned email 114 that details a reply domain associated with the scanned email 114. In some other examples, the RT component 212 can determine the domain of the reply field of the scanned email 114 using text recognition and / or NLP model(s).

[0103] At 344, the RT component 212 can compare the reply domain determined at operation 342 to determine whether the reply domain address matches any free email service domains. For example, the RT component 212 can determine at operation 342 that the reply address domain is "from@realbrand.com". The RT component 212 can determine at operation 344 that the domain (i.e., "@realbrand.com") does not match any free email service domains (e.g., "@gmail.com", "@yahoo.com", "@hotmail.com", etc.). In this way, the method 300 can proceed to the next operation.

[0104] Determining that the reply domain determined at operation 342 does not match any free email service domain (ie, “no” at operation 344 ) may cause method 300 to proceed to operation 346 .

[0105] At 346, the RT component 212 can determine any similarities between the reply address domain found at operation 342 and the sender field address domain determined at operation 320. For example, if both the sender field address domain and the reply field address domain are similar, this may suggest that the email is unlikely to be fraudulent. Alternatively, in instances where the sender field address domain and the reply field address domain are not similar, this may indicate that the email is fraudulent.

[0106] After operation 344 or determining that the reply domain matches the free email service domain (i.e., "yes" at operation 344), method 300 may proceed to operation 358 to Figure 3D Operation 358 is described in more detail in .

[0107] Figure 3C A flow chart of an example method 300 for extracting any "URL" information and / or data of a filtered email 114 of an email security system that is also configured to detect emails, assign probability scores, and classify the emails as authentic emails or fraudulent emails using the probability scores. The email security system 102 can monitor emails transmitted between users of an email platform or service to detect fraudulent emails, phishing emails, and / or other malicious emails.

[0108] At 348, the URL analysis component (hereinafter referred to as "URL component") 210 can identify any (one or more) URLs contained within the scanned email 114. The URL component 210 can use text recognition, (one or more) NLP models, predetermined field analysis, etc. to identify any (one or more) URLs.

[0109] At 350, the URL component 210 may compare the identified URL(s) within the screened emails 114 to the sender address domain determined at operation 320 and determine if any matches exist.

[0110] At 352, the URL component 210 can determine whether there are any unsubscribe actions and / or language with associated and / or integrated URLs. The URL component 210 can use text recognition, (one or more) NLP models, and / or any other applicable process to identify and determine whether there are any unsubscribe actions and / or language with associated and / or integrated URLs.

[0111] If it is determined that there are any unsubscribe actions and / or languages ​​with associated and / or integrated URLs (ie, “yes” at operation 352 ), the method 300 proceeds to operation 354 .

[0112] At 354, the URL component 210 can determine any matching URLs determined from operation 350 and / or operation 352. Thus, the URL component 210 can determine the number of matching URLs, the number of unmatched URLs, and / or the total number of URLs at operation 354. In some other examples, the URL component 210 can also determine the number of matching URLs that are image(s). Additionally, the URL component 210 can use comparison logic to determine a match.

[0113] After operation 354, method 300 may proceed to Figure 3D Operation 360 is described in more detail in FIG.

[0114] Figure 3D A flow chart of an example method 300 for an email security system to detect emails, assign probability scores, and use the probability scores to classify the emails as authentic emails or fraudulent emails is shown. The email security system 102 can monitor emails transmitted between users of an email platform or service to detect fraudulent emails, phishing emails, and / or other malicious emails.

[0115] At 356, the FF component 208 may determine a sender field probability score according to a process that flows naturally from operation 302. Thus, determining at operation 332 a match between the organization names determined at operation 310 and operation 330 (i.e., "yes" at operation 332) may produce a lower probability score indicating that the filtered email 114 is not fraudulent. Alternatively, determining that the sender address domain matches a free email service (i.e., "yes" at operation 322) or determining that the sender address domain matches a marketing mail service (i.e., "yes" at operation 324) may produce a higher probability score indicating that the filtered email 114 is fraudulent. Accordingly or alternatively, determining that the domain name randomness (e.g., exceeds a threshold) at operation 338 may produce a higher probability score indicating fraud. The FF component 208 may combine the interrelated processes that originate from operation 302 and flow into operation 356 at operation 356 and derive an overall sender field probability score. In some examples, the overall sender field probability score can include determining individual scores for each process and finding the mean, median, mode, weighted average, and the like.

[0116] At 358, the RT component 212 can determine a reply probability score, which indicates the possibility that the filtered email 114 is fraudulent for the process of the method 300 that flows naturally from operation 340. For example, determining the reply probability score can ultimately depend on operation 344. In this way, a "yes" determined at operation 344 can produce a higher probability score at operation 358 because the reply address domain matches the free email service domain. In other words, the match with the free email service domain can indicate that the attacker is guiding the victim to reply to the fraudulent email address created by the victim instead of the address associated with the legitimate brand. In some other instances, a "no" at operation 344 will lead to operation 346. In this way, the reply address domain determined to be dissimilar to the sender field address domain can similarly indicate the possibility that the filtered email 114 is fraudulent at operation 358 and be assigned a higher probability score. In addition, the RT component 212 can combine the interrelated processes originating from operation 340 and flowing into operation 358 at operation 358, and obtain an overall reply field probability score. In some examples, the overall response field probability score can include determining individual scores for each process and finding the mean, median, mode, weighted average, etc.

[0117] At 360, the URL component 210 may determine the URL probability score according to a process that flows naturally from operation 348. Therefore, the URL component 210 may determine the URL probability score at operation 360 using the determination made at operation 354. For example, determining at operation 354 that all URLs are matched may be considered to determine a lower URL probability score at operation 360. In such an instance, the URL probability score may be lower because the match indicates that the filtered email 114 is not fraudulent with a higher probability. Alternatively, in some other instances, determining at operation 354 that the number of unmatched URLs is high may result in determining a higher URL probability score at operation 360. Thus, a higher number of unmatched URLs may indicate that the filtered email 114 is fraudulent. In some other instances, the URL component 210 may determine a higher probability score at operation 360 from a "no" determined at operation 352. For example, emails from legitimate brands often contain unsubscribe language, and the omission of such language may indicate fraud. In addition, the URL component 210 can combine the interrelated processes originating from operation 348 and flowing into operation 360 at operation 360 and obtain an overall URL field probability score. In some examples, the overall URL field probability score can include determining the individual scores of the various processes and finding the average, median, mode, weighted average, etc.

[0118] The above operations 358, 360, and / or 362 may be determined independently and / or within a single intelligent probability calculation function. Accordingly or alternatively, the above operations 356, 358, and / or 360 may be performed in any suitable manner and / or method apparent to those skilled in the art.

[0119] At 362, the final probability and classification component (hereinafter referred to as "FP and C component") 218 ​​determines the final probability and classification from the method 300. The FP and C component 218 can combine the three interrelated processes derived from the method 300 at operation 362 and obtain the overall final probability score and classification of the filtered email 114. The final probability score can be determined by taking the individual probability scores determined at operation 356, operation 358 and / or operation 360 and finding the average, median, mode, weighted average, etc. In addition, the FP and C component 218 can use the final probability score to classify the filtered email 114 as fraudulent or non-fraudulent. As described and / or implied herein, when the final probability score exceeds a predetermined threshold, it can result in classification as fraudulent. For example, the predetermined threshold can be 0.75, and any final probability score that exceeds the threshold can cause the FP and C component 218 to classify the filtered email 114 as fraudulent. Additionally or alternatively, at operation 362, the FP and C component 218 may also determine the target legitimate brand name and / or possible spoofing of the target legitimate brand name. For example, the FP and C component 218 may determine that the legitimate brand "RealBrand" was intended, while the possible spoof "RealBrand" was attempted, and / or include determining that homographs (in Figure 5 described in more detail in ).

[0120] In some instances, method 300 may include additional and / or different processes. For example, a certificate probability score associated with a certificate may be determined. In such an instance, method 300 may be started by identifying a first domain name at operation 320 and identifying a second domain name at operation 342. Thus, method 300 may be continued by using the first domain name and the second domain name to identify an associated certificate. In addition, method 300 may use an associated certificate to determine an owner. Then, method 300 may identify a brand associated with the owner and compare the brand with a displayed brand name and / or display name from a filtered email 114. In addition, method 300 may determine, based at least on the comparison, whether the displayed brand name and / or display name of the filtered email 114 matches and / or corresponds to the name of a brand associated with the owner, and determine a certificate probability score based at least in part on the degree to which similarity and / or correspondence is determined.

[0121] In some other instances, the method 300 may determine a WHOIS probability score associated with the WHOIS information. For example, the method 300 may identify a first domain name and a second domain name associated with any URL found in the filtered email 114. In addition, the method 300 may use the first domain name and the second domain name to identify one or more associated registered domains, and determine the owner from the one or more associated registered domains. The method 300 may then identify a brand associated with the owner, and compare the brand with a displayed brand name and / or display name from the filtered email 114. In addition, the method 300 may determine, based at least on the comparison, whether the displayed brand name and / or display name of the filtered email 114 matches and / or corresponds to the name of the brand associated with the owner, and determine the WHOIS probability score based at least in part on the degree to which the similarity and / or correspondence is determined.

[0122] Figure 4 An example probability determination sequence 400 associated with an impersonated email probability 228 used by an email security system to detect fraudulent emails is shown.

[0123] At 402, an example probability determination can be started by loading JSON. JSON is an open standard file format and data interchange format that uses human-readable text to store and transmit data objects consisting of attribute-value pairs and arrays. The fake email probability 228 can utilize other formatting protocols, including but not limited to YAML, Protobuf, Avro, MongoDB, OData, JavaScript, Python, etc.

[0124] At 404 , the spoofed email probability 228 may begin calculating a probability score associated with the data collected in the “from field” of the screened emails 114 .

[0125] At 406, the impostor email probability 228 can indicate the collected information related to the sender name portion of the filtered email 114. For example, the illustration depicts the sender name reading "Phishlabs ITSupport."

[0126] At 408, the fake email probability 228 may indicate the collected information related to the sender domain of the screened email 114. For example, the illustration depicts the sender domain as "fakebrand.com."

[0127] At 410, the fake email probability 228 can indicate the collected information related to the domain name of the screened email 114. For example, the illustration depicts the domain name as "fakebrandtest."

[0128] At 412, the impostor email probability 228 can indicate the collected information related to the name of the person of the screened email 114. For example, the illustration does not depict information related to the name of the person and leaves the field blank.

[0129] At 414, the phony email probability 228 can indicate the collected information related to the organization name of the screened email 114. For example, the illustration depicts the collected organization name as "phishlabs."

[0130] At 416, the fake email probability 228 can calculate a probability score associated with the collected "From Field" information. For example, the illustration depicts that the "From Field" probability score is "0.80".

[0131] At 418 , the spoofed email probability 228 may begin calculating a probability score associated with the “URL” data collected from the screened emails 114 .

[0132] At 420, the imposter email probability 228 may indicate the collected information regarding the total number of URLs found within the screened emails 114. For example, the illustration depicts that "2" URLs were found.

[0133] At 422, the fake email probability 228 can indicate how many domain URLs were determined to match. For example, the diagram depicts "0" of "2" domain URLs being matched.

[0134] At 424, the fake email probability 228 can indicate how many domain URLs were determined to be unmatched. For example, the illustration depicts that there are "2" unmatched domain URLs.

[0135] At 426, the fake email probability 228 can indicate how many domain URLs that are image files are matched. For example, the illustration depicts that there are "0" matching domain URLs that are image files.

[0136] At 428, the fake email probability 228 may indicate the collected information related to the number of unsubscribe URLs found within the screened emails 114. For example, the illustration depicts that "0" unsubscribe URLs were found.

[0137] At 430, the fake email probability 228 can calculate a probability score associated with the collected URL data. For example, the illustration depicts that the "URL" information probability score is "1.0".

[0138] At 432 , the spoofed email probability 228 may begin calculating a probability score associated with the “reply-to field” data collected from the screened emails 114 .

[0139] At 434, the fake email probability 228 can indicate the collected information related to the reply field data. For example, the illustration depicts that the reply domain is "fraud.reply.com".

[0140] At 436, the fake email probability 228 can calculate a probability score associated with the collected "reply field" data. For example, the illustration depicts that the "reply field" probability score is "0.80".

[0141] At 438, the spoofed email probability 228 can indicate a final probability calculated starting from the previously calculated probability score.

[0142] At 440, the fake email probability 228 can indicate that the previous step at 438 has been completed, with the calculation spanning a certain accompanying duration. For example, the illustration depicts that the final probability score was calculated in "0.893" seconds.

[0143] At 442, the fake email probability 228 can display the final probability score. For example, the illustration depicts the average probability score of the previous three probability scores, i.e., the filtered email 114 has a probability score of "0.867", which indicates that the filtered email 114 is fraudulent.

[0144] It should be noted that the above steps of the fake email probability 228 are merely exemplary. Thus, steps may be added or removed. For example, additional steps indicating the classification of the filtered email 114 as fraudulent or non-fraudulent may be included and / or added.

[0145] Figure 5An example 500 of a fraudulent email 502 detected by an email security system 102 is shown. As shown, the screened email 114 shown is a payment request fraud email, in which the attacker pretends to be someone that the victim / target owes payment. The email 114 includes a payment request. The scammer can use many domain name techniques 504 that look similar to deceive its victim / target. In this instance, the domain name techniques 504 that look similar will appear to be legitimate brands to the victim / target. In this example, the domain name techniques 504 that look similar at "1" are called top-level domain (TLD) swaps. As shown, at "1", the attacker includes the name of a legitimate brand (i.e., phishlabs) and then inserts a TLD swap (i.e., tech) to try to mislead the victim / target into believing that the domain is legitimate and / or associated with a legitimate brand.

[0146] In some other examples, the attacker may employ a subdomain at "2". In such an instance, the attacker may attempt to mislead the victim / target by using a legitimate domain, but by inserting a dot to separate it and create a fraudulent domain. For example, at "2", the attacker inserts a dot between "phish" and "labs", which makes "labs" a subdomain. The victim / target may view the domain and determine that it is legitimate and / or associated with a legitimate brand because the domain contains elements of the legitimate domain. It should be understood that inserting a dot to create a subdomain undermines the legitimacy of the domain, although it may not be easily visually obvious to the victim / target.

[0147] In some other examples, the attacker may employ a typographical error at "3". In such an instance, the attacker attempts to deceive the victim by intentionally misspelling the name of a domain of a legitimate organization (e.g., a brand). For example, at "3", the attacker intentionally changes the letter "b" to "v" so that the domain of a legitimate brand reads "phislavs.tech" instead of "phishlabs.tech". In this way, the victim may not easily observe the typo and mistake the domain as legitimate and / or associated with a legitimate brand.

[0148] In some other examples, the attacker may employ hyphenation at "4". In such an instance, the attacker attempts to deceive the victim by hyphenating an otherwise legitimate domain. For example, at "4", the attacker inserts a hyphen between "phish" and "labs". Although the domain may appear legitimate to the victim, the insertion of the hyphen causes the domain to be fraudulent.

[0149] In some other examples, the attacker may employ repetition at the "5". In such instances, the attacker attempts to deceive the victim by repeating letters, and without careful inspection, may cause the victim to ignore the repetition and believe that the domain is legitimate and / or associated with a legitimate brand. For example, at the "5", the attack repeats the letter "l". This way, the fraudulent domain contains two "l"s, which can be easily ignored by the victim. The addition of additional letters causes the domain to be fraudulent.

[0150] In some other examples, the attacker may employ substitutions at "6". In such instances, the attacker attempts to deceive the victim by replacing letters, typically with letters, numbers, and / or symbols that are very similar to the replaced letters. For example, at "6", the attacker replaces the letter "i" with the number "1". In this way, the victim may not easily notice the substitution and believe that the domain is legitimate and / or associated with a legitimate brand.

[0151] In some other examples, the attacker may employ an omission at "7". In such an instance, the attacker attempts to deceive the victim by omitting elements of the legitimate domain. For example, at "7", the attacker attempts to deceive the victim by removing the letter "i" from the domain. In this way, the new fraudulent domain is "phshlabs.tech" instead of "phishlabs.tech", wherein the difference may not be noticed by the victim.

[0152] In some other examples, the attacker may employ a swap at "8". In such an instance, the attacker attempts to deceive the victim by swapping elements of a legitimate brand domain. For example, at "8", the attacker switches the positions of the letters "i" and "s", causing the domain to read "phsilabs.tech". As such, this small difference may similarly go unnoticed by the victim, who mistakenly believes the fraudulent domain is legitimate and / or associated with a legitimate brand.

[0153] In some other examples, the attacker may employ an insertion at "9". In such an instance, the attacker attempts to deceive the victim by inserting additional elements into the legitimate domain. For example, at "9", the attacker inserts the letter "x" into the middle of the legitimate domain. In this way, the fraudulent domain reads "phishxlabs.tech", which may lead the victim to believe that it is legitimate and / or associated with a legitimate brand.

[0154] In some other examples, the attacker may employ homographs at "10". In such instances, the attacker attempts to deceive the victim by using homographs or homographs, where the attacker abuses the similarity of character scripts to create fraudulent domains of legitimate brands to deceive victims into clicking. For example, at "10", the attacker replaces the letter "h" with the letters "l" and "n", which together (e.g., "ln") have similarities to the letter "h". In this way, the victim may not be able to discern the subtle differences between the legitimate brand domain and the homograph attack.

[0155] In some other examples, the attacker may employ vowel swapping at "11". In such instances, the attacker attempts to deceive the victim by swapping vowels to exploit the victim's typing error or oversight of the construction of the domain. For example, at "11", the attacker replaces the letter "a" with the letter "e". Thus, this may be a common typing error made by the victim due to the close proximity of these letters on a standard keyboard, and / or may exploit the victim's oversight in discerning variations in the construction of a legitimate domain.

[0156] In some other examples, the attacker may employ additions at "12". In such instances, the attacker attempts to deceive the victim by adding characters to a legitimate domain construction. For example, at "12", the attacker adds an additional letter "s" to an otherwise legitimate domain construction. In this way, the element addition may not be noticed by the victim and / or a flash payment through the fraudulent domain may not appear to contain a problem. In such instances, the victim may believe that the fraudulent domain is legitimate and / or associated with a legitimate brand.

[0157] The above-mentioned domain name technology list 504 that looks similar is merely exemplary and should not be construed as limiting. In addition, the examples described and suggested with respect to the domain name technology 504 that looks similar are similarly exemplary, and it should be understood that additional technologies and / or variations may be considered and / or apparent to those skilled in the art.

[0158] Figure 6 A flowchart of an example method 600 is shown, which illustrates at least in part Figures 1 to 5 Aspects of the functions performed by devices in the computing infrastructure described in . Figure 6 The described logical operations may be implemented as (1) a sequence of computer-implemented acts or program modules running on a computing system and / or (2) interconnected machine logic circuits or circuit modules within the computing system.

[0159] The implementation of the various components described herein is selected based on the performance and other requirements of the computing system. Therefore, the logical operations described herein are variously referred to as operations, structural devices, actions, or modules. These operations, structural devices, actions, and modules can be implemented in software, firmware, dedicated digital logic, and any combination thereof. It should also be understood that more than one operation can be performed. Figure 6 The present invention also can be used to describe more or less operations shown in and described in this article. These operations can also be performed in parallel, or in an order different from that described in this article. At least a portion of these operations can also be performed by any suitable components and / or components that are obvious to those skilled in the art. Although the techniques described in this disclosure refer to specific components, in other examples, these techniques can be implemented by fewer components, more components and / or different components.

[0160] Figure 6 A flowchart of an example method for an email security system to screen emails, analyze their content, and assign a probability score and classification indicating the probability of whether the screened email 114 is fraudulent is shown. These techniques can be applied by a system including one or more processors and one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform the operations of method 600.

[0161] At 602, the email security system 102 may receive an email sent from a sending email address to a target email address. For example, the email security system 102 may monitor emails transmitted by an email service platform and obtain the emails.

[0162] At 604, the email security system 102 may classify the email as a screened email 114. For example, the processor(s) 202 may classify incoming emails as screened and initiate a process to analyze them for fraud.

[0163] At 606, the email security system 102 can extract information from the screened email 114. For example, the sender field analysis component 208, the URL analysis component 210, the reply analysis component, etc. can extract data from the screened email 114 to determine that the screened email 114 is a fraudulent email directed to the target user.

[0164] At 608, the email security system 102 can process the extracted information. For example, various components can analyze the extracted data from the filtered email 114 to determine that the filtered email 114 is a fraudulent email directed to the target user. In such an example, various components of the email security system 102 can determine similarities, matches, presence of legitimate brand names, domains, etc., for determining a probability score indicating fraud.

[0165] At 610, the email security system 102 can determine a probability score indicating fraud of the filtered email 114 based at least in part on the processed, extracted information. For example, the email security system 102 can determine that there are differences between the sender field domain address and the reply-to domain address. Thus, these differences can indicate that the attacker is attempting to trick the victim into responding to the fraudulent reply-to domain address. In this instance, the email security system 102 can determine a probability score indicating that the filtered email 114 is fraudulent based at least in part on the processed and extracted information.

[0166] At 612, the email security system 102 may classify the screened email 114 as fraudulent or non-fraudulent based at least in part on the probability score. For example, a predetermined threshold (i.e., score) may be included in the impersonated email probability 228. Thus, a determined probability score that exceeds the predetermined threshold may indicate a fraudulent email. For example, the email security system 102 may determine at operation 610 that the probability score of the screened email 114 is "0.9". Additionally, the predetermined threshold score may be "0.75". Thus, the probability score of the screened email 114 will exceed the threshold score, and the email security system 102 may classify the screened email 114 as fraudulent based at least in part on the probability score.

[0167] At 614, the email security system 102 may allow the screened email 114 to pass through the email security system 102 as an allowed email 110 based at least in part on the non-fraudulent classification. In this way, the allowed email 110 may be allowed to pass freely along the network(s) 108 between the sending device(s) 104 and the receiving device(s) 106.

[0168] Figure 7 An example computer architecture is shown for a computer 700 capable of executing program components for implementing the functionality described herein. Figure 7The computer architecture shown illustrates a conventional server computer, workstation, desktop computer, laptop computer, tablet computer, web appliance, e-reader, smart phone and / or other computing device, and can be used to execute any software components presented herein. In some examples, computer 700 can correspond to a physical server included in the email security system 102 described herein, and can include networking devices such as servers, switches, routers, hubs, bridges, gateways, modems, repeaters, access points, and the like.

[0169] The computer 700 includes a baseboard 702 (or "motherboard"), which is a printed circuit board to which many components or devices may be connected by way of a system bus or other electrical communication paths. In one illustrative configuration, one or more central processing units ("CPUs") 704 operate in conjunction with a chipset 706. The CPU 704 may be a standard programmable processor that performs the arithmetic and logic operations necessary for the operation of the computer 700.

[0170] The CPU 704 performs operations by transitioning from one discrete physical state to the next, where the state transitions are achieved by manipulating switching elements that distinguish and change these states. Switching elements generally include electronic circuits that maintain one of two binary states, such as flip-flops, and electronic circuits that provide output states based on logical combinations of the states of one or more other switching elements, such as logic gates. These basic switching elements can be combined to create more complex logic circuits, including registers, adders and subtractors, arithmetic logic units, floating point units, and the like.

[0171] Chipset 706 provides an interface between CPU 704 and the remaining components and devices on baseboard 702. Chipset 706 may provide an interface with RAM 708, which is used as main memory in computer 700. Chipset 706 may further provide an interface with a computer-readable storage medium, such as read-only memory (ROM) 710 or non-volatile RAM (NVRAM), for storing basic routines that help start computer 700 and transfer information between various components and devices. ROM 710 or NVRAM may also store other software components necessary for the operation of computer 700 according to the configuration described herein.

[0172] The computer 700 can operate in a networked environment using logical connections to remote computing devices and computer systems through a network (e.g., network 708). The chipset 706 can include functionality to provide network connectivity through a NIC 712 (e.g., a Gigabit Ethernet adapter). The NIC 712 can connect the computer 700 to other computing devices through the network 708. It should be appreciated that multiple NICs 712 can be present in the computer 700, connecting the computer to other types of networks and remote computer systems.

[0173] The computer 700 can be connected to a storage device 718 that provides non-volatile storage for the computer. The storage device 718 can store an operating system 720, a program 722, and data, which have been described in more detail herein. The storage device 718 can be connected to the computer 700 via a storage controller 714 connected to the chipset 706. The storage device 718 can be composed of one or more physical storage units. The storage controller 714 can be connected to the physical storage unit via a serial attached SCSI ("SAS") interface, a serial advanced technology attachment ("SATA") interface, a fiber channel ("FC") interface, or other types of interfaces for physically connecting and transmitting data between the computer and the physical storage unit.

[0174] The computer 700 can store data on the storage device 718 by transforming the physical state of the physical storage unit to reflect the information being stored. In different embodiments of the present specification, the specific transformation of the physical state may depend on various factors. Examples of such factors may include, but are not limited to, the technology used to implement the physical storage unit, whether the storage device 718 is characterized as primary storage or secondary storage, etc.

[0175] For example, the computer 700 may store information to the storage device 718 by issuing instructions through the storage controller 714 to change the magnetic properties of a specific location within a disk drive unit, the reflective or refractive properties of a specific location in an optical storage unit, or the electrical properties of a specific capacitor, transistor, or other discrete component in a solid-state storage unit. Other transformations of the physical medium are possible without departing from the scope and spirit of the present specification, and the foregoing examples are provided only for the convenience of the present specification. The computer 700 may further read information from the storage device 718 by detecting the physical state or properties of one or more locations within the physical storage unit.

[0176] In addition to the mass storage device 718 described above, the computer 700 may also access other computer-readable storage media to store and retrieve information, such as program modules, data structures, or other data. It should be understood by those skilled in the art that computer-readable storage media are any available media that provide non-transitory storage of data and can be accessed by the computer 700. In some examples, operations performed by devices in a distributed application architecture and / or any components included therein may be supported by one or more devices similar to the computer 700. In other words, at least a portion of the operations performed by the email security system 102 and / or any components included therein may be performed by one or more computer devices 700 operating in any system or arrangement.

[0177] By way of example, and not limitation, computer-readable storage media may include volatile and nonvolatile, removable and non-removable media implemented in any method or technology. Computer-readable storage media include, but are not limited to, RAM, ROM, erasable programmable ROM ("EPROM"), electrically-erasable programmable ROM ("EEPROM"), flash memory or other solid-state memory technology, compact disc ROM ("CD-ROM"), digital versatile disk ("DVD"), high definition DVD ("HD-DVD"), BLU-RAY or other optical storage, cassettes, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information in a non-transitory manner.

[0178] As briefly mentioned above, the storage device 718 can store an operating system 720 that is utilized to control the operation of the computer 700. According to one example, the operating system includes a LINUX operating system. According to another example, the operating system includes an UNIX operating system from MICROSOFT Corporation of Redmond, Washington. SERVER operating system. According to another embodiment, the operating system may include a UNIX operating system or one of its variants. It should be understood that other operating systems may also be utilized. Storage device 718 may store other systems or applications and data utilized by computer 700.

[0179] In one example, the storage device 718 or other computer-readable storage medium is encoded with computer-executable instructions that, when loaded into the computer 700, transform the computer from a general-purpose computing system into a special-purpose computer capable of implementing the embodiments described herein. As described above, these computer-executable instructions transform the computer 700 by specifying how the CPU 704 transitions between states. According to one example, the computer 700 is able to access a computer-readable storage medium storing computer-executable instructions that, when executed by the computer 700, perform the above-described Figures 1 to 6 The computer 700 may also include a computer-readable storage medium having stored thereon instructions for performing any other computer-implemented operations described herein.

[0180] The computer 700 may also include one or more input / output controllers 716 for receiving and processing input from a number of input devices, such as a keyboard, a mouse, a touch pad, a touch screen, an electronic stylus, or other types of input devices. Similarly, the input / output controller 716 may provide output to a display (e.g., a computer monitor, a flat panel display, a digital projector, a printer, or other types of output devices). It will be appreciated that the computer 700 may not include Figure 7 All components shown in the Figure 7 Other components not explicitly shown in the figure or may be used in conjunction with Figure 7 A completely different architecture is shown in .

[0181] In summary, a technique for an email security system to screen emails, extract information from emails, analyze information, assign probability scores to emails, and classify emails as potentially fraudulent or non-fraudulent is described. The system can analyze a user's emails and identify fraudulent emails by analyzing the content of the emails. The system can evaluate the content of the emails to determine (one or more) probability scores, which (one or more) probability scores can further determine the overall probability score. The system can then classify the emails as fraudulent or non-fraudulent, and can perform actions including shielding emails, allowing emails, marking emails, etc. In some instances, the filtered emails may include legitimate brand domain addresses, names, images, (one or more) URLs, etc. However, the filtered emails may contain a reply domain address that matches a free email service provider domain. In such an instance, the email security system may assign a probability score indicating that the filtered emails are fraudulent.

[0182] Although the present invention is described with respect to specific examples, it is to be understood that the scope of the present invention is not limited to these specific examples. Because other modifications and changes to adapt to specific operating requirements and environments are obvious to those skilled in the art, the present invention is not considered to be limited to the examples selected for disclosure purposes, but covers all changes and modifications that do not constitute a departure from the true spirit and scope of the present invention.

[0183] Although the present application describes embodiments with specific structural features and / or methodological actions, it is to be understood that the claims are not necessarily limited to the specific features or actions described. Rather, the specific features and actions are only illustrative of some embodiments within the scope of the claims of the present application.

Claims

1. A method for detecting malicious emails in an email security system, the method comprising: obtaining, at the email security system, an email sent from a sending device to a receiving device; extracting, from the email, first data representing a sender field of the email, second data representing a uniform resource locator (URL) in the email, and third data representing a reply address; determining a first probability value using the first data, the first probability value indicating a first likelihood that the sender field of the email is impersonating a brand name; determining a second probability value using the second data, the second probability value indicating a second likelihood that the URL in the email is impersonating the brand name; determining a third probability value using the third data, the third probability value indicating a third likelihood that the reply address in the email is impersonating the brand name; as well as An overall probability value is determined using the first probability value, the second probability value, and the third probability value, the overall probability value indicating an overall likelihood that the email is a malicious email impersonating the brand name.

2. The method according to claim 1, further comprising: identifying a displayed brand name and a display name in the sender field of the email using the first data; identifying a first domain name in the From field of the email using the first data; comparing the displayed brand name of the email to the display name; comparing the first domain name to a plurality of free email service domains; as well as The first probability value is determined based at least in part on comparing the displayed brand name of the email to the display name and comparing the first domain name in the sender field of the email to the plurality of free email service domains.

3. The method according to claim 1 or 2, further comprising: identifying a second domain name associated with the URL using the second data; comparing the brand name to the second domain name; determining, based at least in part on the comparing, whether the brand name corresponds to the second domain name; as well as The second probability value is determined based at least in part on determining whether the brand name corresponds to the second domain name.

4. The method according to any one of claims 1 to 3, further comprising: identifying a third domain name using the third data; identifying a first domain name using the first data; comparing the first domain name to a plurality of free email service domains; comparing the first domain name with the third domain name; determining whether the first domain name corresponds to the plurality of free email service domains and whether the first domain name corresponds to the third domain name based on comparing the first domain name with the plurality of free email service domains and comparing the first domain name with the third domain name; as well as The third probability value is determined based at least in part on determining whether the first domain name corresponds to the plurality of free email service domains and whether the first domain name corresponds to the third domain name.

5. The method according to any one of claims 1 to 4, further comprising: identifying a first domain name using the first data; identifying a second domain name using the second data; identifying a third domain name using the third data; identifying an associated certificate using the first data, the second data, and the third data; determining an owner using the associated certificate; identifying, using the owner, a corresponding name of a brand associated with the owner; determining a displayed brand name and a display name for the email using the first data; comparing the displayed brand name of the email and the display name to a name of a brand associated with the owner; determining, based at least on the comparing, whether the displayed brand name of the email and the display name correspond to a name of a brand associated with the owner; as well as A fourth probability value is determined based at least in part on determining the displayed brand name of the email and whether the displayed name corresponds to a name of a brand associated with the owner.

6. The method according to any one of claims 1 to 5, further comprising: identifying, from the email, a selectable option for the receiving device to unsubscribe from additional emails; extracting, from the email, an unsubscribe URL associated with the selectable option; as well as comparing the unsubscribe URL to the first domain name, Wherein determining the second probability value indicating the second likelihood that the email impersonates the brand name is based at least in part on comparing the URL to the first domain name.

7. The method according to any one of claims 1 to 6, further comprising: identifying an image included in the email; identifying an image URL from image data associated with the image; as well as comparing the image URL to a first domain name; Wherein determining the second probability value indicating the second likelihood that the email impersonates the brand name is based at least in part on comparing the image URL to the first domain name is based at least in part on comparing the image URL to the first domain name.

8. The method according to any one of claims 1 to 7, further comprising: identifying a first domain name using the first data; identifying a second domain name using the second data; identifying a third domain name using the third data; identifying an associated Whois database entry using the first data, the second data, and the third data; determining a registrant from said associated Whois database entry; a name identifying the brand associated with said registrant; identifying a displayed brand name and a display name of the email using the first data; comparing the displayed brand name of the email and the display name to a name of a brand associated with the registrant; as well as A seventh probability value is determined based at least in part on comparing the displayed brand name of the email and whether the displayed name corresponds to a name of a brand associated with the registrant.

9. A system comprising: one or more processors; as well as One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising: obtaining, at the email security system, an email sent from a sending device to a receiving device; extracting, from the email, first data representing a sender field of the email, second data representing a uniform resource locator (URL) in the email, and third data representing a reply address; determining a first probability value using the first data, the first probability value indicating a first likelihood that the sender field of the email is impersonating a brand name; determining a second probability value using the second data, the second probability value indicating a second likelihood that the URL in the email is impersonating the brand name; determining a third probability value using the third data, the third probability value indicating a third likelihood that the reply address in the email is impersonating the brand name; and An overall probability value is determined using the first probability value, the second probability value, and the third probability value, the overall probability value indicating an overall likelihood that the email is a malicious email impersonating the brand name.

10. The system according to claim 9, further comprising: identifying a displayed brand name and a display name in the sender field of the email using the first data; identifying a first domain name in the From field of the email using the first data; comparing the displayed brand name of the email to the display name; comparing the first domain name to a plurality of free email service domains; as well as The first probability value is determined based at least in part on comparing the displayed brand name of the email to the display name and comparing the first domain name in the sender field of the email to the plurality of free email service domains.

11. The system according to claim 9 or 10, further comprising: identifying a second domain name associated with the URL using the second data; comparing the brand name to the second domain name; determining, based at least in part on the comparing, whether the brand name corresponds to the second domain name; as well as The second probability value is determined based at least in part on determining whether the brand name corresponds to the second domain name.

12. The system according to any one of claims 9 to 11, further comprising: identifying a third domain name using the third data; identifying a first domain name using the first data; comparing the first domain name to a plurality of free email service domains; comparing the first domain name with the third domain name; determining whether the first domain name corresponds to the plurality of free email service domains and whether the first domain name corresponds to the third domain name based on comparing the first domain name with the plurality of free email service domains and comparing the first domain name with the third domain name; as well as The third probability value is determined based at least in part on determining whether the first domain name corresponds to the plurality of free email service domains and whether the first domain name corresponds to the third domain name.

13. The system according to any one of claims 9 to 12, further comprising: identifying a first domain name using the first data; identifying a second domain name using the second data; identifying a third domain name using the third data; identifying an associated certificate using the first data, the second data, and the third data; determining an owner using the associated certificate; identifying, using the owner, a corresponding name of a brand associated with the owner; determining a displayed brand name and a display name for the email using the first data; comparing the displayed brand name of the email and the display name to a name of a brand associated with the owner; determining, based at least on the comparing, whether the displayed brand name of the email and the display name correspond to a name of a brand associated with the owner; as well as A fourth probability value is determined based at least in part on determining the displayed brand name of the email and whether the displayed name corresponds to a name of a brand associated with the owner.

14. The system according to any one of claims 9 to 13, further comprising: identifying, from the email, a selectable option for the receiving device to unsubscribe from additional emails; extracting, from the email, an unsubscribe URL associated with the selectable option; as well as comparing the unsubscribe URL to the first domain name, Wherein determining the second probability value indicating the second likelihood that the email impersonates the brand name is based at least in part on comparing the URL to the first domain name.

15. The system according to any one of claims 9 to 14, further comprising: identifying an image included in the email; identifying an image URL from image data associated with the image; as well as comparing the image URL to a first domain name; Wherein determining the second probability value indicating the second likelihood that the email impersonates the brand name is based at least in part on comparing the image URL to the first domain name is based at least in part on comparing the image URL to the first domain name.

16. The system according to any one of claims 9 to 15, further comprising: identifying a first domain name using the first data; identifying a second domain name using the second data; identifying a third domain name using the third data; identifying an associated Whois database entry using the first data, the second data, and the third data; determining a registrant from said associated Whois database entry; a name identifying the brand associated with said registrant; identifying a displayed brand name and a display name of the email using the first data; comparing the displayed brand name of the email and the display name to a name of a brand associated with the registrant; as well as A seventh probability value is determined based at least in part on comparing the displayed brand name of the email and whether the displayed name corresponds to a name of a brand associated with the registrant.

17. One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising: obtaining, at the email security system, an email sent from a sending device to a receiving device; extracting, from the email, first data representing a sender field of the email, second data representing a uniform resource locator (URL) in the email, and third data representing a reply address; determining a first probability value using the first data, the first probability value indicating a first likelihood that the sender field of the email is impersonating a brand name; determining a second probability value using the second data, the second probability value indicating a second likelihood that the URL in the email is impersonating the brand name; determining a third probability value using the third data, the third probability value indicating a third likelihood that the reply address in the email is impersonating the brand name; as well as An overall probability value is determined using the first probability value, the second probability value, and the third probability value, the overall probability value indicating an overall likelihood that the email is a malicious email impersonating the brand name.

18. The one or more non-transitory computer readable media of claim 17, further comprising: identifying a displayed brand name and a display name in the sender field of the email using the first data; identifying a first domain name in the From field of the email using the first data; comparing the displayed brand name of the email to the display name; comparing the first domain name to a plurality of free email service domains; as well as A first probability value is determined based at least in part on comparing the displayed brand name of the email to the display name and comparing the first domain name in the sender field of the email to the plurality of free email service domains.

19. The one or more non-transitory computer readable media of claim 18, further comprising: identifying a second domain name associated with the URL using the second data; comparing the brand name to the second domain name; determining, based at least in part on the comparing, whether the brand name corresponds to the second domain name; as well as The second probability value is determined based at least in part on determining whether the brand name corresponds to the second domain name.

20. The one or more non-transitory computer readable media of any one of claims 17 to 19, further comprising: identifying a third domain name using the third data; identifying a first domain name using the first data; comparing the first domain name to a plurality of free email service domains; comparing the first domain name with the third domain name; determining whether the first domain name corresponds to the plurality of free email service domains and whether the first domain name corresponds to the third domain name based on comparing the first domain name with the plurality of free email service domains and comparing the first domain name with the third domain name; as well as The third probability value is determined based at least in part on determining whether the first domain name corresponds to the plurality of free email service domains and whether the first domain name corresponds to the third domain name.

21. A system for implementing an email security system to detect malicious emails, the system comprising: means for obtaining, at an email security system, an email sent from a sending device to a receiving device; means for extracting from the email first data representing a sender field of the email, second data representing a uniform resource locator (URL) in the email, and third data representing a reply address; means for determining a first probability value using the first data, the first probability value indicating a first likelihood that a sender field of the email impersonates a brand name; means for determining a second probability value using the second data, the second probability value indicating a second likelihood that the URL in the email is impersonating the brand name; means for determining a third probability value using the third data, the third probability value indicating a third likelihood that the reply address in the email is impersonating the brand name; as well as Means for determining an overall probability value using the first probability value, the second probability value, and the third probability value, the overall probability value indicating an overall likelihood that the email is a malicious email impersonating the brand name.

22. The system of claim 21, further comprising means for implementing the method of any one of claims 2 to 8.

23. A computer program, a computer program product or a computer readable medium comprising instructions which, when executed by a computer, cause the computer to perform the steps of the method according to any one of claims 1 to 8.

Images