Cyber ​​threat defense system that uses machine learning models to protect email networks

Abstract

To provide a cyber defense system using models that are trained on a normal behavior of email activity and user activity associated with an email system.SOLUTION: A cyber defense system has a cyber threat module and automatic response module using comparison. The cyber threat module refers to models that are trained on the normal behavior of email activity and user activity. The cyber threat module determines a threat risk parameter that factors in the likelihood that a chain of one or more unusual behaviors of the email activity and user activity under analysis fall outside of an obtained normal benign behavior. An autonomous response module, which is not a human taking an action, causes one or more autonomous actions to cause one or more autonomous rapid actions to be taken to contain the cyber threat when the threat risk parameter from the cyber threat module is equal to or larger than a threshold to be an index of the action.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] Copyright Notice

[0002] A portion of this disclosure contains material that is subject to copyright protection. The copyright owner has no objection to others copying of the copyrighted material, as it appears in the U.S. Patent and Trademark Office patent files or records, but otherwise reserves all copyrights whatsoever. Related Applications

[0003] This application claims priority under 35 U.S.C. § 119 to and the benefit of Provisional Patent Application No. 62 / 632,623, entitled "A cyber-threat defense system with various improvements," filed February 20, 2018, which is incorporated by reference in its entirety.

[0004] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The embodiments of the designs provided herein relate generally to a cyber threat defense system. In one embodiment, an artificial intelligence analyzes cyber security threats originating from and / or associated with email. [Background technology]

[0005] In the cybersecurity environment, firewalls, endpoint security methods, and other tools such as SIEMs and sandboxes are deployed to enforce specific policies and provide protection against specific threats. While these tools currently form a vital part of an organization's cyber defense strategy, they are inadequate in the new era of cyber threats.

[0006] Cyber ​​threats, including email threats, are sophisticated and can quickly compromise networks. Having an automated response makes it possible to quickly combat these threats. Summary of the Invention

[0007] In one embodiment, the cyber threat protection system protects the system from cyber threats originating from and / or associated with email and / or email systems. One or more machine learning models are trained on normal behavior of email and user activities associated with the email system and normal behavior of the intended recipients of the email as understood from their normal network behavior. The normal network behavior can be obtained from other systems operating outside of email interactions. The cyber threat module can have one or more machine learning models trained on cyber threats within the email system or cyber threats that may be present on the recipients' networks. The cyber threat module can refer to models trained on normal behavior of mail and user activities associated with the email system. The cyber threat module determines a threat risk parameter that takes into account the likelihood that a set of one or more non-normal behaviors of the email and user activities under analysis deviate from the obtained normal harmless behavior. A probe collects user and email activities, which are then fed into the cyber threat module to draw in an understanding of the email and user activities within the email system. The autonomous response module, which is not a human taking action, is configured to trigger one or more autonomous actions to be taken to thwart the cyber threat when the threat risk parameter from the cyber threat module is equal to or greater than a threshold that can guide an action.

[0008] These and other features of the designs provided herein can be better understood with reference to the drawings, specification, and claims, all of which form the disclosure of this patent application. [Brief description of the drawings]

[0009] The drawings refer to several embodiments of the designs provided herein.

[0010] [Figure 1] FIG. 1 is a block diagram of one embodiment of a cyber threat protection system having a cyber threat module that references a machine learning model trained on normal behavior of email and user activity associated with at least an email system, and in which the cyber threat module determines a threat risk parameter that takes into account the "likelihood that one or more non-normal behaviors of the set of email and user activity under analysis deviate from the obtained normal harmless behavior" and therefore is more likely to be malicious behavior.

[0011] [Diagram 2] FIG. 2 is a block diagram of one embodiment of a cyber threat defense system that monitors email and network activity, feeds this data into correlated causal relationships between these activities, and provides this input to cyber threat analysis.

[0012] [Diagram 3] FIG. 3 is a block diagram of one embodiment of a cyber threat module that determines a threat risk parameter that takes into account how a set of non-normal behaviors correlates to a potential cyber threat, as well as the likelihood that this set of one or more non-normal behaviors of the email and user activity under analysis deviates from the obtained normal, harmless behavior, and is therefore malicious behavior.

[0013] [Figure 4] FIG. 4 is a block diagram of one embodiment of a cyber threat defense system that references one or more machine learning models that are trained on gaining an understanding of multiple features of the email itself and its associated data, including classifying properties of the email and its metadata.

[0014] [Diagram 5] FIG. 5 is a block diagram of one embodiment of an example set of non-normal behaviors for email relative to other networks under analysis.

[0015] [Figure 6] FIG. 6 is a block diagram of one embodiment of an example window of a user interface of a cyber threat protection system for making emails in the email system filterable, searchable, and sortable.

[0016] [Figure 7] FIG. 7 is a block diagram of one embodiment of example autonomous actions that the autonomous rapid response module may be configured to take without a human initiating the action.

[0017] [Figure 8] FIG. 8 is a block diagram of one embodiment of an email module and a network module that coordinates a particular user's network activity tied to their email activity.

[0018] [Figure 9] FIG. 9 illustrates an example of a cyber threat defense system protecting an example network.

[0019] [Figure 10] FIG. 10 illustrates an example network module that notifies an email module of a computer's network activity before a user of that computer receives an email containing content related to that network activity.

[0020] [Figure 11] FIG. 11 illustrates an example network module that communicates estimated lifestyle pattern information regarding a computer's web browsing activity to an email module before a user of the computer receives an email containing content that is inconsistent with the lifestyle pattern.

[0021] While the present design is subject to various modifications, equivalents, and alternative forms, specific embodiments thereof have been shown by way of example in the drawings and will now be described in detail. It is to be understood that the present design is not limited to the particular embodiments disclosed, but rather is intended to cover all modifications, equivalents, and alternative forms that utilize the particular embodiments. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0022] In the following description, numerous specific details are set forth, such as specific data signals, named components, the number of servers in a system, etc., to provide a thorough understanding of the design. However, it will be apparent to one of ordinary skill in the art that the design may be practiced without these specific details. In other instances, well-known components or methods have not been described in detail, but rather in block diagram form, to avoid unnecessarily obscuring the design. Furthermore, specific numerical references may be made, such as a first server. However, the specific numerical references should not be construed as a literal sequence, but rather that a first server is different from a second server. Thus, the specific details set forth are merely examples. Also, features implemented in one embodiment may be implemented in another embodiment where logically possible. The specific details may be varied and still be construed to be within the spirit and scope of the design. The term coupled is defined to mean connected either directly to a component, or indirectly to a component through another component.

[0023] In general, an artificial intelligence analyzes cyber security threats. The cyber defense system can use models trained on normal behavior of email and user activities associated with the email system. The cyber threat module can reference models trained on normal behavior of mail and user activities. A threat risk parameter is determined that takes into account the likelihood that one or more non-normal behaviors of the set of email and user activities under analysis deviate from the obtained normal harmless behavior. The autonomous response module, which is not a human taking action, can be used to trigger one or more autonomous rapid actions to be taken to thwart the cyber threat when the threat risk parameter from the cyber threat module is equal to or greater than a threshold that can guide the action.

[0024] FIG. 1 shows a block diagram of one embodiment of a cyber threat protection system having a cyber threat module that references a machine learning model trained on normal behavior of email and user activity associated with at least an email system, and the cyber threat module determines a threat risk parameter that takes into account the "likelihood that one or more non-normal behaviors of the set of email and user activity under analysis deviate from the obtained normal harmless behavior" and therefore is likely to be malicious behavior.

[0025] The cyber threat defense system 100 may protect against cyber security threats from an email system as well as its network. The cyber threat defense system 100 may include components such as i) a trigger module, ii) a collection module, iii) a data store, iv) a network module, v) an email module, vi) a network & email coordinator module, vii) a cyber threat module, viii) a user interface and display module, ix) an autonomous response module, x) one or more machine learning models, including a first artificial intelligence model trained on the characteristics of the email itself and its associated data, a second artificial intelligence model trained on potential cyber threats, and one or more artificial intelligence models each trained on different users, devices, system activities, and interactions between entities in the system, as well as other aspects of the system, and xi) other similar components in the cyber threat defense system.

[0026] The trigger module may detect time-stamped data indicating one or more i) events and / or ii) alerts occurring from I) non-normal or II) suspicious behavior / activity, and then trigger that something non-normal is occurring. Thus, the collector module is triggered by specific events and / or alerts of i) anomalous behavior, ii) suspicious activity, and iii) any combination of both. Inline data may be collected on the deployment from a data store as traffic is observed. The range and wide variation of data available at this location results in good quality data for analysis. The collected data is passed to the cyber threat module.

[0027] The collector module may consist of multiple automated data collectors, each looking at different aspects of the data depending on the particular hypothesis formed about the event and / or alert being analyzed. Data related to each type of possible hypothesis is automatically pulled from additional external and internal sources. Some data is pulled or acquired by the collector module for each possible hypothesis. A collaborative feedback loop occurs between the collector module, the email module monitoring email activity, the network module monitoring network activity, and the cyber threat module, applying one or more models trained on different aspects of this process. Each hypothesis of a typical threat, e.g., insider attack / inappropriate network and / or email behavior of a human user, malicious software / malware attack / inappropriate network and / or email behavior, may have various points of data and other metrics associated with that possible threat, and machine learning algorithms look at the relevant points of data to support or disprove the particular hypothesis of what suspicious activity and / or anomalous behavior is associated with for each hypothesis about what suspicious activity and / or anomalous behavior is associated with. Networks have a wealth of data and metrics that can be collected, and then most of the data is filtered or aggregated by the collector into important / salient features of the data.

[0028] In an embodiment, the network module, the email module, and the network & email coordinator module may be part of a cyber threat module.

[0029] The cyber threat module may also use one or more machine learning models that are trained on cyber threats in the email system. The cyber threat module may reference models that are trained on normal behavior of mail and user activities associated with the email system. The cyber threat module can reference these various trained machine learning models as well as data from the network module, email module, and trigger module. The cyber threat module can determine a threat risk parameter that takes into account how a series of non-normal behaviors correlate to potential cyber threats, and "what is the likelihood of this series of one or more non-normal behaviors of the email and user activities under analysis that deviate from the obtained normal harmless behavior and thus are malicious behaviors."

[0030] The one or more machine learning models may be self-learning models that use unsupervised learning and are trained on normal behavior of different aspects of the system, e.g., email activity and user activity associated with the email system. The self-learning model of normal behavior is updated periodically. The self-learning model of normal behavior is updated when new input data is received and deemed within the range of normal behavior. Normal behavior thresholds are used by the model as a moving standard of parameters that correspond to normal life patterns for the computing system. The normal behavior thresholds move according to updated changes in the computer system, allowing the model to discern behavior on the computing system that deviates from the parameters set by the moving standard.

[0031] 10 shows a block diagram of one embodiment of a cyber threat module that compares the analyzed metrics on the user network and their respective varying criteria of parameters corresponding to the normal life patterns of the computing system used by the self-learning machine learning model, and the computer activity and email activity compared to the corresponding potential cyber threats. The cyber threat module can then determine a threat risk parameter indicative of the likelihood of a cyber threat according to the analyzed metrics and varying criteria of what is considered normal behavior.

[0032] The cyber threat defense system 100 may also include one or more machine learning models that are trained to gain an understanding of the features of the email itself and its associated data, including classifying properties of the email and its metadata.

[0033] The cyber threat module may also refer to a machine learning model that is trained on the email itself and its associated data to determine whether the email or set of emails under analysis has potentially malicious characteristics. The cyber threat module may also take this email characteristic analysis into account in its determination of the threat risk parameters.

[0034] The network module may have one or more machine learning models that are trained on the normal behavior of users, devices, and interactions between them on a network associated with the email system. The user interface has one or more windows for displaying network data, as well as one or more windows for displaying emails and cybersecurity details about those emails, on a display screen through the same user interface, allowing cyber professionals to pivot between the network data and the email cybersecurity details within one platform and view them as an interconnected whole, rather than separate areas on the same display screen.

[0035] The cyber threat module may also take this network analysis into account in its determination of the threat risk parameters.

[0036] The cyber threat defense system 100 may use at least three separate machine learning models (see also FIG. 9). Each machine learning model may be trained on a particular aspect of the normal life patterns for the system, such as devices, users, network traffic flows, output from one or more cybersecurity analysis tools that analyze the system, etc. One or more machine learning models may also be trained on the characteristics and aspects of all modalities of a type of cyber threat. One or more machine learning models may also be trained on the characteristics of email itself.

[0037] Both the Email module, which monitors email activity, and the Network module, which monitors network activity, can feed their data to the Network & Email Coordinator module to correlate causal relationships between these activities, and provide this input to the Cyber ​​Threat module. The application of these causal relationships is demonstrated in the block diagrams, Figures 10 and 11.

[0038] The cyber threat module may also take into account the causal relationship analysis of this particular email and network activity in its determination of the threat risk parameters (see FIG. 11).

[0039] The cyber threat defense system 100 uses various probes to collect user and email activity, which is then fed to a data store and, as appropriate, to the cyber threat module and machine learning models. The cyber threat module uses the collected data to draw in an understanding of email and user activity within the email system, as well as to update the training of one or more machine learning models trained on the email system and its users. For example, email traffic may be collected by placing hooks within email applications such as Outlook or Gmail, and / or by monitoring the Internet gateways through which emails are delivered. In addition, the probes may collect network data and metrics by one of the following methods: ports spanning the organization's existing network equipment, inserting or reusing inline network taps, and / or accessing any existing repositories of network data (see, e.g., FIG. 2).

[0040] The cyber threat defense system 100 may use multiple user interfaces. A first user interface may be constructed to present an inbox-style view of all of the emails entering / leaving the email system and any cybersecurity features known for the email or emails under analysis. A user interface with an inbox-style view of emails has a first window / column that displays the email or emails under analysis and a second window / column with all of the relevant security features known for that email or set of emails under analysis. Complex machine learning techniques determine anomaly scores that account for any deviations from normal that the emails represent, and these are displayed graphically in a familiar manner that users and cyber professionals can recognize and understand.

[0041] The cyber threat defense system 100 can then take action to combat the detected potential cyber threats.

[0042] The autonomous response module may be configured to trigger one or more rapid autonomous actions to be taken to thwart a cyber threat when a threat risk parameter from the cyber threat module, which is not a human taking action, is equal to or greater than a threshold that may guide the action. The cyber threat module configured in conjunction with the autonomous response module to trigger one or more autonomous actions to be taken to thwart a cyber threat, by responding to the cyber threat without waiting for any human intervention, improves computing devices in the email system by limiting the impact of the cyber threat from consuming unauthorized CPU cycles, memory space, and power consumption on the computing devices (see also FIG. 6).

[0043] The cyber threat defense system 100 may be hosted on the device, on one or more servers, and / or within its own cyber threat appliance platform (see, e.g., FIG. 2).

[0044] 2 shows a block diagram of one embodiment of a cyber threat protection system that monitors email and network activity, feeds this data into the interrelated causal relationships between these activities, and provides this input to cyber threat analysis. The network can include a variety of computing devices, such as desktop units, laptop units, smart phones, firewalls, network switches, routers, servers, databases, Internet gateways, the cyber threat protection system 100, etc.

[0045] The network module can monitor network activity using probes and also reference machine learning models that are trained on normal behavior of users, devices, and the interactions between them, or the Internet, which is then associated with the email system.

[0046] The user interface has both i) one or more windows for presenting / displaying network data, alerts, and events, and ii) one or more windows for displaying email data, alerts, events, and cybersecurity details about those emails through the same user interface on the display screen. These two sets of information shown on the same user interface on the display screen allow cyber professionals to pivot between network data and email cybersecurity details within one platform and view them as an interconnected whole rather than separate areas.

[0047] The network module and its machine learning models are utilized to determine potentially non-normal network activity to provide additional input of information to the cyber threat module to determine a threat risk parameter (e.g., a score or probability) indicative of the level of threat.

[0048] A particular user's network activity can be associated with their email activity as the Network Module monitors the network activity and the Network & Email Coordinator Module receives the Network Module observations and pulls it into an understanding of this particular user's email activity and makes an assessment of potential email threats with the resulting threat risk parameters adjusted for different users in the mail system. The Network Module tracks each user's network activity and sends it to the Network & Email Coordinator component to interconnect the network activity and email activity and closely inform each other's behavior and assessment of potential email threats.

[0049] The cyber threat defense system 100 here traces potentially malicious activity observed by the network module on the organization's network back to specific email events observed by the email module, and uses an autonomous rapid response module to shut down any potentially harmful activity on the network itself, and also freeze any similar email activity that triggers harmful activity on the network.

[0050] The probes collect user activity as well as email activity. The collected activity is fed into a data store and evaluated for non-normal or suspicious behavioral activity, e.g., alerts, events, etc., which are evaluated by a cyber threat module to derive an understanding of email and user activity within the email system. The collected data may also be used to potentially update training for one or more machine learning models that are trained on normal life patterns for the email system, its users, and the network and its entities.

[0051] An example probe for an email system may be configured to interface directly with an organization's email application, such as an Office 365 Exchange domain, and receive blind carbon copies (BCC) of all inbound and outbound communications. The email module examines emails to provide a comprehensive understanding of the patterns of life of an organization's email usage.

[0052] FIG. 3 shows a block diagram of one embodiment of a cyber threat module that determines a threat risk parameter that takes into account how a series of anomalous behaviors correlate to potential cyber threats, as well as the likelihood that this series of one or more non-normal behaviors of the email and user activity under analysis deviates from the obtained normal harmless behavior and is therefore malicious behavior.

[0053] The user interface 150 can graphically display the logic, data, and other details that the cyber threat module considers.

[0054] The user interface 150 displays an example email that, when subjected to analysis, exhibits characteristics such as headers, addresses, subject lines, senders, recipients, domains, etc. that are statistically inconsistent with normal emails similar to the example email.

[0055] Thus, the user interface 150 displays example email non-normal activity that it has classified as behaviorally anomalous.

[0056] During analysis, the email module can reference one or more machine learning models that are self-learning models trained on the normal behavior of email and user activity associated with the email system. This can include various email policies and rules that are configured for this email system. The cyber threat module can also reference models trained on the normal characteristics of email itself. The cyber threat module can apply these various trained machine learning models to data including metrics, alerts, events, and metadata from the network and email modules. In addition, a set of AI models can be responsible for learning the normal "pattern of life" of internal and external address identities in connection with other networks for each email user (see, e.g., FIG. 8 for a visual display of this data). This allows the system to disable malicious emails that deviate from the normal "pattern of life" of a given address identity for that user, its history, its peer group, and in relation to the broader organization.

[0057] The email module then has at least a first email probe inspect the email at the point where it passes through an email application, such as Office 365, to extract hundreds of data points from the raw email content and the sender's and recipient's historical email behavior. These metrics are combined with target recipient or sender's pattern of life data retrieved from a data store. The combined set of metrics is run through a machine learning algorithm to yield a single anomaly score for the email, and various combinations of metrics attempt to generate notifications that help define the "type" of the email.

[0058] Email threat alerts, such as type notifications, triggered by anomalous and / or non-normal behavior of "emails and any associated characteristics of those emails" are used by the cyber threat module to better identify any network events that may result from email-borne attacks.

[0059] In conjunction with specific threat alerts and anomaly scores, the system can prompt actions against emails designed to prevent delivery of the email or neutralize potentially malicious content.

[0060] The data store then stores the metrics and previous threat alerts associated with each email over a period of time, by default at least 27 days. This collection of data is fully searchable within the user interface 150, offering immense insight into mail flow for email administrators and security professionals.

[0061] The cyber threat module can then issue an anomaly rating even if the non-normal email is not closely related to any identifiable malicious email. This value indicates how non-normal the cyber threat module considers this email to be compared to the normal life patterns of the organization and the specific internal user (either the inbound recipient or the outbound sender). The cyber threat module considers over 750 metrics for non-normal behavior and organizational life patterns in a time window. For example, the cyber threat module considers metrics for non-normal behavior and organizational life patterns in the past 7 days as well as other auxiliary metrics when computing an anomaly score that is also considered in the final threat risk parameters.

[0062] 4 illustrates a block diagram of one embodiment of a cyber threat defense system that references one or more machine learning models that are trained on gaining an understanding of multiple features of the email itself and its associated data, including classifying properties of the email and its metadata. The email module system extracts metrics from all email inbound and outbound.

[0063] The user interface 150 can graphically display the logic, data, and other details considered by the cyber threat defense system.

[0064] The Cyber ​​Threat Module works in conjunction with machine learning models to analyze these metrics to develop rich patterns of life for email activity within the email system, which enables the Cyber ​​Threat Module in conjunction with the Email Module to identify non-normal and anomalous emails that have evaded / passed through existing email gateway defenses.

[0065] The email module detects emails whose content does not match normal patterns of content when received by this particular recipient.

[0066] An example analysis may be as follows. To what extent has the sender of this email had previous contact with individuals within the recipient's organization? How closely related is the recipient of this email to these individuals who have had previous contact with the sender? Does the content of this email match other emails sent or received by the intended recipient? If there is a link or attachment within the email that should be clicked or opened by the intended recipient, does this constitute anomalous activity relative to that individual's normal network behavior? Do the email properties match recent network activity for this particular user?

[0067] Thus, the cyber-threat module may also refer to a machine learning model that is trained on the email itself and its associated data to determine whether an email or set of emails under analysis has potentially malicious characteristics. The cyber-threat module may also take this email characteristic analysis into account in its determination of the threat risk parameter.

[0068] The email module can retrospectively process email application metadata, such as Office 365 metadata, to gain detailed knowledge of each of those users and their email addresses, communications, and routine operations. The power of the cyber threat module lies in leveraging this unique understanding of each of the email users, their history, their peer group, and their day-to-day email behavior in relation to the broader organization (see, for example, Figure 8 for a visual display of email address relevance data). By having knowledge of what is "normal" for a particular organization and specific individuals, rather than what fits a predefined template of malicious communications, the cyber threat module can identify sophisticated and sophisticated email campaigns that mimic harmless communications and place hidden threats as routine activity.

[0069] The email module then provides comprehensive email logs of all emails observed. These logs can be filtered using complex logical queries, and each email can be queried for a vast number of metrics within the email information stored in the data store.

[0070] Some example email characteristics that can be stored and analyzed are:

[0071] Email Destinations: Message destinations - outbound and inbound email.

[0072] Sent Time: The sent time is the date and time the email was originally sent, according to the message metadata.

[0073] Links: Every web link in an email has its own properties. Links to websites are extracted from the body of the email. Various attributes include, but are not limited to, location in the text, domain, frequency of occurrence of the domain in other emails, and how relevant it is to the anomaly scores of those emails, how well the domain fits into the normal life patterns of the email's intended recipients, their estimated peer groups, and their organizations.

[0074] Recipient: The recipient of an email. If an email was addressed to multiple recipients, each of these recipients can be viewed as a "recipient". Known identity properties of an email recipient, such as how well known the recipient is to the sender, descriptors of the volume of mail, and how email has changed over time, to what extent the recipient's email domain is involved within the network.

[0075] Subject:The email subject.

[0076] Attachments: All attachments associated with a message now appear as separate entries in the user interface, and each entry can be queried for metrics that are displayed and detailed. These include, but are not limited to, the attachment file name, the file type detected, a descriptor of the likelihood that the recipient will receive such a file, and a descriptor of the delivery of the file, such as all files in emails that violate various anomaly scores for those emails.

[0077] Header: Email headers are lines of metadata that accompany each message providing important information such as the sender, recipient, and message content type.

[0078] FIG. 10 illustrates an example of a network module that notifies an email module of a computer's network activity prior to a user of that computer receiving email containing content related to that network activity.

[0079] FIG. 11 illustrates an example of a network module that communicates inferred patterns of lifestyle information related to a computer's web browsing activity to an email module before a user of that computer receives an email containing content that is inconsistent with the lifestyle patterns.

[0080] The user interface may display a graph 220 of a series of example non-normal behaviors for the email in relation to other networks under analysis.

[0081] The Network & Email module can tie alerts and events from the email domain to alerts and events from the network domain.

[0082] The cyber threat module interfaces with one or more machine learning models that are trained and otherwise configured with mathematical algorithms for cyber threat analysis to infer what may happen due to a set of disparate alerts and / or events that result from a non-normal pattern, and then assign a threat risk associated with the disparate items of the set of alerts and / or events that form the non-normal pattern.

[0083] This is a "behavior pattern analysis" of what is the non-normal behavior of the network / system / device / user / email under analysis by the cyber threat module and machine learning model. The cyber defense system uses the non-normal behavior that deviates from the normal behavior and then builds a chain of non-normal behaviors and causal relationships between this chain of non-normal behaviors to detect cyber threats. An example behavior pattern analysis of what is non-normal behavior may be as follows: Non-normal patterns may be determined by filtering out activities / events / alerts that fall within a window of being a normal pattern of life for that network / system / device / user / email under analysis, and then the remaining activity / event / alert behavior pattern, after filtering, may be analyzed to determine if the pattern is indicative of a malicious party behavior - human, program, email, or other threat. The defense system may go back and pull out some of the filtered out normal activities to help support or refute a possible hypothesis of whether the pattern is indicative of a malicious party behavior. An example behavior pattern included in the chain is shown in a graph over an example 7-day time frame. The prevention system detects three instances of a series of anomalous behaviors of non-normal data transfers, and three instances of non-normal characteristics in emails in the monitored system that appear to have some causal relationship to the non-normal data transfers. Similarly, two instances of non-normal credentials attempting the non-normal behavior of gaining access to an information sensitive area, or malicious IP addresses and users associated with non-normal credentials attempting the non-normal behavior, have a causal relationship to at least one of those three emails with the non-normal characteristics. When the behavioral pattern analysis of the individual behaviors or the chain as a group is deemed to be indicative of a malicious threat, a score is generated of how confident the prevention system is in this assessment that it identifies whether the non-normal pattern was caused by a malicious party.Further assigned then is a threat level parameter (e.g., a score or probability) indicating what level of threat this malicious party poses to the system. Finally, the cyber threat defense system is configurable within its user interface of the defense system as to what type of automatic response action, if any, the defense system may take for different types of cyber threats that are equal to or greater than the configurable level of threat when posed by this malicious party.

[0084] The cyber threat module may connect the individual alerts and events that form the non-normal pattern into a disparate item for cyber threat analysis of that series of disparate alerts and / or events. The cyber threat module may reference one or more machine learning models trained on email threats to identify similar features from the individual alerts and / or events that form the disparate item made up of the series of alerts and / or events that form the non-normal pattern.

[0085] One or more machine learning models may also be trained on the characteristics and aspects of all modalities of a cyber threat type to analyze the threat risk associated with a series / group of alerts and / or events that form an abnormal pattern. Machine learning techniques using advanced mathematics can detect previously unidentified threats and automatically defend the network without rules.

[0086] The model may be implemented by threat detection through probabilistic changes in normal behavior by application of unsupervised Bayesian mathematical models to detect behavioral changes in computers and computer networks. The core threat detection system is called "Bayesian Probability". The Bayesian Probability approach can determine periodicity in multiple time series data and identify changes across single or multiple time series data for the purpose of anomalous behavior detection. A large number of metrics can be obtained from email and network raw sources of data, each of which provides time series data for a given metric.

[0087] The detectors within the cyber-threat module, including its network module and email module components, may be discrete mathematical models that implement specific mathematical methods on different sets of variables with targets, such that each model is specifically targeted to, for example, i) the pattern of life of alerts and / or events brought about by its cybersecurity analysis tools, ii) analyzing various aspects of emails, iii) specific devices and / or users within the system, etc.

[0088] Fundamentally, a cyber threat defense system mathematically characterizes what constitutes "normal" behavior based on the analysis of a large number of different measures / sets of different measures of a device's network behavior. The cyber threat defense system can build an elaborate "pattern of life" that understands what represents normal for every person, device, email activity, and network activity within the system being protected by the cyber threat defense system.

[0089] As discussed, each machine learning model may be trained on a particular aspect of the system's normal pattern of life, such as devices, users, network traffic flows, output from one or more cybersecurity analysis tools that analyze the system, email contact associations for each user, email features, etc. One or more machine learning models may use at least an unsupervised learning algorithm to establish what the normal pattern of life of the system is. Machine learning models may be trained on both i) the past normal delivery of alerts and events for that system, and ii) normal delivery information from similar peer systems is taken into account to establish the normal pattern of life of alert and / or event behavior for that system. Another set of machine learning models is trained on email features and the activities and behavior of that email user to establish normal for these.

[0090] Note that when the model detects anomalies by leveraging at least two different approaches: e.g., comparing the behavior of each system with its own history, and comparing it with the history of its peers, and / or, e.g., comparing an email with both the email's characteristics and the activity and behavior of that email user, this multi-source comparison allows the model to avoid learning existing bad behavior as "normal" since compromised devices / users / components / emails will exhibit different behavior than their close peers.

[0091] In addition, one or more machine learning models can use a comparison between i) normal life patterns for the system corresponding to past normal delivery of alerts and events for the system mapped in the same multi-dimensional space, and ii) the current set of individual alert and event behaviors under analysis. This comparison can result in the detection of one or more non-normal patterns of behavior within the plotted individual alerts and / or events, which allows for the detection of previously unidentified cyber threats compared to simply finding cyber threats using predefined descriptive objects and / or signatures. Thus, increasingly sophisticated malicious cyber threats that try to pick and choose when they act to generate low-level alerts and events will still be detected, even if they have not yet been identified by other means of cyber analysis. These sophisticated malicious cyber threats can include malware, spyware, keyloggers, malicious links in emails, malicious attachments in emails, etc., as well as rogue internal information technology staff who know well how not to trigger any high-level alerts or events.

[0092] Essentially, plotting and comparing is a way to filter out what is normal for the system and then focus the analysis on what is abnormal or non-normal for the system. Then, for each hypothesis of what may happen due to a set of non-normal events and / or alerts, the collector module can gather additional metrics from the data store that originally contained the pool of metrics considered "normal behavior" to support or refute each possible hypothesis of what may happen due to this set of non-normal behavior under analysis.

[0093] It should be noted that each individual alert and / or event within a chain of alerts and / or events forming a non-normal pattern may exhibit subtle anomalous behavior and thus each alert and / or event may have a low threat risk associated with that individual alert and / or event. However, when analyzed as a chain of disparate alert and / or event behaviors forming a chain of non-normal patterns by one or more machine learning models, that disparate chain of alerts and / or events may now be determined to have a much higher threat risk than any of the individual alerts and / or events within the chain.

[0094] In addition, note that today's cyber attacks can be of such severity and velocity that a human response cannot occur fast enough. Thanks to these self-learning advances, machines are now able to discover these emerging threats and deploy appropriate real-time responses to counter the most serious cyber threats.

[0095] Threat detection systems have the ability to self-learn and detect normality to spot true anomalies, allowing organizations of all sizes to understand the behavior of users and machines on their networks at both individual and group levels. Monitoring behavior, rather than using predefined descriptive objects and / or signatures, means that more attacks can be spotted up front and even the most subtle indicators of fraud can be detected. Unlike traditional legacy defenses, a particular attack type or new malware does not need to be seen in the first place before it can be detected. Behavioral defense approaches behaviorally and mathematically model both machine, email, and human activity during and after a security breach to predict and understand today's increasingly sophisticated cyber attack vectors. It is therefore possible to computationally establish what is normal and then detect what is abnormal. Additionally, machine learning uses probabilistic mathematics to constantly revisit assumptions about behavior. The unsupervised machine learning methods of cyber threat defense systems do not require training data with predefined labels. Instead, they can identify key patterns and trends within the data without the need for human input.

[0096] The user interface and output module may also project the individual alerts and / or events that form the chain of behavior onto a user interface with at least three dimensions: i) a horizontal axis of a window of time, ii) a vertical axis of a scale indicating the threat risk assigned to each alert and / or event in the chain, and iii) a third dimension of different colors (e.g., red, blue, yellow, etc., and in the case of grayscale, different shades of gray black and white with potentially different hash patterns) for similar features shared between the individual alerts and events that form distinct items of the chain. These similarities of events and / or alerts in the chain may be, for example, alerts or events brought about by the same device, same user credentials, same group, same source ID, same destination IP address, same type of data transfer, same type of non-normal activity, same type of alert, same unusual connections being made, same type of event, etc., so that a human can visually see what makes up a particular chain spatially and content-wise, rather than simply browsing a text log of data. Note that when a human mind visually sees the projected patterns and corresponding data, the human can ultimately determine whether a cyber threat is posed. Again, at least a three-dimensional projection helps the human synthesize this information more easily. The visualization on the user interface allows the cyber threat defense system to see data that supports or disproves why these aggregated alerts and / or events may be potentially malicious. Also, instead of generating a simple binary output "malicious" or "benign," the cyber threat defense system's mathematical algorithms result in outputs that indicate different degrees of potential security compromise.

[0097] The cyber threat defense system 100 may use at least three separate machine learning models. Each machine learning model may be trained on a particular aspect of the normal life patterns for the system, such as devices, users, network traffic flows, output from one or more cybersecurity analysis tools that analyze the system, etc. One or more machine learning models may also be trained on the characteristics and aspects of all modalities of a type of cyber threat. One or more machine learning models may also be trained on the characteristics of email itself.

[0098] In embodiments, one or more models may be trained on specific aspects of these broad concepts: for example, models may be specifically trained on relevance, attachments, compliance, data loss & transfer, conventions, metadata, hygiene, links, proximity, spoofing, type, validation, and other anomalies.

[0099] So, for example, the first email model retroactively processes Office 365 metadata to gain detailed knowledge of users, email addresses, communication partners, and routine operations. Even in an environment with encrypted email, cyber defense systems can derive key markers from the metadata and provide valuable insight into communication partner identities, communication frequency, and potential risk.

[0100] Additionally, the one or more machine learning models can be self-learning using unsupervised learning algorithms. For example, a set of one or more machine learning models can be trained on the normal behavior of users and their emails, using data from probes to train and therefore periodically updating what the baseline of normal behavior is. This autonomous self-learning defense system protects against malicious activity within email domains, whether the malicious activity is i) standard threat actors from email, such as phishing and malware emails, and ii) insider threats from users, and it does not rely solely on a priori known arbitrary ideas of malicious email domain activity, but instead autonomously contextualizes each communication to evaluate its anomalies against the standard behavior of users and organizations.

[0101] As described above, one or more models may be trained on a compliance concern, however, the trained models may also be used to satisfy a compliance concern even if no models are specifically trained on the compliance issue.

[0102] The power of the Cyber ​​Threat Module lies in leveraging this unique understanding of daily user email behavior in relation to the user's history, the user's peer group, and the broader organization. By having knowledge of what is "normal" for a particular organization and specific individuals, rather than what fits a predefined template of malicious communications, the Cyber ​​Threat Module is able to identify sophisticated and sophisticated email campaigns that mimic harmless communications and place hidden threats as routine activity.

[0103] FIG. 6 illustrates a block diagram of one embodiment of an example window of a user interface of a cyber threat protection system to allow emails in the email system to be filterable, searchable, and sortable.

[0104] The user interface 150 allows emails in the email system to be filterable, searchable, and sortable, with an appearance configured to be in the style of an email application user interface 150 familiar to typical users. The user interface 150 allows emails in the email system to be filterable, searchable, and sortable to customize and target one or more emails under analysis in a first window, and then show them next to a second window with the relevant security features known for those one or more emails. Thus, these two windows display their respective information on the same display screen, and this user interface 150 allows the cyber professional to analyze the emails under analysis to better assess whether those one or more emails are in fact a cyber threat. The user interface 150 gives the cyber professional the ability to explore and customize highly complex machine learning and then view the resulting analysis of an email or set of emails in a graphical user interface 150 that is easy to grasp and familiar in appearance.

[0105] The user interface 150 can be used to investigate threats and gain better insight into an organization's email hygiene. This can help security teams implement programs tailored to different levels of users in the user's system that protect key executives and other likely targets from attacks, including phishing campaigns and supply chain attacks in different modalities, from other users in the system.

[0106] The user interface 150 can also display the exact logic of why the autonomous response was invoked.

[0107] In the search field, cyber experts can create natural language and / or structured Boolean searches to perform global omni searches on users, email addresses, domains, observed links, aliases, and the like.

[0108] In the date range field, the cyber expert can have only data that falls within a particular time frame to be displayed.

[0109] The filter target field allows the cyber professional to select which parts of the email message are examined against the query logic.

[0110] An embodiment of a user interface having an inbox-style view of all emails entering / leaving an email system and any cybersecurity features known for one or more emails under analysis. The user interface having an inbox-style view of emails has at least a first window / column that displays one or more emails under analysis, and a second window with all of the relevant security features known for that email or set of emails under analysis.

[0111] Similarly, on another level, the user interface has one or more windows for displaying network data, as well as one or more windows for displaying emails and cybersecurity details about those emails, on a display screen through the same user interface, thereby enabling cyber professionals to pivot between the network data and the email cybersecurity details within one platform and view them as an interconnected whole rather than separate areas on the same display screen.

[0112] FIG. 7 illustrates a block diagram of one embodiment of example autonomous actions that the autonomous rapid response module may be configured to take without a human initiating the action.

[0113] The autonomous rapid response module is configurable, via the user interface 150, to know when to take autonomous action to stop a cyber threat when i) a known malicious email or ii) an email that is at least highly likely to be malicious is determined by the cyber threat module. The autonomous rapid response module has management tools that are configurable through the user interface to program / set what are the autonomous actions that the autonomous rapid response module can take, including the type of action and the specific action that the autonomous rapid response module can take, when the cyber threat module indicates that the threat risk parameter is equal to or greater than a threshold that can guide an action selectable by a cyber expert, i.e., at least highly likely to be malicious.

[0114] The types of actions and specific actions that the autonomous rapid response module can take are customizable for different users and parts of the system, and therefore can be configured for cyber experts to approve / set for the autonomous rapid response module to automatically take those actions and when those actions should be taken automatically.

[0115] The autonomous rapid response module has a library of response action types and specific actions that are possible for the autonomous rapid response module, including focused response actions selectable through the user interface 150 that are contextualized to take autonomously against specific email elements of a malicious email, rather than a blanket quarantine or block approach to the email, to avoid business disruptions to specific users of the email system. The autonomous rapid response module can take a variety of measured actions directed at those email communications to minimize business disruptions in a responsive, contextualized manner.

[0116] The autonomous response module partners with AI models to neutralize malicious emails and deliver preemptive protection against targeted email-borne attack campaigns in real-time.

[0117] A cyber threat module working in conjunction with an autonomous response module may, for example, detect and stop an infection within a network, recognize that this infection has email as its source, and identify and neutralize the malicious email by deleting it from the corporate email account inbox or simply stripping the malicious portion of the email before it reaches its intended user. Autonomous actions may range from flattening attachments or stripping suspicious links to stopping the email entirely if it poses sufficient risk.

[0118] The cyber threat module can identify the source of the security breach and then invoke an autonomous unsuccessful response action by sending a request to the autonomous response model that can quickly halt the spread of an emerging attack campaign and give human responders the critical time they need to catch up.

[0119] In an embodiment, the autonomous response module may initially run in a human review mode, where all autonomous intelligent interventions must first be reviewed by a human operator. As the autonomous response module refines and attaches special significance to its understanding of the organization's email behavior, the level of autonomous action may be increased until no human oversight is required for each autonomous response action. Most security teams reach this level and spend very little time in the user interface 150. At this time, the autonomous response module response actions neutralize malicious emails without the need for any active management. The autonomous response module may take one or more proactive or reactive actions against email messages observed to be potentially malicious. Actions are triggered by threat alerts or by the level of anomalous behavior as defined and detected by the cybersecurity system, providing highly customizable targeted response actions to email threats that allow end users to remain safe without intervention. Suspicious email content may be fully withheld for further inspection or certification for release, but autonomously selected users are exempt from this policy. User behavior and notable events can be mapped and detailed comprehensive email logs can be filtered by a wide range of metrics compared to models of normal behavior to release or remove potentially malicious content from emails. Examples of possible actions

[0120] The following example action sections, categorized as delivery actions, attachment actions, link actions, header and body actions, etc., appear on the dashboard and may be taken, or at least suggested to be taken, by the autonomous response module when threat risk parameters are equal to or above configurable set points set by a cybersecurity expert.

[0121] Hold message: The autonomous response module holds a message before delivery due to suspicious content or attachments. The held email can be reprocessed and released by an operator after investigation. The email is deleted from the recipient's inbox if delivery is prevented or delivery has already occurred. The original email is kept in a buffer cache by the data store and can be recovered or sent to an alternate mailbox using a "Release" button in the user interface 150.

[0122] Lock the link: The autonomous response module replaces the URL of the link such that clicking on the link will first divert the user to an alternative destination. The alternative destination may optionally require confirmation from the user before proceeding. The original link destination and original source are subject to additional checks before the user is allowed access to that source.

[0123] Convert attachments: The autonomous response module converts one or more attachments to this email into a secure format, typically by converting to PDF with an initial image conversion to flatten the file. This conveys the contents of the attachment to the intended recipient, but with greatly reduced risk. For attachments that are visual in nature, such as images, pdfs, and Microsoft Office formats, the attachment is processed into an image format and then rendered into a PDF (for Microsoft Office formats and PDFs) or an image in the original file format (for images). In some email systems, the email attachment may first be removed and replaced with a notice informing the user that the attachment is under processing. Once processing is complete, the converted attachment is inserted back into the email.

[0124] Double-lock the link: The autonomous response module replaces the URL with a redirected email link. When this link is clicked, the user is presented with a notification that they are not authorized to access the original destination of the link. The user cannot follow the link to the original source, but the user's intent to follow the link is recorded by the data store via the autonomous response module.

[0125] Strip Attachment: The autonomous response module strips one or more attachments from this email. Most file formats are delivered as converted attachments. File formats that do not convert to a visible document (e.g. executables, compressed types) are stripped to reduce risk. The "Strip Attachment" action causes the system to remove the attachment from the email and replace it with a file that informs the user that the original attachment was removed.

[0126] Junk Actions: The autonomous response module ensures that emails classified as junk or otherwise malicious emails are diverted to the recipient's junk folder, or other designated destination, such as "quarantine."

[0127] Redirect: The autonomous response module ensures that an email is not delivered to the intended recipient, but instead is delivered to a specific email address.

[0128] Copy: The autonomous response module ensures that the email is delivered to the original recipient, but a copy is sent to another specific email address.

[0129] Hold or Do Not Alter: Can be set on specific user criteria. The autonomous response module ensures that emails are never held back and never altered in any way by the system, regardless of actions performed by other models or triggered by the general threat level.

[0130] Take no action on attachments: Can be set on a specific user basis. This action overrides any attachment actions that might otherwise be taken by the autonomous response module, whether in response to a specific threat alert or in response to a globally detected anomaly level.

[0131] Header and Body Behavior: The autonomous response module inserts specific custom text into the email body or subject line to add to or replace existing text, images, or other content in the email's header and / or body.

[0132] Spoofing Removal: The autonomous response module identifies standard email header address fields (e.g., rfc822 types) and replaces personal names and header email addresses with alternative names or email addresses that may be more revealing about the true sender of the email. This mechanism significantly reduces the psychological impact of spoofing attempts.

[0133] FIG. 8 shows a block diagram of one embodiment of an email module, showing how relationships between email addresses can be visually presented.

[0134] The recipients, senders, and contact lists of each user can be graphed to see how close a relationship exists and therefore how likely or unusual it is that this recipient will receive email from this sender and vice versa.

[0135] The network module and its machine learning model and the email module and its machine learning model are utilized to determine potentially non-normal network activity that provides additional input of information to the cyber threat module to determine threat risk parameters. Network activity of particular users can be associated with their email activity as the network module monitors network activity and the cyber threat module receives the network module observations and pulls them into an understanding of the email activity of this particular user to make an assessment of potential email threats with the resulting threat risk parameters adjusted for different users in the mail system.

[0136] Sender Interactions: The first section of the user interface graphically depicts an example of email interactions observed by the email module for a sender email address. The sender node is the central node, and the recipients of a particular selected message are indicated by larger connecting nodes.

[0137] Recipient Interactions: The second section of the user interface graphically represents all instances of email interactions observed by the email module for a recipient email address. The recipient node is the central node, and the senders of the particular messages selected are represented by larger connecting nodes.

[0138] The email module tracks whether a domain is internal or external relative to the domain of the email application it is monitoring, so that to external recipients / senders, others from those organizations or domains also appear external. Defense Systems

[0139] FIG. 9 illustrates an example of a cyber threat defense system protecting an example network. Example Network FIG. 9 illustrates an example of a network of computer systems 50 using a threat detection system. The system depicted by FIG. 9 illustrates a simplified example provided to facilitate the description of the present invention. The system 50 comprises a first computer system 10 in a building that uses the threat detection system to detect, and thereby attempt to prevent, threats to computing devices within its range. The first computer system 10 comprises three computers 1, 2, 3, a local server 4, and a multifunction device 5 that provides printing, scanning, and faxing functions to each of the computers 1, 2, 3. All of the devices in the first computer system 10 are communicatively coupled via a local area network 6. As a result, all of the computers 1, 2, 3 can access the local server 4 via the LAN 6 and use the functions of the MFD 5 via the LAN 6.

[0140] The LAN 6 of the first computer system 10 is connected to the Internet 20 which in turn provides the computers 1, 2, 3 with access to a number of other computing devices including a server 30 and a second computer system 40. The second computer system 40 also includes two computers 41, 42 connected by a second LAN 43.

[0141] In this exemplary embodiment of the invention, the computer 1 on the first computer system 10 has a threat detection system and therefore executes a threat detection method for detecting threats to the first computer system. The computer 1 therefore comprises a processor configured to execute the steps of the process described herein, a memory required to store information regarding the execution of this process, as well as a network interface for collecting the required information. This method shall now be described in detail with reference to FIG. 9.

[0142] Computer 1 builds and maintains a dynamic, ever-changing model of the "normal behavior" of each user and machine in system 10. The approach is based on Bayesian mathematics and monitors all interactions, events, and communications within system 10 - which computers talk to which computers, files created, networks accessed.

[0143] For example, computer 2 is based in the company's San Francisco office and is operated by a marketing employee who regularly accesses the marketing network and typically communicates with a machine in the company's UK office in the second computer system 40 from 9:30 am to noon and is active from approximately 8:30 am to 6:00 pm. This same employee virtually never accesses an employee timesheet, rarely connects to the company's Atlanta network, and has no business in Southeast Asia. The threat detection system takes all available information about this employee and establishes a "pattern of life" for that person that is dynamically updated as more information is gathered. The "normal" model is used as a moving standard, enabling the system to spot behavior on the system that appears to deviate from this normal pattern of life and flag this behavior as an anomaly for further investigation.

[0144] Threat detection systems are built to address the fact that today's attackers are becoming increasingly cautious, and may "hide" in a system using normal software protocols to ensure that they avoid raising suspicions in the end user, such as by slowing down the user's machine. Thus, any attack process will stop or "back down" if the mouse or keyboard is used. However, still more sophisticated attacks try the opposite, hiding in memory as normal processes and stealing CPU cycles only when the machine is active in an attempt to defeat relatively simple security processes. These sophisticated attackers look for activity that is not directly associated with user input. Advanced Persistent Threat (APT) attacks typically have very long mission windows, weeks, months, or years, and such processor cycles may not be stolen very frequently so as not to impact machine performance. However, no matter how hidden and sophisticated an attack is, there will be a measurable difference, even if extremely slight, in typical machine behavior before and after a security breach. This difference in behavior can be observed and acted upon in the form of Bayesian mathematical analysis used by a threat detection system installed on computer 1.

[0145] The cyber defense self-learning platform uses machine learning techniques. Using advanced mathematics, machine learning techniques can detect previously unidentified threats and automatically defend the network without rules. Note that today's attacks can be of such severity and velocity that a human response cannot occur fast enough. Thanks to these self-learning advancements, it is now possible for machines to discover emerging threats and deploy appropriate real-time responses to counter the most serious cyber threats.

[0146] Cyber ​​threat defense systems build sophisticated "patterns of life" that understand what represents normal for all person, device, and network activity within the systems protected by the cyber threat defense system.

[0147] Threat detection systems have the ability to self-learn and detect normality to distinguish true anomalies, allowing organizations of all sizes to understand the behavior of users and machines on their networks at both individual and group levels. Monitoring behavior, rather than using predefined descriptive objects and / or signatures, means that more attacks can be identified in advance and even the most subtle indicators of fraud can be detected. Unlike traditional legacy defenses, a particular attack type or new malware does not need to be seen in the first place before it can be detected. A behavioral defense approach behaviorally and mathematically models both machine and human activity during and after the point of compromise to predict and understand today's increasingly sophisticated cyber attack vectors. It is therefore possible to computationally establish what is normal and then detect what is abnormal.

[0148] This intelligent system is capable of making value judgments and performing higher value, more thoughtful tasks. Machine learning requires complex algorithms to be devised and a general framework for interpreting the results that are generated. However, when applied correctly, these approaches can facilitate machines to make logical, probability-based decisions and undertake thoughtful tasks.

[0149] Advanced machine learning is at the forefront of the fight against automated and human-initiated cyber threats, overcoming the limitations of rules- and signature-based approaches. Machine learning learns what is normal in a network – it does not rely on knowledge of previous attacks. Machine learning thrives at the scale of complexity and diversity of modern business, where every device and person is slightly different. Machine learning puts attacker innovation at the disposal of the attacker – any non-normal activity is visible. · Machine learning uses probabilistic mathematics to constantly revisit assumptions about behavior. · Machine learning is always up-to-date and does not rely on human input. Utilizing machine learning in cybersecurity technology is difficult, but when implemented correctly, it is extremely powerful. Machine learning means that previously unidentified threats can be detected even when their manifestations fail to trigger any rule sets or signatures. Instead, machine learning allows the system to analyze large data sets and learn the "patterns of life" of what it sees.

[0150] Machine learning can approximate some human capabilities to machines, such as: · Thinking: Machine learning uses past information and insights to form its judgments. · Real-time: The system processes information instantly. Self-improvement: A model’s machine learning understanding is constantly challenged and adapted based on new information.

[0151] Thus, novel unsupervised machine learning enables computers to recognize emerging threats without prior warning or supervision. Unsupervised Machine Learning

[0152] Unsupervised learning solves a problem without predefined labels. If you sort a set of different animals, the system analyzes the information and figures out the different classes of animals. This allows the system to handle the unexpected and embrace uncertainty. The system doesn't always know what it's looking for, but it can independently classify data and detect compelling patterns.

[0153] Unsupervised machine learning methods of cyber threat defense systems do not require training data with predefined labels. Instead, they can identify key patterns and trends in data without the need for human input. The advantage of unsupervised learning is that it allows a computer to go beyond what the computer's programmer already knows and discover previously unknown relationships.

[0154] The Cyber ​​Threat Prevention System uses a unique implementation of unsupervised machine learning algorithms to analyze network data at scale, intelligently dealing with the unexpected and embracing uncertainty. Instead of relying on knowledge of past threats to know what to look for, it can independently classify data and detect compelling patterns that define what may be considered normal behavior. Any novel behavior that deviates from those that constitute this notion of "normality" may indicate a threat or security breach. The impact of the Cyber ​​Threat Prevention System's unsupervised machine learning on cybersecurity is transformative. Threats that would otherwise go undetected can be identified, highlighted, contextually prioritized, and isolated using these algorithms. The application of machine learning has the potential to provide full network visibility and much greater levels of detection, ensuring that networks have internal defense mechanisms. Machine learning has the ability to learn when to launch automated responses to the most serious cyber threats, disrupting ongoing attacks before they become a danger to the organization.

[0155] This novel mathematics not only identifies important relationships in the data, but also quantifies the uncertainty associated with such inferences. Knowing and understanding this uncertainty allows many results to be organized into a coherent framework based on Bayesian probability analysis. The mathematics behind machine learning is highly complex and difficult to understand properly. Robust and reliable algorithms are developed with scalability that enables their successful application in real-world environments. overview

[0156] In an embodiment, details of the machine learning algorithm and approach of the cyber threat protection system are as follows:

[0157] The Cyber ​​Threat Defense System's probabilistic approach to cybersecurity is based on a Bayesian framework. It allows us to synthesize a large number of weak indicators of potentially anomalous network behavior to produce a single, unambiguous measure of how likely a network device is to be compromised. This probabilistic mathematical approach provides the ability to make sense of important information in the noise of the network, even when you don't know what you're looking for. Threat ranking

[0158] Importantly, the Cyber ​​Threat Prevention System's approach accounts for the inevitable ambiguity present in the data and distinguishes between slightly different levels of evidence that different data may contain. Instead of generating a simple binary output "malicious" or "benign," the Cyber ​​Threat Prevention System's mathematical algorithms result in outputs that indicate different degrees of potential security compromise. This output allows users of the system to rank different alerts in a rigorous fashion to prioritize those that most urgently require action, while simultaneously eliminating the many false positive issues associated with rule-based approaches.

[0159] At their core, cyber threat defense systems mathematically characterize what constitutes "normal" behavior based on the analysis of a large number of different measures / sets of different measures of device network behavior. Examples include: Server Access Data Access Event timing · Use of credentials DNS Requests Other similar parameters

[0160] Each measure of network behavior is then monitored in real time to detect anomalous behavior. Clustering

[0161] To properly model what should be considered normal for a device, its behavior must be analyzed in the context of other similar devices on the network. To accomplish this, cyber threat prevention systems leverage the strengths of unsupervised learning to algorithmically identify naturally occurring groupings of devices, a task that is impossible to do manually on even a moderately sized network.

[0162] To achieve as holistic a view of the relationships within the network as possible, the cyber threat defense system simultaneously employs several different clustering methods, including matrix-based clustering, density-based clustering, and hierarchical clustering techniques. The resulting clusters are then used to inform exemplary behavior modeling for individual devices. Clustering: At a glance Analyze behavior within the context of other similar devices on the network. · The algorithm identifies naturally occurring groupings of devices that would be impossible to do manually. · Run several different clustering methods simultaneously to inform the model. Network Topology

[0163] Any cyber threat detection system must also recognize that a network is much more than the sum of its individual parts, that most of its meaning is contained in the relationships between its different entities, and that complex threats can often induce subtle changes in this network structure. To capture such threats, cyber threat defense systems employ several different mathematical methods so that they can model multiple aspects of the network topology.

[0164] One approach is based on iterative matrix methods that reveal significant connectivity structures within the network. In parallel with these, cyber threat defense systems have developed an innovative application of models from the field of statistical physics that allow modeling the "energy landscape" of a network to reveal the underlying structure of anomalies hidden within it. Network Structure

[0165] A further significant challenge in modeling the behavior of network devices, as well as the network itself, is the high-dimensional structure of the problem with the presence of a large number of potential predictor variables. Observing packet traffic and host activity in enterprise LANs, WANs, and clouds is difficult because both inputs and outputs may contain many interrelated features (such as protocols, source and destination machines, log changes, and rule triggers). Learning a sparse and coherently structured predictor function is critical to avoid the harms of overfitting.

[0166] In this context, cyber threat defense systems employ state-of-the-art large-scale computational approaches to learn sparse structures in models of network behavior and connectivity based on applying L1-regularization techniques (e.g., the Rathau method), which assigns efficiently solvable convex optimization problems and allows the discovery of true associations between different network components and events that can result in parsimonious models. Recursive Bayesian Estimation

[0167] To combine these multiple analyses of different measures of network behavior to generate a single, comprehensive picture of the state of each device, the cyber threat defense system leverages the strengths of Recursive Bayesian Inference (RBE) through the implementation of a Bayes filter.

[0168] Using RBE, the mathematical models of cyber threat defense systems can constantly adapt in a computationally efficient manner as new information becomes available to the system: they continually recalculate threat levels in light of new evidence and identify changing attack behaviors where traditional signature-based methods fail.

[0169] The Cyber ​​Threat Prevention System's innovative approach to cyber security pioneered the use of Bayesian methods to track changing device behavior and computer network structure. At the core of the Cyber ​​Threat Prevention System's mathematical modeling is the determination of exemplary behavior, enabled by a sophisticated software platform that allows the mathematical model to be applied to novel network data in real time. The result is a system that can identify subtle variations in machine events in computer network behavior history that may indicate a cyber threat or security breach.

[0170] Cyber ​​threat defense systems use mathematical analysis and machine learning to detect potential threats, allowing the system to stay ahead of emerging risks. The Cyber ​​threat defense system approach means that detection no longer relies on archives of previous attacks. Instead, attacks can be discerned against a contextual understanding of what represents normality within the network. No predefinition is required, which allows for the most likely insight and defense against today's threats. In addition to detection capabilities, Cyber ​​threat defense systems can automatically create digital antibodies as an immediate response to the most threatening cyber breaches. The Cyber ​​threat defense system approach both detects and defends against cyber threats. Pure unsupervised machine learning removes the reliance on signature-based approaches to cyber security that are not working. Cyber ​​threat defense system technology can become an essential tool for security teams looking to understand the scale of their networks, observe levels of activity, and detect potential weak areas. These no longer need to be manually hunted down, but are flagged by automated systems and ranked as to their significance.

[0171] Machine learning techniques are a fundamental ally in defending systems against today's hackers and insider threats, and in formulating responses to unknown methods of cyber attacks. It is a groundbreaking step change in cybersecurity. Defense must start inside. Example Method

[0172] The threat detection system shall now be described in further detail with reference to the process flow performed by the threat detection system for automated detection of cyber threats through probabilistic changes in normal behavior by application of unsupervised Bayesian mathematical models to detect behavioral changes in computers and computer networks.

[0173] The core threat detection system is called "Bayesian Probabilistic," a Bayesian system that automatically determines periodicities in multiple time series data and identifies changes across single or multiple time series data for the purpose of anomalous behavior detection.

[0174] Human, machine, or other activity is modeled by first ingesting data from several sources in step S1 and deriving secondary metrics from the raw data in step S2.

[0175] Raw data sources include, but are not limited to: Raw network IP traffic captured from IP or other network TAPs or SPAN ports Machine-generated log files ·Building access ("swipe card") systems IP and non-IP data flowing through distributed Industrial Control Systems (ICS) networks Individual machine, peripheral, or component power usage Telecommunications signal strength, and / or Machine-level performance data from on-host sources (CPU usage / memory usage / disk usage / disk free space / network usage / etc.)

[0176] From these raw data sources, a large number of metrics can be obtained, each yielding time series data for a given metric. The data is dumped into individual time slices (e.g., the number of observations can be counted per second, per 10 seconds, or per 60 seconds), which can be combined at a later stage as needed to provide longer range values ​​for any multiple of the selected internal size. For example, if the underlying time slice selected is 60 seconds long, each metric time series stores a single value for that metric every 60 seconds, and then any new time series data for a fixed multiple of 60 seconds (120 seconds, 180 seconds, 600 seconds, etc.) can be calculated without loss of accuracy. Metrics are selected directly and fed into Bayesian probabilities by low-order models that reflect some inherent underlying part of the data and can be derived from the raw data with specific domain knowledge. The metrics obtained depend on the threats the system is looking for. It is common that a large number of metrics for a wide range of potential threats should be obtained to provide a secure system. Communications from components in your network contacting known suspicious domains.

[0177] The actual metrics used are largely irrelevant to the Bayesian probabilistic systems described here, but some examples are provided below.

[0178] Metrics derived from network traffic may include data such as: · The number of bytes of data entering or leaving a networked device per time interval. File access. ·Commonality / uniqueness of communication processes · Invalid SSL certificate. ·Failed authentication attempts. · Email access patterns.

[0179] When TCP, UDP, or other transport layer IP protocols are used across the IP network, and when alternative internet layer protocols are used (e.g., ICMP, IGMP), knowledge of the structure of the protocols in use and basic packet header analysis can be utilized to generate further metrics such as: · The number of multicasts per time interval that originate from networked devices and are intended to reach publicly addressable IP ranges. Number of internal link-local IP broadcast requests resulting from networked devices. · The size of the packet payload data. The number of individual TCP connections made by the device or data forwarded by the device, either as a combined aggregate across all destinations, or to any definable network range (e.g., a single target machine, or a specific network range).

[0180] For IP traffic, where application layer protocols can be determined and analyzed, further types of time series metrics can be defined, such as, for example: The number of DNS requests networked devices generate per time interval, again either to any definable network range, or in aggregate. ·The number of SMTP, POP, or IMAP logins or failed logins the machine generated per time interval. ·The number of LDAP logins or failed logins generated. Data transferred via file sharing protocols such as SMB, SMB2, and FTP. · Login to Microsoft Windows Active Directory, SSH or local login to Linux or Unix-like systems, or other authentication systems such as Kerberos.

[0181] The raw data needed to obtain these metrics can be collected from virtual switch implementations, from cloud-based systems, or from the communication devices themselves, via passive fiber or copper connections to the network's internal switchgear. Ideally, the system receives copies of all communication packets to provide full coverage of the organization.

[0182] For other sources, several domain-specific time series data are obtained, each selected to reflect a distinct and distinguishable phase of the underlying source of the data, which in some way reflects the use or behavior of the system over time.

[0183] Many of these time series data are extremely sparse, with the majority of data points equal to 0. An example is an employee using a swipe card to access a building or part of a building, or a user logging into their workstation authenticated by a Microsoft Windows Active Directory server, which is typically performed a small number of times per day. Other time series data are much denser, such as the size of data moving in and out of an always-on web server, web server CPU utilization, or power usage of a copier.

[0184] Regardless of the type of data, whether originally generated as a result of explicit human behavior or automated computer or other systems, it is quite common for such time series data to exhibit periodicity and to have various pattern trends within the data that repeat at approximately regular intervals. Moreover, it is common for such data to have many distinct but independent regular time periods that are evident within the time series.

[0185] In S3, detectors perform analysis of second-order metrics. Detectors are discrete mathematical models that implement a specific mathematical methodology on a different set of variables that comprise the target network. For example, an HMM might look specifically at the size and transmission time of packets between nodes. Detectors are provided in a hierarchy that is a pyramid of loosely arranged models. Each detector model effectively acts as a filter and passes its output to another model higher up the pyramid. At the top of the pyramid is a Bayesian probability that is the final threat decision model. Each lower-level detector monitors different global attributes or "features" of the underlying network and / or computer. These attributes consist of values ​​over time for all internal computational features such as packet rates and morphology, endpoint file system values, and TCP / IP protocol timing and events. Each detector is specialized to record and make decisions about different environmental factors based on the detector possessing an internal mathematical model such as an HMM.

[0186] While a threat detection system may be configured to look for any possible threat, in practice the system may keep an eye on one or more specific threats depending on the network in which the threat detection system is being used. For example, the threat detection system provides a way in which known characteristics of the network, such as desired compliance and human resource policies, are encapsulated in explicitly defined heuristics or detectors that can be triggered when they cooperate with a set of probability anomalies or varying thresholds resulting from the probability decision output. The heuristics are constructed using a complex set of weighted logical expressions that represent regular expressions with atomic objects derived at run time from the output of data measuring / tokenizing detectors and local contextual information. These sets of logical expressions are then stored in and / or on an online library and parsed in real time against the output from the measuring / tokenizing detectors. An example policy may take the form of "Alert if any employee (contextual information) subject to a HR disciplinary situation is accessing sensitive information (heuristic definition) in a manner (Bayesian probability output) that is anomalous when compared to previous behavior." In other words, different arrays of pyramids of detectors are provided to detect specific types of threats.

[0187] The analysis performed by the detector on the secondary metric then outputs data in a form suitable for use with the model of normal behavior. As can be seen, the data is in a form suitable for comparison to the model of normal behavior and for updating the model of normal behavior.

[0188] In S4, the threat detection system uses automated adaptive periodicity detection that maps to a pattern-of-life analysis of observed behavior to calculate a threat risk parameter that indicates the likelihood that a threat exists. It infers that a threat exists from a collected set of attributes that have themselves exhibited deviations from exemplary collective or individual behavior over time. The automated adaptive periodicity detection uses a calculated time period for which a Bayesian probability is most appropriate within the observed network and / or machine. Furthermore, the pattern-of-life analysis identifies how humans and / or machines behave over time, i.e., when they typically start and finish tasks. These models are continuously adapted automatically, making them inherently harder to defeat than known systems. The threat risk parameter is the probability that a threat exists in a particular configuration. Alternatively, the threat risk parameter is a value that represents the presence of a threat, which is compared to one or more thresholds that indicate the likelihood of a threat.

[0189] In practice, the step of calculating a threat involves comparing current data collected related to a user to a model of normal behavior of the user and the system being analyzed. The current data collected relates to a period in time, which may relate to a certain influx of new data, or a specific period of time, from a few seconds to a few days. In some configurations, the system is configured to predict the expected behavior of the system. The predicted behavior is then compared to the actual behavior to determine if a threat exists.

[0190] The system uses machine learning / artificial intelligence to understand what is normal inside a company's network and when something is not. The system then invokes an automated response to crush the cyber attack until a human team can roll back. This may include disrupting connections, preventing malicious emails from being sent, preventing file access, preventing communications outside the organization, etc. This approach starts as surgical and controlled as possible to disrupt the attack without affecting the normal behavior of, say, a laptop, but as the attack escalates, it eventually becomes necessary to quarantine the device to prevent wider harm to the organization.

[0191] To improve the accuracy of the system, checks are performed to compare the user's current behavior with related users, i.e., users within a single office. For example, if there is an unexpectedly low level of activity from a user, this may not be due to non-normal activity from the user, but may be due to factors affecting the entire office. Various other factors may be considered to assess whether the abnormal behavior actually indicates a threat.

[0192] Finally, in step S5, a decision is made based on the threat risk parameters as to whether further action needs to be taken regarding the threat. This decision can be made by a human operator after being presented with the probability that the threat exists, or an algorithm can make the decision, for example, by comparing the determined probability to a threshold value.

[0193] In one configuration, given a unique global input of Bayesian probabilities, a form of threat visualization is provided that allows users to see the threat landscape across all internal traffic, without needing to know how their internal networks are structured or dense, and in such a way that a "universal" view is presented within a single compartment regardless of the size of the network. The topology of the network under scrutiny is automatically projected as a graph based on device communication relationships via an interactive 3D user interface. The projection can be linearly scaled to any node scale without prior seeding or skeleton definition.

[0194] Thus, the threat detection system described above implements a plausible form of recursive Bayesian inference to maintain a distribution over the probability state variables. This distribution is constructed from a complex set of low-level host, network, and traffic observations or "features." These features are iteratively recorded and processed in real-time on the platform. A plausible representation of the relationship information between entities in a generally dynamic system, such as an enterprise network, a biological cell or social community, or certainly the entire Internet, is a probabilistic network that is topologically rewiring and semantically evolving over time. In many highly structured I / O problems, such as packet traffic and host activity observations in a distributed digital enterprise, where both inputs and outputs can include tens of thousands, sometimes millions, of interrelated features (such as data transports, host-web-client dialogues, log changes, and rule triggers), learning a predictive function of sparse and consistent structure is challenged by the lack of normal distributions. To overcome this, the threat detection system consists of a data structure that determines a rotating continuum, rather than a stepwise method, to which repetitive time cycles, such as work days, shift patterns, and other routines, are dynamically assigned. In this way, we provide a non-frequentist architecture for inferring and testing causal relationships between explanatory variables, observations, and feature sets. This allows for efficiently solvable convex optimization problems, resulting in parsimonious models. In such configurations, threat detection processing may be triggered by the input of new data. Alternatively, threat detection processing may be triggered by the absence of predictive data. In some configurations, processing may be triggered by the presence of an event that may guide a particular action.

[0195] The method and system are configured to be implemented by one or more processing components having any portion of the software stored in executable form on a computer-readable medium. The computer-readable medium may be non-transitory and does not include radio or other carrier waves. The computer-readable medium may be a physical computer-readable medium, such as, for example, a semiconductor or solid-state memory, a magnetic tape, a removable computer floppy disk, a random access memory (RAM), a read-only memory (ROM), a rigid magnetic disk, and an optical disk, such as a CD-ROM, a CD-R / W, or a DVD.

[0196] The various methods described above may be implemented by a computer program product. The computer program product may include computer code configured to instruct a computer to perform one or more functions of the various methods described above. The computer program and / or code for implementing such methods is provided to an apparatus, such as a computer, on a computer-readable medium, or on a computer program product. In the case of a computer program product, the transitory computer-readable medium may include a radio or other carrier wave.

[0197] An apparatus, such as a computer, may be configured in accordance with such code to perform one or more processes in accordance with the various methods discussed herein. Website

[0198] The website is configured as a browser-based or direct-app tool for configuring, analyzing, and communicating with the cyber threat defense system. network

[0199] Several electronic systems and devices can communicate with each other in a network environment. The network environment has a communication network. The network can include one or more networks selected from an optical network, a cellular network, the Internet, a local area network ("LAN"), a wide area network ("WAN"), a satellite network, a third party "cloud" environment, a fiber network, a cable network, and combinations thereof. In some embodiments, the communication network is the Internet. There can be many server computing systems and many client computing systems connected with each other via the communication network.

[0200] The communication network may connect one or more server computing systems selected from at least a first server computing system and a second server computing system with each other as well as with at least one or more client computing systems. Each of the server computing systems may optionally include an organizational data structure such as a database. Each of the one or more server computing systems may have one or more virtual server computing systems, and multiple virtual server computing systems may be implemented by design. Each of the one or more server computing systems may have one or more firewalls and similar defenses to protect data integrity.

[0201] At least one or more client computing systems, e.g., mobile computing devices (e.g., smartphones having an Android-based operating system), can communicate with the server. The client computing systems may include, for example, software applications or hardware-based systems that may be able to exchange communications with the first electric personal transportation vehicle and / or the second electric personal transportation vehicle. Each of the one or more client computing systems may have one or more firewalls and similar defenses to protect data integrity.

[0202] A cloud provider platform may include one or more of the server computing systems. A cloud provider may install and operate application software within the cloud (e.g., a network such as the Internet), and a cloud user may access the application software from one or more of the client computing systems. In general, a cloud user with a cloud-based site within the cloud may not independently manage the cloud infrastructure or platform on which the application software runs. Thus, the server computing system and its organizational data structures may be a shared resource, with each cloud user being given dedicated use of a certain amount of the shared resource. Each cloud user's cloud-based site may be given a virtual amount of dedicated space and bandwidth within the cloud. Cloud applications may differ from other applications in scalability, which may be achieved by mimicking tasks on multiple virtual machines at runtime to meet changing work demands. A load balancer distributes work to a set of virtual machines. This process is transparent to cloud users who only see a single access point.

[0203] The cloud-based remote access may be coded to engage in request and response cycles by applications on a client computing system, such as a web browser application in the client computing system, utilizing a protocol such as the Hypertext Transfer Protocol ("HTTP"). The cloud-based remote access may be accessed anytime and / or anywhere by a smart phone, desktop computer, tablet, or any other client computing system. The cloud-based remote access may be coded to engage in 1) request and response cycles from any web browser-based application, 3) request and response cycles from a dedicated online server, 4) request and response cycles directly between a native application in a client device and a cloud-based remote access to another client computing system, and 5) combinations thereof.

[0204] In an embodiment, the server computing system may include a server engine, a web page management component, a content management component, and a database management component. The server engine may perform basic processing and operating system level tasks. The web page management component may handle the creation and display or routing of web pages or screens associated with receiving and serving digital content and digital advertisements. Users (e.g., cloud users) may access one or more of the server computing systems by their associated uniform resource locators ("URLs"). The content management component may handle most of the functionality within the embodiments described herein. The database management component may include storage and retrieval tasks related to databases, queries to databases, and storage of data.

[0205] In some embodiments, the server computing system may be configured to display information in windows, web pages, and the like. For example, applications, including any program modules, applications, services, processes, and other similar software executable when executed on the server computing system, may cause the server computing system to display windows and user interface screens within a portion of the display screen space. With respect to web pages, a user, e.g., via a browser on a client computing system, may interact with the web page and then provide inputs to queries / fields and / or services presented in the user interface screen. The web pages may be served by a web server, e.g., the server computing system, on a HyperText Markup Language ("HTML") or Wireless Access Protocol ("WAP") enabled client computing system (e.g., client computing system 802B) or any equivalent thereof. The client computing system may host a browser and / or specific applications to interact with the server computing system. Each application has code written to implement functions in which software components are coded to perform presentation fields, etc. to retrieve desired information details. Algorithms, routines, and engines, for example in a server computing system, can take information from the submitted fields and place it in a suitable storage medium, such as a database (e.g., a database). A comparison wizard can be written to reference the database and use such data. An application can be hosted, for example, on the server computing system and served, for example, to a specific application or browser on the client computing system. The application then serves a window or page that allows entry of the details. Computing Systems

[0206] The computing system may be, in whole or in part, one or more portions of a server or client computing device according to some embodiments. The components of the computing system may include, but are not limited to, a processing unit having one or more processing cores, a system memory, and a system bus coupling various system components including the system memory to the processing unit. The system bus may be any of several types of bus structures selected from a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures.

[0207] A computing system typically includes a variety of computing machine readable media. Computing machine readable media can be any available media that can be accessed by a computing system and includes both volatile and non-volatile media, as well as removable and non-removable media. By way of example and not limitation, computing machine readable media uses include storage of information such as computer readable instructions, data structures, other executable software or other data. Computer-storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic disk storage devices, or any other tangible media that can be used to store desired information and that can be accessed by the computing device 900. Transient media such as wireless channels are not included in machine readable media. Communication media typically embodies computer readable instructions, data structures, other executable software, or other transport mechanisms and includes any information delivery media.

[0208] System memory includes computer storage media in the form of volatile and / or nonvolatile memory such as read-only memory (ROM) and random access memory (RAM). A basic input / output system (BIOS), containing the basic routines that help to transfer information between elements within a computing system, such as during start-up, is typically stored in ROM. RAM typically contains data and / or software that is immediately accessible to and / or presently being operated on by the processing unit. By way of example, and not limitation, RAM may include portions of the operating system, application programs, other executable software, and program data.

[0209] The drives and their associated computer storage media discussed above provide storage of computer readable instructions, data structures, other executable software and other data for the computing system.

[0210] A user may input commands and information into the computing system through input devices such as a keyboard, a touch screen, or software or hardware input buttons, a microphone, a pointing device, and / or a scrolling input component such as a mouse, a trackball, or a touchpad. The microphone may be associated with voice recognition software. These and other input devices are often connected to the processing unit through a user input interface that is coupled to the system bus, but may also be connected by other interface and bus structures such as a parallel bus, a game port, or a universal system bus (USB). A display monitor or other type of display screen device is also connected to the system bus through an interface such as a display interface. In addition to the monitor, the computing device may also include other peripheral output devices such as speakers, vibrators, lights, and other output devices that may be connected through an output peripheral interface.

[0211] The computing system can operate in a networked environment using logical connections to one or more remote computers / client devices, such as remote computing systems. The logical connections can include a personal area network ("PAN") (e.g., Bluetooth), a local area network ("LAN") (e.g., Wi-Fi), and a wide area network ("WAN") (e.g., cellular networks), but can also include other networks. Such networking environments are common in offices, enterprise-wide computer networks, intranets, and the Internet. Browser applications or direct apps that interact with the cloud platform can reside in the computing device and can be stored in memory.

[0212] It should be noted that the design may be executed on a single computing system and / or on a distributed system where different parts of the design are executed on different parts of the distributed computing system.

[0213] Applications described herein include, but are not limited to, programs that are part of software applications, mobile apps, and operating system applications. Some portions of this description are presented in terms of algorithms and symbolic representations of operations on data bits within a computer memory. These algorithmic descriptions and representations are the means used by those skilled in the data processing arts to most effectively convey the substance of their work to others skilled in the art. An algorithm is here, and generally, considered to be a self-consistent sequence of steps leading to a desired result. The steps are those requiring physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, transferred, combined, and otherwise manipulated. It has proven convenient at times, primarily for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like. These algorithms may be written in a number of different software programming languages, such as Python, C, C+, or other similar languages. Also, the algorithms may be implemented with lines of code in software, configured logic gates in software, or a combination of both. In embodiments, logic consists of electrical circuitry that follows the rules of Boolean logic, software containing patterns of instructions, or any combination of both.

[0214] It should be noted, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. Unless expressly indicated otherwise, as will be apparent from the above description, descriptions utilizing terms such as "processing" or "computing" or "calculating" or "determining" or "displaying" will be understood throughout the description to refer to the acts and processes of a computer system, or similar electronic computing device, that manipulates and transforms data represented as physical (electronic) quantities in the computer system's registers and memory into other data that are similarly represented as physical quantities in the computer system's memory or registers, or other such information storage, transmission or display device.

[0215] Many functions performed by electronic hardware components can be replicated through software emulation. Thus, software programs written to accomplish those same functions can emulate the functionality of the hardware components in the input-output circuitry.

[0216] Although the foregoing designs and embodiments thereof have been provided in considerable detail, it is not the intention of the applicants to limit the designs and embodiments provided herein. Additional adaptations and / or assembly are possible and are encompassed in broad aspects. Thus, the foregoing designs and embodiments may be prepared without departing from the scope created by the following claims, which, when properly interpreted, are limited only by the claims.

Claims

1. one or more first machine learning models trained on normal behavior of email and user activity associated with the email system; a cyber-threat module having one or more second machine learning models trained on cyber-threats in the email system, the cyber-threat module being configured to reference the one or more first machine learning models, issue an anomaly assessment value to indicate how abnormal the cyber-threat module considers the email under analysis to be compared to the normal life patterns of the organization and the specific user, and determine a threat risk parameter taking into account the likelihood that one or more abnormal behaviors of the set of email and user activities under analysis deviate from a derived normal harmless behavior and are therefore likely to be malicious; a probe configured to collect the user activity and the email activity and then feed the activity to the cyber threat module to derive an understanding of the email activity and user activity in the email system; an autonomous response module configured to trigger one or more autonomous actions to be taken to thwart the cyber threat when the threat risk parameter from the cyber threat module is equal to or greater than a threshold that can guide an action; The autonomous response module is configured to interface with a library of response action types and specific actions that can be taken by the autonomous response module, and a focused response action is selectable through a user interface configured to autonomously address specific email elements of a malicious email rather than a blanket quarantine or blocking approach to the email in order to avoid disruption to specific users of the email system.

2. The apparatus of claim 1 , wherein the cyber threat module is further configured to determine how the set of one or more non-normal behaviors of email activity and user activity under analysis correlates to a potential cyber threat.

3. The apparatus of claim 1 , implemented by one or more processing components having portions of software comprising the cyber-threat module stored in executable form on a computer-readable medium.

4. and one or more third machine learning models trained to gain an understanding of a plurality of features of the email under analysis and data associated with the email under analysis.

2. The apparatus of claim 1, wherein the cyber threat module is configured to reference the one or more third machine learning models to determine whether the email under analysis or set of emails under analysis has potentially malicious characteristics.

5. The apparatus of claim 4, wherein the cyber threat module is further configured to also take into account whether the email or set of emails under analysis has potentially malicious characteristics in the cyber threat module's determination of the threat risk parameter.

6. 2. The apparatus of claim 1, further comprising a user interface having an inbox-style view of emails entering and leaving the email system, and known cybersecurity features for one or more emails under analysis, including the email under analysis, the user interface having an inbox-style view of emails having a first window or column displaying the one or more emails under analysis and a second window or column having known security features for the one or more emails under analysis.

7. 7. The apparatus of claim 6, wherein the user interface is further configured to allow emails in the email system to be filterable, searchable, and sortable to customize and target the one or more emails under analysis in the first window next to the cybersecurity characteristics known for those one or more emails under analysis in the second window, and the first window and the second window display information on the same display screen as the user interface to enable a cyber expert analyzing the one or more emails under analysis to better assess whether the one or more emails under analysis are a cyber threat.

8. 13. The apparatus of claim 1, further comprising a network module including one or more fourth machine learning models utilized to determine potentially non-normal network activity to provide additional input of information into the cyber threat module for determining the threat risk parameter.

9. 1. A method for a cyber threat defense system, comprising: using one or more first machine learning models trained on normal behavior of email and user activity associated with the email system; determining, by a cyber-threat module, whether the email under analysis has potentially malicious characteristics by reference to the one or more second machine learning models trained on cyber-threats in the email system, and issuing an anomaly score to indicate how abnormal the cyber-threat module considers the email under analysis to be compared to normal life patterns of the organization and the particular user; determining, by said cyber threat module, a threat risk parameter that takes into account the likelihood that a set of one or more non-normal behaviors of the email and user activities under analysis deviates from the obtained normal harmless behaviors and is therefore likely to be malicious; collecting said email activity and said user activity by a probe; feeding the email activity and the user activity by the probes to the cyber threat module to derive an understanding of the email activity and user activity in the email system; and triggering, by an autonomous response module, one or more autonomous actions to be taken to thwart the cyber threat when the threat risk parameter from the cyber threat module is equal to or greater than a threshold that can guide an action.

10. 10. The method of claim 9, wherein the cyber threat module further determines how the set of one or more non-normal behaviors of email activity and user activity under analysis correlates to a potential cyber threat.

11. 10. The method of claim 9, implemented by one or more processing components having portions of software comprising the cyber-threat module stored in executable form on a computer-readable medium.

12. 12. The method of claim 11, further comprising displaying, via a user interface having an inbox-style view of emails entering and leaving the email system, a first window including the one or more emails under analysis that are part of the emails, and a second window having known security characteristics for the one or more emails under analysis.

13. 13. The method of claim 12, further comprising configuring the user interface to allow emails in the email system to be filterable, searchable, and sortable to customize and target the one or more emails under analysis in the first window next to relevant security features known for those one or more emails in the second window, wherein the first window and the second window display information on the same display screen as the user interface to enable a cyber expert analyzing the one or more emails under analysis to better assess whether the one or more emails under analysis are a cyber threat.

14. 13. The method of claim 12, further comprising taking the one or more autonomous actions by the autonomous response module to thwart the cyber threat when the cyber threat module determines that the email under analysis is i) a known malicious email or ii) at least a highly likely malicious email, the autonomous response module having management tools configurable through the user interface to configure what autonomous actions the autonomous response module can take, including the types of actions and specific actions possible for the autonomous response module when the cyber threat module indicates that the threat risk parameter is equal to or greater than a threshold that can guide the action.

Images