Endpoint Agent Extensions for Machine Learning Cyber ​​Defense Systems for Email

Abstract

To provide expansion of a cyber defense system for an electronic mail.SOLUTION: In a system, an integrated module is integrated with an electronic mail client application (AP) to detect cyber threat in an electronic mail of the AP and to restrict the electronic mail. An action module is interfaced with the AP to, when a cyber threat module compares an electronic mail and its file with modeled actions of user electronic mails which are threat for data derivation and if it is determined that it is any of malicious and abnormal actions or any combination of them, give instructions to take autonomous actions for an outbound electronic mail and its file. The autonomous action includes actions such as making a user logging-off from the AP, preventing transmission of an electronic mail, removing attached files, invalidating a link to a file from an electronic email, and transmitting a notice to an electronic email to a person in charge of cyber security.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] Copyright Notice A portion of this disclosure contains material that is subject to copyright protection. The copyright owner has no objection to the copying by others of the copyrighted material as it appears in the U.S. Patent and Trademark Office patent files or records, but otherwise reserves all copyrights whatsoever.

[0002] Related Applications This application claims priority under 35 U.S.C. §119 to and the benefit of U.S. Provisional Patent Application No. 62 / 893,350, entitled "CYBER DEFENSE SYSTEM WITH VARIOUS IMPROVEMENTS," filed August 29, 2019, which is incorporated herein by reference in its entirety. Additionally, this application claims priority under 35 U.S.C. §121 as a continuation-in-part to and the benefit of U.S. Provisional Patent Application No. 16 / 278,932, entitled "CYBER DEFENSE SYSTEM FOR PROTECTING EMAIL NETWORKS USING MACHINE LEARNING MODELS," filed February 19, 2019, which claims the benefit under 35 U.S.C. §119 to U.S. Provisional Patent Application No. 62 / 632,623, entitled "CYBER DEFENSE SYSTEM WITH VARIOUS IMPROVEMENTS," filed February 20, 2018, which is incorporated herein by reference in its entirety.

[0003] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Design embodiments provided herein relate generally to cyber defense systems. In one embodiment, an artificial intelligence analyzes cyber security threats arising from and / or related to email. [Background technology]

[0004] In the cyber security environment, firewalls, antivirus security methods, and other tools currently form a vital part of an organization's cyber defense strategy, but they are insufficient in the new era of cyber threats. Summary of the Invention [Means for solving the problem]

[0005] The object of the present invention is to provide an endpoint agent extension of a cyber defense system that is capable of adequately dealing with new-age cyber threats. In one embodiment, the cyber defense system protects the system from cyber threats arising from and / or associated with email and / or email systems. In one embodiment, an endpoint agent extension of the cyber defense system for email includes two or more modules and one or more machine learning models. An integration module of the endpoint agent extension integrates with an email client application on an endpoint computing device to detect email cyber threats in emails at the email client application as well as regulate outbound email. A behavioral module of the endpoint agent extension interfaces with the email client application to direct an autonomous action by the behavioral module, rather than a human taking action, on at least the outbound email containing the attachment and / or linked file under analysis when the cyber threat module determines that the outbound email containing the attachment and / or linked file is (a) a data exfiltration threat, (b) malicious and anomalous behavior compared to the user's modeled email behavior, and (c) any combination of these two determinations. At a minimum, autonomous actions for outbound email and files may include one or more of the following: i) logging the user off of the email client application; ii) preventing the outbound email from being sent; iii) stripping attachments and / or disabling links to files from the outbound email; and iv) sending a notification regarding the outbound email to the organization's cybersecurity personnel.

[0006] These and other features of the designs provided herein can be better understood with reference to the drawings, specification, and claims, all of which form the disclosure of this patent application.

[0007] [Brief description of the drawings]

[0008] The drawings refer to several embodiments of the designs provided herein.

[0009] [Figure 1] FIG. 1 is a block diagram of one embodiment of an endpoint agent extension of a cyber defense system for email that includes two or more modules.

[0010] [Diagram 2] FIG. 2 is a block diagram of one embodiment of a secure communications module in an endpoint agent extension configured to securely communicate with one or more modules in a cyber security appliance of a cyber defense system in a network connected to the endpoint computing device to receive contextual information outside of an email domain regarding an outbound email under analysis, and to receive instructions or additional information regarding what autonomous action should be taken on the outbound email to mitigate threats posed by the outbound email and its attachments and / or links from an autonomous response module of the cyber security appliance.

[0011] [Diagram 3] FIG. 3 is a block diagram of one embodiment of an example autonomous behavior that the autonomous rapid response module and / or behavior module may be configured to take without a human initiating the behavior.

[0012] [Figure 4]FIG. 4 is a block diagram of one embodiment of an email module and / or cyber threat module that takes into account many factors to compare emails based on multiple aspects of the email to identify threats posed by outbound emails and their attachments and / or links.

[0013] [Diagram 5] FIG. 5 is a block diagram of one embodiment of an email module and / or cyber threat module that takes into account many other exemplary factors to compare emails based on multiple aspects of the email to identify threats posed by outbound emails and their attachments and / or links.

[0014] [Figure 6] FIG. 6 is a block diagram of one embodiment of a cybersecurity device having an email module that references a machine learning model that is trained on normal behavior of email and user activity associated with at least an email system, and the email module determines a threat risk parameter that takes into account the likelihood that one or more unusual behaviors in the set of email and user activity under analysis deviate from the obtained normal benign behavior, and therefore are malicious behavior.

[0015] [Figure 7] FIG. 7 is a block diagram of one embodiment of an email module that compares analyzed metrics of user and email activity and corresponding potential cyber threats compared to respective variation benchmarks of parameters corresponding to normal behavior of email and user activity associated with the network and its email domains used by the self-learning machine learning model.

[0016] [Figure 8] FIG. 8 is a block diagram of one embodiment of an example cyber defense system for protecting an example network.

[0017] [Figure 9] FIG. 9 is a diagram of an example endpoint computing device that may implement an instance of an endpoint agent extension of a cyber defense system for email that includes two or more modules and interfaces with a machine learning model. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0018] While the present design is subject to various modifications, equivalents, and alternative forms, specific embodiments thereof have been shown by way of example in the drawings and are now described in detail. It is to be understood that the present design is not limited to the particular embodiments disclosed, but on the contrary, it is intended to cover all modifications, equivalents, and alternative forms that utilize the specific embodiments.

[0019] In the following description, numerous specific details are set forth, such as specific data signals, named components, number of servers in a system, etc., to provide a thorough understanding of the design. However, it will be apparent to one of ordinary skill in the art that the design may be practiced without these specific details. In other instances, well-known components or methods have not been described in detail, but rather in block diagrams, to avoid unnecessarily obscuring the design. Furthermore, specific numerical references may be made, such as a first server. However, specific numerical references should not be construed as a literal sequence, and a first server should be construed as being different from a second server. Thus, the specific details set forth are merely examples. Also, features implemented in one embodiment may be implemented in another embodiment where logically possible. It may be contemplated that the specific details may vary, but still be within the spirit and scope of the design. The term coupled is defined to mean connected directly to a component, or indirectly to a component through another component.

[0020] Typically, artificial intelligence is used to analyze cyber security threats. Cyber ​​defense systems can use models trained on normal behavior of email activity and user activity associated with email systems.

[0021] The cyber defense system integrates an endpoint agent extension, such as a plug-in app, having email threat detection and autonomous response capabilities for at least outbound email from, and possibly inbound email to, email client applications on endpoint computing devices, such as desktop computing devices, mobile computing devices, smart home devices, etc. The cyber defense system integrates email analysis and autonomous response actions into the endpoint agent extension that interfaces with email applications resident on the endpoint computing devices.

[0022] FIG. 1 illustrates a block diagram of one embodiment of an endpoint agent extension of a cyber defense system for email that includes two or more modules.

[0023] The endpoint agent extension 100 of the machine learning cyber defense system for email includes two or more modules. The integration module of the endpoint agent extension 100 integrates with an email client application on an endpoint computing device to detect email cyber threats in emails at the email client application as well as regulate at least outbound emails.

[0024] 2 illustrates a block diagram of one embodiment of a secure communications module in an endpoint agent extension configured to securely communicate with one or more modules in a cyber security appliance of a cyber defense system in a network connected to the endpoint computing device to receive contextual information outside of the email domain regarding an outbound email under analysis, and to receive instructions from an autonomous response module of the cyber security appliance regarding or receive additional information regarding what autonomous action should be taken on the outbound email to mitigate threats posed by the outbound email and its attachments and / or links. Thus, the endpoint agent extension of a cyber defense system for an email network is integrated with email client applications on endpoint computing devices, including desktop computing devices, mobile computing devices, tablets, automobiles, smart televisions or other home devices, smart watches, smart phones, or other types of endpoint computing devices connected to the network, to assist in the creation of and autonomously control the flow of at least outbound email messages, and in some embodiments inbound email messages as well. An endpoint agent extension in the endpoint computing device securely communicates with one or more modules in the cyber security appliances 260A-260C.

[0025] Referring again to FIG. 1, the behavioral module of the endpoint agent extension 100 interfaces with the email client application to direct an autonomous action, rather than a human action, by the behavioral module with respect to at least the outbound email containing the attachment and / or linked file under analysis when the cyber threat module determines that the outbound email containing the attachment and / or linked file is (a) a data exfiltration threat, (b) malicious and anomalous behavior compared to the user's modeled email behavior, and (c) any combination of these two determinations. The autonomous action with respect to at least the outbound email and file may include one or more of the following actions: i) logging the user off the email client application, ii) preventing the outbound email from being sent, iii) stripping the attachment and / or disabling links to the file from the outbound email, and iv) sending a notification to the organization's cyber security personnel regarding the outbound email (see, e.g., FIG. 3). The endpoint agent extension 100 integration module interfaces with email client applications such as Microsoft's Outlook email application, Google's Gmail email application, etc., to assist and regulate cyber security contributions to inbound email, such as composing and sending new outbound emails, as well as capturing details about the internal delivery of that email from the endpoint computing device. The endpoint agent extension 100 integration module of a cyber defense system for email networks may have a suite of interfaces, each interface adapted to operate its particular email application.The endpoint agent extension 100 may be implemented as one of: i) a plug-in integration for a desktop email client application; and ii) a browser extension for integration with a browser-based email client application such as Gmail.

[0026] It should be noted that if portions of i) the endpoint agent extension 100 and ii) any modules are implemented in software, then those instructions are stored on one or more non-transitory machine-readable storage media in a format that, when executed by an endpoint computing device, causes the endpoint computing device to perform the operations described herein.

[0027] Cyber ​​defense systems such as Antigena Email™ interact with both inbound and outbound email. An instance of an endpoint agent extension 100 may reside on each endpoint computing device associated with the network to interface with the email client application resident on that endpoint computing device to perform these actions. Each endpoint agent extension 100 also leverages the knowledge and potential computing power of the network-based in-the-box cyber security appliances to assist the user (see FIG. 2).

[0028] Referring again to FIG. 1, the attachment analyzer of the endpoint agent extension 100 scans any files i) attached and / or ii) linked to an outbound email about to be sent in the outbox in order to analyze the file contents and meta data of the file including the file type, file size, etc. through file structure examination, meta data analysis tools, and machine learning analysis, as well as perform other analysis to gather information about the given file itself and the contents within the file. It should be noted that the algorithms configured to examine various aspects of the file structure that indicate malicious activity may take several cycles of computation than an optical character recognition (OCR) process. Nevertheless, if the attachment is sufficiently suspected to require longer computation time to perform an OCR process, an OCR process may be used in combination with the algorithm.

[0029] The attachment analyzer may scan and perform optical character recognition and / or file interrogation on the content and perform other analysis to understand what the file type of the attached or linked file is, and what the subject matter is within the file attached or linked to the email.

[0030] The secure communication module in the endpoint agent extension 100 securely communicates with one or more modules in the cyber security appliance of the cyber defense system in the network connected to the endpoint computing device. The module of the endpoint agent extension 100 receives and takes into account both knowledge outside the email domain and metrics and other information from the email domain collected by the one or more modules of the cyber security appliance on the network. The module of the endpoint agent extension 100 is also configured to use the computational power of the one or more modules of the cyber security appliance for one or more of the machine learning models. The endpoint agent extension 100 uses both the external computing power and the additional knowledge collected outside the email domain to analyze contextual information about the outbound email under analysis, contextual information about the user behavior of the user generating the outbound email, and / or contextual information about files i) attached or ii) linked to the outbound email. The endpoint agent extension 100 securely communicates with modules in the cyber defense system, such as an email module, a network module, and a SaaS module.

[0031] The endpoint agent extension 100 can be an extension of the cyber defense system for email with one or more machine learning models, which gives it a competitive advantage of including a much broader range of information than traditional tools when performing analysis of email and any files that email contains.

[0032] Referring again to FIG. 2, the endpoint agent extension resident on the endpoint device also communicates with deployed modules of the cyber defense system, such as the network module, email module, and / or SaaS module, to receive contextual information about user behavior or files, and potentially instructions from the autonomous response module of each cyber security appliance 260A-260C that communicates with the endpoint agent extension. Thus, the secure communication module in the endpoint agent extension securely communicates with one or more modules in a cyber security appliance, such as the first cyber security appliance 260A of the cyber defense system, that is in the network connected to the endpoint computing device, to receive instructions from the autonomous response module of the cyber security appliance as to, or to receive additional information regarding, what autonomous action should be taken on the outbound email to mitigate the threat posed by the outbound email and its attachments and / or links. The communication module communicates the desired action from the cyber security appliance, such as the first cyber security appliance 260A, to the secure communication module of the endpoint agent extension that is on the endpoint computing device, such as the second mobile phone. The endpoint agent extension exchanges secure communications (e.g., insights and commands) with other cyber security defense system components. Thus, an endpoint agent extension of a cyber defense system for an email network has an interface with an email client application and a secure communications module with network-based cyber security appliances.

[0033] The cyber security appliances of the cyber defense system may be located within IT networks, OT networks, SaaS environments, cloud networks, and / or any combination of these networks to exchange secure communications with the endpoint agent extensions and provide additional contextual information regarding user behavior outside of the email domain, and regarding files attached to the email under analysis to determine whether the outbound email under analysis and its attachments and / or links are i) unusual or ii) not unusual in the context of the current user behavior to prevent data loss and improperly addressed recipients.

[0034] The endpoint agent extension communicates with other deployed modules of the cyber defense system, such as the network module or the SaaS module, to receive additional contextual information about the user's behavior, about attachments, and potential instructions from the autonomous response elements of each module (see, for example, Figures 4 and 5). The network and SaaS modules can provide additional metrics of the user, such as recently browsing various websites that have a logical connection to the email under analysis, using online services that have a logical connection to the email under analysis, to help determine how unusual or rare a particular user's behavior, email, and / or file is in the context of the user's broader behavior analysis that takes into account what the user is doing outside of the email domain. To contextualize information about emails and their attachments from more sources than email domains, the endpoint agent extension makes it possible to treat email security as part of a broader network-cloud-SaaS-email security landscape. The Endpoint Agent Extension uses inputs from other areas of the extended digital estate such as Cloud / SaaS / Network / Email / Host-based etc. to determine whether the current email under analysis and its attachments are deemed i) unusual or ii) not unusual in the context of the current user behavior, thus preventing data loss and incorrectly addressed recipients from occurring.

[0035] Referring to FIG. 1, the endpoint agent extension 100 uses several security techniques to securely communicate with the email module, network module, SaaS module, etc. of the cyber defense system. The secure communication module may use multiple levels of encryption of at least two or more different types of encryption of the communication. Both the sending and receiving communication modules need to know both encryption types to be applied as well as the order of encryption and decryption of the encryption types of the communication (e.g., which encryption is applied first). Furthermore, i) the endpoint agent extension 100, ii) the cyber security appliance, or iii) both of these secure communication modules are accompanied by a unique identification token, which must also be verified before allowing any operation on the secure communication (itself). Furthermore, it is noted that the unique identification token may take into account that each user must log into an email account on a known endpoint computing device that the user is known to use. In this way, a token unique to each user can be generated. Both sides have the ability to verify the authenticity of that token. The multiple levels of different types of encryption of the communication may include HTTPS, public private key, etc.

[0036] FIG. 6 illustrates a block diagram of one embodiment of a cybersecurity device having an email module that references a machine learning model that is trained on normal behavior of email and user activity associated with at least an email system, and the email module determines a threat risk parameter that takes into account the likelihood that one or more unusual behaviors in the set of email and user activity under analysis deviate from the obtained normal, harmless behavior, and therefore are malicious behaviors.

[0037] The (local) cyber threat module of the endpoint agent extension and / or the email module of the (network) cyber security appliance 660 may interface with one or more machine learning models to perform machine learning analysis on all inbound and outbound email flows of the organization to gain increased awareness of patterns of life for i) each individual user, ii) the organization as a whole, and iii) clustered groups of users that the machine learning has identified as being closely related to a given user. The endpoint agent extension and cyber security appliance 660 on the network (e.g., IT network, SaaS, cloud, etc.) 1) attempts to obtain a pattern of life for i) all individual users, ii) the broader organization, iii) smaller clustered peer groups closely related to a given user on a user by user basis, and 2) attempts to make a determination that the behavior deviates from the pattern of life for the email under analysis and any of its attachments, taking into account network metrics (cloud / network / SaaS / host) along with email domain metrics rather than simply blocking all attachments with macros or attachments identified as malicious by third party intel or containing known virus links (see, e.g., Figures 4 and 5).

[0038] In one embodiment, the endpoint agent extension's cyber threat module runs machine learning analysis using one or more machine learning models on all inbound and outbound email flow for the organization to gain awareness of patterns of life for each individual user, the organization as a whole, and clustered groups of users that the machine learning has identified as closely related. In one embodiment, i) the endpoint agent extension may host the AI ​​models, ii) the cyber security appliance 660 may host the AI ​​models, and / or iii) portions of both the endpoint agent extension and the cyber security appliance 660 may each share portions of the AI ​​models to run the machine learning analysis.

[0039] A cyber defense system such as Antigena Email™ uses i) mathematical models and / or machine learning models trained on normal email behavioral activity and user activity associated with the email system, and ii) has a behavioral module (local) and / or an autonomous response module (over the network) to take one or more autonomous rapid actions to stop the cyber threat, rather than a human taking action. Both the cyber threat module and the email module may reference models trained on normal behavior of email activity and user activity (see, for example, FIG. 7). A threat risk parameter is determined that takes into account the likelihood of one or more unusual behaviors of the set of email activity and user activity under analysis that deviate from normal harmless behavior. If the threat risk parameter from the cyber threat module is equal to or exceeds a threshold that guides the action, then the behavioral module (local) and / or the autonomous response module (over the network) is used to take one or more autonomous rapid actions to stop the cyber threat, rather than a human taking action. Some exemplary autonomous actions include logging the user off their client machine, preventing email from being sent, etc. (see FIG. 3).

[0040] Modules of the endpoint agent extension and modules of the cyber security appliance 660 on the network (IT network, SaaS, cloud, etc.) work together to track and maintain a modeled dynamic profile for each email user in the domain that creates emails. The dynamic profile of the user is derived from 1) the pattern of life for i) that individual user of the email domain, ii) the organization to which the individual user of the email domain belongs, and iii) smaller clustered peer groups that are closely related to the given user on a per user basis, and 2) rather than simply blocking any potentially malicious attachments with macros, blocking all known virus links, and forcing users to retrieve or send these emails and their files from spam folders, a determination can be made that behavior is deviating from the pattern of life for the email under analysis and either its attachments or linked files by taking into account network metrics (cloud / network / SaaS / host) along with email domain metrics. The email module of the cyber security appliance 660 is configured to track and maintain a dynamic profile modeled in the user model for each email user in the domain that creates email, as well as align with the email activity and network activity models of each peer group in the organization, and the email activity model of the organization in general. Note that inputs from all three of these different modeled insights are considered in the dynamic profile when determining if an outbound email about to be sent by a user is unusual and should trigger further analysis.

[0041] Referring to FIG. 1, the secure communications module in the endpoint agent extension 100 securely receives an instance of a dynamic profile for each email user in the domain that creates emails, and a memory that stores all these instances of the dynamic profile, one for each user that uses the endpoint computing device, for faster processing of each outbound email under analysis. The cyber security appliance may track and maintain a "user modeled dynamic profile" for each email user in the domain that creates emails, as well as a model of email activity and network activity for each peer group in the organization, and a model of email activity for the organization in general. Inputs from all three of these different modeled insights may be considered when determining whether emails being created by individual email users are unusual and should trigger further analysis.

[0042] Using the dynamic profile, the cyber threat module of the endpoint agent extension 100 can review each outbound email created in the email client for each user and analyze whether the content, the attached / linked files, and the email address recipient are within the life patterns modeled by the multiple machine learning models. Again, using additional computing power and network knowledge, the cyber threat module of the endpoint agent extension 100 can receive from the cyber security appliance a "user modeled dynamic profile" for each mail user creating the email. The individual user modeled dynamic profiles can be calculated and maintained on the cyber security appliance, and a dynamic profile is generated for every email user. The dynamically maintained user profiles are sent back to the endpoint agent extension 100. In each user model, an association is made based on the life patterns of that user.

[0043] Similarly, the cyber security appliance and / or endpoint agent extension 100, depending on the computing power available on the endpoint computing device, analyzes the content of the email and its associated files to determine the subject of the email and / or file. Note that a user creates an email on a particular subject to a set of one or more other individual user's email addresses. The model creates clusters of putative recipients of email addresses for a particular subject for each particular subject area. Each user may also be clustered with similar users. Similarly, each subject area may also be clustered with similar subject areas. The results of the clustering on the user model identify rare situations where an email for a particular subject area normally associated with "x" recipient is now addressed to a potentially fraudulent email address. Additionally, the results of the clustering on the user model also provide rare situations where a malicious cyber threat is occurring as indicated through highly unusual email behavior by this user. For example, if an email user has never accessed their email account from a certain device, but someone is currently logging into the user's account from an unusual domain or device, and the content of the email or its attachments or linked files also appears to be rare / unusual for this user, the dynamic profile obtained from the machine learning model is used to identify a set of unusual behaviors that may trigger autonomous behavior. Another example of unusual behavior detected using the dynamic profile of this user is when a user does not normally send mass spam emails, but this current email under analysis has markers indicating that it is likely to be a mass spam email, and the subject matter is a rare subject for this user to send emails, the dynamic profile obtained from the machine learning model is used to identify a set of unusual behaviors that may trigger autonomous behavior.

[0044] In one embodiment, a cyber threat module (locally) in the endpoint agent extension 100 or an email module (across the network) in the cyber security appliance can analyze draft emails and outbound emails using content and meta data analysis tools. Each dynamic profile modeled in the user model includes data about a user, at least one organization of the data within a different type of subject area. The email module in the cyber security appliance computes and maintains the dynamic profile modeled in the user model and then transmits instances of that dynamic profile modeled in the user model to the endpoint agent extension 100 for decision support.

[0045] In one embodiment, modules in the endpoint agent extension 100 and / or modules in the cyber security appliance may use classifiers / machine learning for processing. Mathematical classifiers are used to create a "user modeled dynamic profile" of an individual's email life patterns (and peer group and organizational positioning) that can be a) used by the cyber security appliance to decide on the action to be taken for each new email created and / or b) stored by the endpoint agent extension to decide locally on the anomaly of each new email created. This mathematical classifier also includes existing classifiers that determine the anomaly of attachments, linked files, etc. for emails from that particular email user. Various mathematical algorithms may be used to validate the rarity determination. Modules in the endpoint agent extension 100 use email classifiers that identify the rarity / anomaly of emails and attachments in the network domain to validate whether it is, in fact, contextually malicious. This endpoint agent extension 100, residing on the endpoint computing device, interfaces with the email application and uses artificial intelligence learning to enhance the email defenses of that particular endpoint computing device.

[0046] The behavioral module of the endpoint agent extension 100 extends the autonomous actions that the email module can perform in conjunction with the autonomous response module within the cyber security appliance to also encompass various actions on outbound emails that are about to be sent, thus, for example, preventing data loss and enforcing compliance policies and procedures (see, for example, FIG. 3).

[0047] In addition to directing autonomous action immediately upon detecting a threat to prevent (a) data exfiltration threats, (b) malicious anomalous behavior threats, and (c) any combination of these two decisions, the behavioral module of the endpoint agent extension 100 is further configured to direct autonomous action on outbound email when additional decisions are made, including (d) preventing the sending of the email and sending a notification to the user regarding whether to send the outbound email to the suspected erroneous email recipient address, and (e) preventing the sending of the email and sending a notification to the user when the email under analysis, including any attached or linked files, is determined to violate email policies implemented by an organization that includes the user.

[0048] It should be noted that rather than a human taking action, if the threat risk parameters from the cyber threat module are equal to or greater than the action-guiding threshold, the autonomous response module and / or the behavioral module can be used to take one or more autonomous, immediate actions to thwart the cyber threat against the outbound email under analysis. The autonomous response module can be configured to instruct the behavioral module to perform these actions. The behavioral module of the endpoint agent extension 100 extends the autonomous actions that the email module can perform in conjunction with the autonomous response module to also encompass various actions against the outbound email being sent, thus, for example, preventing data loss, enforcing compliance policies and procedures, etc. (see FIG. 3).

[0049] The cyber threat module of the endpoint agent extension 100 is configured to review / analyze emails configured to be sent from the outbox, thereby (a) preventing unauthorized data loss using additional input information from other areas - cloud / SaaS / network / email / host extended digital assets if deemed anomalous to prevent data exfiltration, (b) performing recipient checks that are content, context, and organization-wide association awareness as a supporting element to apply knowledge of known correspondents to prevent sending to unintended recipients that may have been added by the user accidentally / mistyped, which is misdirected / recipient checks, (c) in case of potentially malicious cyber threats deemed associated with the user's anomalous behavior, coordinate with other cyber defense components such as autonomous response modules in the IT network / OT network / host / SaaS and cloud security appliances, firewalls, etc. to block email access for users behaving anomalously elsewhere, (d) preventing users from violating internal processes / GDPR / policies using email, and (e) preventing outbound email by other similar actions. Thus, the endpoint agent extension 100 with autonomous behavior can stop data exfiltration and data loss from sent emails, stop emails with incorrect / unintended recipients entered by matching email subject and currently entered recipients, stripping attachments, disabling links, and many other beneficial uses. The endpoint agent extension 100 increases the need for enhanced email security to prevent damage to a company's reputation due to unauthorized disclosure and / or data breaches, and / or loss of company revenue due to data exfiltration to competitors and / or other sources.Based on the likelihood that the created email is anomalous, the endpoint agent extension 100 takes action against erroneous or malicious emails and, importantly, is not instructed to trigger action against most commonly created emails that are not deemed to be abnormal.

[0050] The endpoint agent extension 100 plugs into email client applications to allow email attachments to be scanned for content using similar tools that detect known malicious malware, and to determine whether an attached or linked file is normally benign but is now contextually malicious. This endpoint agent extension 100 uses email classifiers that identify the rarity / anomaly of email and network domain attachments or links to establish whether a file sent with an outbound email is in fact contextually malicious. For example, an Excel spreadsheet file called "Leads-16.xslx" is not malicious in itself to an antivirus product if it does not contain any literal malware. However, if the endpoint agent extension sends an outbound email with this file to a user's personal email address, or to an email address at a competitor's domain, or to an email address identified as a known malicious domain, then the outbound email with this file will be determined to be contextually malicious data exfiltration.

[0051] In another example, as mentioned above, the endpoint agent extension 100 performs recipient checks that are content, context, and organization-wide association aware to prevent misaddressed outbound emails. The endpoint agent extension 100 uses algorithms to perform basic recipient matching. Additionally, the agent's cyber threat module leverages broader network behavior awareness when making local decisions - for example, this email user has never sent email to todd@example.com, but from information gathered by cyber security appliances within the network, this email user spends a lot of time interacting with the example.com domain on the network, so emails sent to recipient addresses in the example.com domain are not anomalous behavior.

[0052] As previously described, each dynamic profile modeled in the user model includes data about a user, with at least one organization of the data being within a different type of subject area. Each dynamic profile modeled in the user model is tailored to that user. Each type of subject area that this user sends emails to has its own associated grouping of that user's usual possible recipients. Each subject area has its own group of putative recipients, e.g., a grouping clustered with a link between email recipients and subject area topics. The cyber threat module can analyze the content of the outbound email under analysis and match the current subject area under analysis with closely related subject areas of various types. The cyber threat module can then analyze whether each of the recipients of the current email address is likely to be an intended recipient based on that particular subject area and its own associated grouping of the user's usual possible recipients. If the current recipient is not in the cluster of possible recipients for one or more subject areas of that email being composed, the cyber threat module can notify the user of the possibly fraudulently listed email recipients. The user can modify the suggested recipient emails or confirm the currently listed recipients. Each subject area is dynamically updated based on the user's history, which is continually updated as the user continues to compose and send emails.

[0053] The cyber threat module works with one or more policy-based machine learning models and sends them periodic updates to keep them up to date. The cyber threat module works with user models modeled on General Data Protection Regulation (GDPR) compliance and sends them periodic updates to analyze potential violations. In one embodiment, the cyber defense system analysis and data collection is GDPR compliant. In general, the cyber defense system collects data in a manner that clusters information about each user by user with their identity while keeping the actual identity of the individual anonymous. Alternatively, data collection from the network and email domains is not anonymized. An optional anonymization layer of the network components can be implemented to prevent the visual appearance of that data, which does not affect the collection or storage of the underlying data, and is not anonymized for administrative users. Additionally, data communication between the agent and the main device is encrypted. The one or more models trained on the policy help detect policy violations, such as a user attempting to access their personal email address at work or including personal credit card information in an email. The one or more models can identify policy violations, including GDPR violations.

[0054] Traditionally, some previous systems only looked at emails coming into the inbox. This endpoint agent extension can look / analyze not only emails coming into the inbox, but also emails being sent from the outbox. This endpoint agent extension with autonomous behavior can stop data exfiltration and data loss from sent emails, stop emails with incorrect / unintended recipients entered by matching email subject and currently entered recipients, and many other beneficial uses. Furthermore, the cyber defense system is configured to integrate the endpoint agent extension with email threat detection and response capabilities into the endpoint computing devices.

[0055] FIG. 3 illustrates a block diagram of one embodiment of an example autonomous behavior that the autonomous rapid response module and / or behavior module may be configured to take without a human initiating the behavior.

[0056] The autonomous rapid response module is configurable, via the user interface 350, to know when to take autonomous action to stop a cyber threat when i) a known malicious email or ii) an email that is at least highly likely to be malicious is determined by the email module. The autonomous rapid response module has management tools that are configurable through the user interface to program / set what are the autonomous actions that the autonomous rapid response module can take, including the type of action and the specific action that the autonomous rapid response module can take, when the threat risk parameter is at or above a threshold that guides the action that is selectable by the cyber professional, i.e., the email module indicates that one or more emails under analysis are at least highly likely to be malicious.

[0057] The types of actions and specific actions that the autonomous rapid response module takes are customizable for different users and parts of the system, and therefore configurable for cyber experts to approve / set when the autonomous rapid response module should automatically take those actions.

[0058] The autonomous rapid response module has a library of response action types and specific actions that are possible for the autonomous rapid response module, including focused response actions selectable through the user interface 350 that are contextualized to take autonomously against specific email elements of a malicious email, rather than a blanket quarantine or block approach to that email, to avoid business disruptions to specific users of the email system. The autonomous rapid response module can take a variety of measured actions directed toward those email communications to minimize business disruptions in a responsive, contextualized manner.

[0059] The autonomous response module works closely with the AI ​​models to neutralize malicious emails and provide preemptive protection against targeted email-based attack campaigns in real time.

[0060] An email module working in conjunction with an autonomous response module can, for example, detect and stop an infection in the network, recognize that the source of the infection was email, and identify and neutralize the malicious email by deleting it from the inbox of the corporate email account or simply stripping the malicious part before the email reaches its intended user. Autonomous actions can range from flattening attachments or stripping suspicious links to stopping emails altogether if they pose a sufficient risk.

[0061] The email module can determine the source of the compromise and then invoke an autonomous response action by sending a request to the autonomous response model, which can quickly stop the spread of an emerging attack campaign and give human responders the critical time they need to catch up.

[0062] Example possible actions The example actions in the following sections categorized as delivery actions, attachment actions, link actions, header and body actions, etc., may be displayed on the dashboard and may be taken, or at least suggested to be taken, by the autonomous response module when the threat risk parameters are at or above configurable set points set by the cyber security expert.

[0063] Hold message: The autonomous response module holds a message before delivery due to suspicious content or attachments. The held email may be reprocessed and released by an operator after investigation. The email is deleted from the recipient's inbox if delivery is prevented or delivery has already occurred. The original email is kept in a buffer cache by the data store and may be recovered or sent to an alternate mailbox using a "Release" button in the user interface 350.

[0064] Lock the link: The autonomous response module replaces the URL of the link such that clicking on the link will first divert the user to an alternate destination. Optionally, the alternate destination may require confirmation from the user before proceeding. The original link destination and original source are subject to additional checks before the user is allowed access to that source.

[0065] Double-lock the link: The autonomous response module replaces the URL with a redirected email link. When the link is clicked, the user is presented with a notification that they are not authorized to access the original destination of the link. The user cannot follow the link to the original source, and the user's intent to follow the link is recorded by the data store via the autonomous response module.

[0066] Strip Attachments: The autonomous response module strips one or more attachments from this email. Most file types are delivered as converted attachments. File types that do not convert to a visible document (e.g., executables, compressed types) are stripped to reduce risk. The "Strip Attachments" action causes the system to remove the attachment from the email and replace it with a file that informs the user that the original attachment was removed.

[0067] Redirect: The autonomous response module ensures that an email is not delivered to the intended recipient, but instead delivered to a specific email address.

[0068] Take no action on attachments: Can be set on a specific user basis. This action overrides any attachment actions that might otherwise be taken by the autonomous response module, whether in response to a specific threat alert or in response to an overall detected anomaly level.

[0069] Spoofing Removal: The autonomous response module identifies standard email header address fields (e.g., rfc822 types) and replaces personal names and header email addresses with alternative names or email addresses that may reveal more about the true sender of the email. This mechanism significantly reduces the psychological impact of spoofing attempts.

[0070] Referring to FIG. 1, when the threat risk parameters from the cyber threat module are equal to or greater than the action-guiding threshold, rather than a human taking action, the behavioral module is used to take one or more autonomous, immediate actions to thwart the cyber threat. Actions may include logging the user off of that client machine, preventing the email from being sent, sending a notification to the organization's cyber security personnel, sending a notification to the user regarding whether to send this email to the email recipient address that appears to be erroneous, etc. Based on the likelihood that the composed email is anomalous, the endpoint agent extension 100 may suggest (or suggest) an alternative recipient based on known communication history or other contextual factors, strip attachments, or prevent the outbound email altogether.

[0071] As an endpoint agent extension 100 of the cyber defense system that prevents malicious inbound emails, this application can regulate at least outbound emails. For outbound emails, the endpoint agent extension performs the following actions:

[0072] (a) Data Exfiltration Prevention / Data Loss Prevention - typically occurs primarily by a user emailing a sensitive attachment to their own personal email address, a competitor's email address, or an email address of an unintended recipient. The endpoint agent extension 100 prevents many things, such as damage to a company's reputation due to unauthorized disclosure and / or data breach, and / or loss of company revenue due to data exfiltration to a competitor. Dynamic profiles and machine learning models help determine how unusual / rare it is that a file with that subject and type of document file type is attached or linked to this user's email. Secure communication exchanges between the cyber security appliance and the endpoint agent extension 100 can provide recent and historical network activity to help determine if this file transfer is unusual in this context and for the stated email recipient. In one embodiment, several factors are examined to trigger an exfiltration analysis. For example, in some cases, the attached or linked file must exceed a certain data file size. If the file is below this data file size, it will not trigger an exfiltration analysis since, depending on the subject matter and current context, the amount of data loss for non-sensitive data is minimal. Also, an exfiltration analysis may be triggered, for example, when the attachment or link to the file is of a particular subject matter or type of document that users would not normally attach or link to their emails. An exfiltration analysis may be triggered if the email with the file attached or linked is addressed to the recipient's personal email address, and / or to a competitor's email address, and / or to a known or suspected malicious email address from a malicious email domain.

[0073] (b) Recipient Checks / Emails Considered Misaddressed - The outbound email threat module performs recipient checks that are aware of content, context, and associations across the organization. The endpoint agent extension 100 may perform basic recipient matching (fuzzy matching like todd@example.com vs. ted@sample.com) as a baseline, but may then analyze broader associations of user, content, etc. to make more nuanced suggestions. The cyber threat module uses email life pattern knowledge from the model to make smart suggestions - for example, you may have communicated with todd@example.com before, but never about subject A, so you may try to send an email to ted@sample.com, who you regularly discuss with about subject A. The endpoint agent extension 100 cyber threat module leverages broader network behavior awareness when making local decisions - for example, you have never sent email to todd@example.com, but you spend a lot of time interacting with the example.com domain on the network, so it is not an unusual or unusual recipient address.

[0074] (c) The current behavior of the email user is considered an anomaly / non-normal in the user’s modeled behavior by integrating with other cyber defense components, including one or more machine learning models.

[0075] The Cyber ​​Threat Module identifies anomalous / non-normal behavior and limits damage when a breach occurs elsewhere - such as when an employee reuses compromised credentials (on a third-party platform) and a corporate email account is accessed to send spam emails.

[0076] As mentioned above, each dynamic profile modeled in the user model contains data about a user and at least one organization in a different type of subject area. The endpoint agent extension uses classifiers to investigate when an attachment may be malicious in the context of i) the current email and its listed recipients, and ii) the current user's role in the organization and past history of this user and colleagues performing similar roles / jobs in the organization, and iii) built-in information about the file, this user, and the email from outside the email domain. Thus, the agent can use contextual information from other sources such as host, SaaS, and network to inform its decisions. For example, the SaaS module may discern files from unusual locations for clustered user groups, or users downloading very large amounts of files. The cyber defense system may then execute a multi-layered autonomous response, i.e., the SaaS module logs out the user, the network module enforces standard pattern of life behavior on the user's normal browsing port, e.g., port 443 / 80, and the endpoint agent extension prevents anomalous outbound emails or emails containing problematic files. Each of the multiple layers executes actions at approximately the same time to prevent cyber threats. Note that in machine learning, the cyber defense system may use various types of classification algorithms, such as linear classifiers, logistic regression classifiers, naive Bayes classifiers, nearest neighbor classifiers, and support vector machine classifiers. Unsupervised classification may use algorithms that attempt to discover natural structures in the data. Note that this natural structure may not necessarily be what humans would consider a logical division. The algorithm looks for similar patterns and structures in the data points and groups them into clusters. Classification of the data is done based on the clusters formed.Unsupervised classification can generate insights such as associations, commonalities, and rarities from data.

[0077] (d) The cyber threat module works with one or more policy trained models, including a GDPR trained model, to protect citizens' personal data and privacy. Thus, the outbound cyber threat module working with the GDPR model analyzes emails for identifying personal data and for missing necessary unsubscribe links as required by law.

[0078] Thus, a cyber defense system for email including two or more modules and one or more machine learning models prevents at least outbound email that the cyber defense system deems malicious or erroneous as per points (a) to (e) herein.

[0079] Next, the endpoint agent extension is created for easy rollout. A set of executable files in the rollout routine facilitates and automates the download and installation of the endpoint agent extension on the endpoint computing device. The rollout routine is configured to comply with Microsoft's One Click standard. Similarly, on the phone, the endpoint agent extension is created to match the phone's mobile device management profile.

[0080] Additionally, FIG. 6 illustrates a block diagram of an embodiment of a cyber security device having an email module that references a machine learning model that is trained on normal behavior of email activity and user activity associated with at least an email system.

[0081] The cyber security appliance 660 may protect against cyber security threats from the email system and its network. The cyber security appliance 660 may include components such as i) a trigger module, ii) a collection module, iii) a data store, iv) a network module, v) an email module, vi) a network & email coordinator module, vii) a user interface and display module, viii) an autonomous response module, ix) one or more machine learning models, including a first artificial intelligence model trained on characteristics of the email itself and its associated data, a second artificial intelligence model trained on potential cyber threats, and one or more artificial intelligence models trained on the activities of different users, devices, systems and interactions between entities in the system, as well as other aspects of the system, and x) other similar components within the cyber security appliance 660.

[0082] The trigger module may detect time-stamped data indicating that one or more i) events and / or ii) alerts have occurred due to I) unusual or II) suspicious behavior / activity, and then trigger that something unusual is happening. Thus, the collector module is triggered by specific events and / or alerts of i) anomalous behavior, ii) suspicious activity, and iii) any combination of both. Inline data may be collected on the deployment from a data store as traffic is observed. The range and wide variation of data available at this location results in good quality data for analysis. The collected data is passed to the email module.

[0083] The collector module may consist of multiple automated data collectors, each looking at a different aspect of the data depending on the particular hypothesis formed about the event and / or alert being analyzed. Data relevant to each type of possible hypothesis is automatically pulled from additional external and internal sources. Some data is pulled or acquired by the collector module for each possible hypothesis. A feedback loop of cooperation occurs between the collector module, the email module that monitors email activity, the network module that monitors network activity, the mass email association algorithm, the email similarity scoring algorithm, the email layout change predictor algorithm, the image tracking link module, and the email module to apply one or more models that are trained on different aspects of this process. Each hypothesis of a typical threat, e.g., human user insider attack / inappropriate network and / or email behavior, malicious software / malware attack / inappropriate network and / or email behavior, can have various supporting items of data and other metrics associated with that possible threat, and the machine learning algorithm looks at the supporting items of data to prove or disprove the specific hypothesis of what suspicious activity and / or anomalous behavior is associated with for each hypothesis about what suspicious activity and / or anomalous behavior is associated with. Networks have a wealth of data and metrics that can be collected, and then most of the data is filtered / aggregated by the collector into key / salient features of the data.

[0084] In one embodiment, the network module, the email module, and the network & email coordinator module may be part of an email module. In one embodiment, the mass email association algorithm, the email similarity scoring algorithm, the email layout change predictor algorithm, and the image tracking link module may be separate modules or may be combined into part of a larger module. The modules may be implemented as electronic hardware circuitry, executable software structures, and / or a combination of both.

[0085] The email module may also use one or more machine learning models that are trained on cyber threats within the email system. The email module may reference models that are trained on normal behavior of email and user activity associated with the email system. The email module may reference these various trained machine learning models as well as data from the network module, the email and network coordinator module, and the trigger module. The email module may determine a threat risk parameter that takes into account how a series of non-normal behaviors correlate to potential cyber threats, as well as "what is the likelihood of this series of one or more non-normal behaviors of the email and user activity under analysis that deviates from the normal harmless behavior obtained, and thus is malicious behavior." Each of the other modules, such as the mass email correlation algorithm, email similarity scoring algorithm, email layout change predictor algorithm, image tracking link module, etc., may provide its own input to the overall analysis by the email module.

[0086] The one or more machine learning models may be self-learning models that use unsupervised learning and are trained on normal behavior for different aspects of the system, e.g., email activity and user activity associated with an email system. The self-learning model of normal behavior is updated periodically. The self-learning model of normal behavior is updated when new input data is received and deemed within the range of normal behavior. Normal behavior thresholds are used by the model as a moving standard for parameters that correspond to normal patterns of life for the endpoint computing device. The normal behavior thresholds move according to updated changes in the computer system, allowing the model to discern behavior on the endpoint computing device that falls outside the parameters set by the moving standard.

[0087] 7 illustrates a block diagram of one embodiment of an email module that compares analyzed metrics of user activity and email activity and corresponding potential cyber threats compared to respective varying benchmarks of parameters corresponding to normal behavior of email activity and user activity associated with the network and its email domains used by the self-learning machine learning model. The email module can then determine cyber threat risk parameters indicative of the likelihood of a cyber threat according to the analyzed metrics and varying standards of what is considered normal behavior.

[0088] The cyber security appliance may also include one or more machine learning models that are trained to gain an understanding of multiple characteristics of the email itself and its associated data, including classifying properties of the email itself and its meta data.

[0089] The email module may also reference a machine learning model that is trained on the email itself and its associated data to determine whether an email or set of emails under analysis has potentially malicious characteristics. The email module may also take this email characteristic analysis into account in its determination of the threat risk parameters.

[0090] 6, the network module may have one or more machine learning models that are trained on the normal behavior of users, devices, and the interactions between them on the network tied to the email system. The email module may also take this network analysis into account in its determination of threat risk parameters.

[0091] The user interface has one or more windows for displaying network data, as well as one or more windows for displaying emails and cyber security details about those emails on a display screen through the same user interface, enabling a cyber professional to pivot between the network data and the email cyber security details within one platform and view them as an interconnected whole rather than separate areas on the same display screen.

[0092] The cyber security appliance 660 may use at least three separate machine learning models. Each machine learning model may be trained on a particular aspect of the normal life patterns for the system, such as devices, users, network traffic flows, output from one or more cyber security analysis tools that analyze the system, etc. One or more machine learning models may also be trained on the characteristics and aspects of all modalities of a type of cyber threat. One or more machine learning models may also be trained on the characteristics of the email itself.

[0093] Both the email module, monitoring email activity, and the network module, monitoring network activity, may send their data to the network and email coordinator module to correlate causal relationships between these activities, and provide this input to the email module. The email module may also take into account the causal analysis of the connection between this particular email and network activity in its determination of threat risk parameters.

[0094] The mass email correlation algorithm determines the likelihood that two or more highly similar emails have been i) sent from or ii) received by a set of users in the email domain under analysis at substantially the same time based on at least i) past communication patterns between those users, and ii) how rare it is for all of the set of users under analysis to send and / or receive this highly similar email within approximately substantially the same time frame. The normal behavior of the network and email activity and user activity associated with that email domain are used by the mass email correlation algorithm to create a map of associations between users in the email domain and generate a probabilistic likelihood that two or more users are included in the highly similar emails determined by the mass email correlation detector.

[0095] The email layout change predictor algorithm analyzes changes in email layout of emails of users in the email domain to assess whether malicious activity is occurring in the user's email account based on changes in email layout of emails that deviate from a historical baseline. The email layout change predictor algorithm detects anomalous deviations by considering two or more parameters of an email selected from the group consisting of the layout of the email, the format of the email, and the structure of the email body including any of the content, language usage, subject matter, and sentence structure within the email body to detect changes in the behavior of the email sender under analysis that indicate the account has been compromised. The email layout change predictor algorithm utilizes machine learning models. One or more machine learning models are trained and configured to model and store historical baseline states of layout, including format and structure for each sender (inside or outside the email domain). The email layout change predictor algorithm compares this historical baseline state of layout, format, and structure each time a new email is seen. The email layout change predictor algorithm checks whether the new email about to be sent deviates from the historical baseline state by more than a threshold amount.

[0096] The image tracking link detector detects image tracking links based on the visual properties of the link (e.g., Cascading Style Sheets (CSS) properties that describe the visual style and appearance of the link) and the purpose of the query parameters from that link. The image tracking link module works in conjunction with the image tracking link detector to analyze the properties of the link that describe the visual style and appearance of the link to detect whether the tracking link is intentionally hidden and the type of query request made by the tracking link. Using this information, the image tracking link module determines whether the tracking link is a suspicious covert tracking link, and then, when determined to be a suspicious covert tracking link, the autonomous response module takes autonomous action to repair the tracking link while stopping only the emails that contain the suspicious covert tracking link, rather than stopping all emails entering the email domain that contain the tracking link.

[0097] Again, the email module is configured to receive input from at least each of the two or more modules described above. The email module takes into account the input from each of these analyses described above and uses the broad meta data from the observed email communications to detect and determine when deviations from normal behavior of email activity and user activity associated with the network and its email domain occur, and then determines what autonomous action to take to remediate the potentially malicious email. The module communicates with a set of machine learning models. The two or more modules are also configured to receive information from a probe including a set of detectors to provide at least broad meta data from the observed email communications at the email domain. The email module works in conjunction with the two or more modules to analyze the broad meta data from the observed email communications. The email module also analyzes with machine learning models trained on normal behavior of email activity and user activity associated with the network and its email domain to determine when deviations from normal behavior of email activity and user activity associated with the network and its email domain occur.

[0098] The cyber security appliance 660 uses various probes to collect user and email activity and then sends the activity to a data store and, as appropriate, to the email module and machine learning models. The email module uses the collected data to derive an understanding of email and user activity within the email system and to update training for one or more machine learning models trained on the email system and its users. For example, email traffic may be collected by placing probe hooks into email applications such as Outlook or Gmail and / or by monitoring the Internet gateway from which email is routed. Additionally, the probes may collect network data and metrics by one of the following methods: port scanning the organization's existing network equipment, inserting or reusing inline network taps, and / or accessing existing repositories of network data.

[0099] The email module does not proactively know what a "bad" email signature looks like and prevents known "bad" email signatures, but rather detects deviations from normal behavior in email activity and user activity associated with the network and its email domains based on at least one or more AI models that determine normal behavior in email activity and user activity associated with the network and its email domains.

[0100] The cyber security appliance 660 takes action to combat the detected potential cyber threat. If the threat risk parameter from the email module is equal to or greater than the action guiding threshold, the autonomous response module is configured to take one or more autonomous rapid actions to thwart the cyber threat, rather than a human taking action. The email module works in conjunction with the autonomous response module to take one or more autonomous actions to thwart the cyber threat, in order to improve the computing device in the email system by limiting the impact of the cyber threat from consuming unauthorized CPU cycles, memory space, and power consumption in the computing device, by responding to the cyber threat without waiting for human intervention.

[0101] The Network Module and its machine learning models are utilized to determine network activity that may be unusual to provide additional input of information to the Email Module to determine a threat risk parameter (e.g., score or probability) indicative of the level of threat. A particular user's network activity may be linked to its email activity as the Network Module observes the network activity and the Network & Email Coordinator Module receives the Network Module's observations to derive an understanding of this particular user's email activity and evaluates potential email threats with the resulting threat risk parameters tailored to various users in the email system. The Network Module tracks each user's network activity and interconnects the network activity and email activity to provide detailed information about each other's behavior and the evaluation of potential email threats.

[0102] The cyber defense system 660 traces potentially malicious activity observed by the network module on the organization's network back to specific email events monitored by the email module and uses an autonomous rapid response module to stop the potentially harmful activity on the network itself and to freeze similar email activity that triggers the harmful activity on the network.

[0103] As previously described, a probe including a set of detectors collects user and email activity. The collected activity is provided to a data store for storing this information, which is then evaluated by a module for non-normal or suspicious behavioral activity (e.g., alerts, events, etc.). The collected data can also be used to potentially update training for one or more machine learning models trained on the normal life patterns of user and email activity for this email system, its users and networks, and the entity.

[0104] In FIG. 7, the user interface may display a graph 725 of an exemplary series of unusual behavior of email in relation to other networks under analysis.

[0105] The Network & Email module allows you to tie alerts and events from the email domain to alerts and events from the network domain.

[0106] The email module interfaces with one or more machine learning models trained and otherwise configured with mathematical algorithms for cyber threat analysis to infer what may occur due to a series of disparate alerts and / or events resulting from an abnormal pattern and then assign a threat risk associated with the disparate items of the series of alerts and / or events that form the abnormal pattern.

[0107] This is a "behavioral pattern analysis" of what is the abnormal behavior of the network / system / device / user / email under analysis by the email module and machine learning model. The cyber defense system uses the abnormal behavior that deviates from normal behavior and then builds a chain of abnormal behavior and causal relationships between this chain of abnormal behavior to detect cyber threats. An exemplary behavioral pattern analysis of what is abnormal behavior may be as follows: An abnormal pattern may be determined by filtering out activities / events / alerts that fall within a window of being a normal pattern of life for that network / system / device / user / email under analysis, and then the remaining activity / event / alert behavior pattern, after filtering out, may be analyzed to determine if the pattern is indicative of a malicious party behavior - human, program, email, or other threat. The defense system may go back and pull out some of the filtered out normal activities to help prove or disprove a possible hypothesis of whether the pattern is indicative of a malicious party behavior. An exemplary behavioral pattern included within the chain is shown in a graph over an example 7-day time frame. The prevention system detects three unusual behaviors in a series of unusual data transfers, and three unusual features in emails in the monitored system that appear to have some causal relationship to the unusual data transfers. Similarly, two unusual credentials attempting unusual behaviors to gain access to an information sensitive area, or a malicious IP address and user associated with unusual credentials attempting unusual behaviors, are causally related to at least one of those three emails with unusual features. When the behavioral pattern analysis of the individual behaviors or the chain as a group is deemed to be indicative of a malicious threat, a score is generated of how confident the prevention system is in this assessment that it identifies whether the unusual pattern was caused by a malicious party.Then, further assigned is a threat level parameter (e.g., a score or probability) indicating what level of threat this malicious party poses to the system. Finally, the cyber defense system is configurable within its user interface of the defense system as to what type of automated response action, if any, the defense system may take when posed by this malicious party for different types of cyber threats that are equal to or greater than the configurable level of threat.

[0108] The email module may connect the individual alerts and events that form an unusual pattern into a disparate topic for cyber threat analysis of the series of disparate alerts and / or events. The email module may reference one or more machine learning models trained on email threats to identify similar features from the individual alerts and / or events that form a disparate topic made up of the series of alerts and / or events that form an unusual pattern.

[0109] One or more machine learning models may also be trained on characteristics and aspects of all modalities of a cyber threat type to analyze the threat risk associated with a series / group of alerts and / or events that form an unusual pattern. Machine learning techniques using advanced mathematics can detect previously unidentified threats and automatically defend the network without rules.

[0110] The model may be implemented by threat detection through probabilistic changes in normal behavior through the application of unsupervised Bayesian mathematical models to detect behavioral changes in computers and computer networks. The core threat detection system is called "Bayesian Probabilistic". Bayesian Probabilistic techniques can determine periodicity in multiple time series data and identify changes across single or multiple time series data for the purpose of anomalous behavior detection. From email, and network raw sources of data, a large number of metrics can be obtained, each of which results in a time series of a given metric.

[0111] The detectors in the email module, including its network module and email module components, may be discrete mathematical models that implement a particular mathematical methodology on a set of different variables with targets, such that each model is specifically targeted to, for example, i) its cyber security analysis tools, ii) analyzing different aspects of emails, iii) the pattern of life of alerts and / or events brought about by particular devices and / or users in the system, etc.

[0112] Fundamentally, a cyber defense system mathematically characterizes what constitutes "normal" behavior based on the analysis of a large number of different measures / sets of different measures of a device's network behavior. The cyber defense system can build an elaborate "pattern of life" that understands what represents normal for every person, device, email activity, and network activity within the system being protected by the cyber defense system.

[0113] As previously described, each machine learning model may be trained on a particular aspect of the normal pattern of life of the system, such as devices, users, network traffic flows, output from one or more cyber security analysis tools analyzing the system, email contact associations for each user, email features, etc. The one or more machine learning models may use at least an unsupervised learning algorithm to establish what the normal pattern of life of the system is. The machine learning models may be trained on both i) the past normal delivery of alerts and events for that system, and ii) normal delivery information from similar peer systems is taken into account to establish the normal pattern of life of alert and / or event behavior for that system. Another set of machine learning models is trained on email features and the activities and behavior of that email user to establish normal for these.

[0114] Note that when the model detects anomalies by leveraging at least two different techniques: for example, comparing the behavior of each system with its own history, and comparing it with the history of its peers, and / or, for example, comparing emails with both the email characteristics and the activity and behavior of that email user, this multi-source comparison allows the model to avoid learning existing malicious behavior as "normal" since compromised devices / users / components / emails will exhibit different behavior than their close peers.

[0115] In addition, one or more machine learning models can use a comparison between i) normal life patterns for the system corresponding to past normal delivery of alerts and events for the system mapped in the same multi-dimensional space, and ii) the behavior of the current set of individual alerts and events under analysis. This comparison can result in the detection of one or more abnormal patterns of behavior within the plotted individual alerts and / or events, which allows for the detection of previously unidentified cyber threats compared to simply finding cyber threats using predefined descriptive objects and / or signatures. Thus, increasingly sophisticated malicious cyber threats that try to pick and choose when they act to generate low-level alerts and events will still be detected, even if they have not yet been identified by other means of cyber analysis. These sophisticated malicious cyber threats can include malware, spyware, keyloggers, malicious links in emails, malicious attachments in emails, etc., as well as rogue internal information technology staff who know well how not to trigger any high-level alerts or events.

[0116] Essentially, plotting and comparing is a way to filter out what is normal for the system and then focus the analysis on what is anomalous or unusual for the system. Then, for each hypothesis of what may be happening due to a set of unusual events and / or alerts, the collector module can collect additional metrics from the data store, including the pool of metrics originally considered "normal behavior", to prove or disprove each possible hypothesis of what may be happening due to this set of unusual behavior under analysis.

[0117] It should be noted that each individual alert and / or event in a chain of alerts and / or events forming an unusual pattern may exhibit subtle anomalous behavior and thus each alert and / or event may have a low threat risk associated with that individual alert and / or event, however, when analyzed as a series of distinct alerts and / or events that form an unusual pattern by one or more machine learning models, that distinct series / group of alerts and / or events may now be determined to pose a much higher threat risk than any of the individual alerts and / or events in the chain.

[0118] In addition, it should be noted that today's cyber attacks can be of such severity and speed that a human response cannot occur fast enough. Thanks to these advances in self-learning, it is now possible for machines to discover these new threats and develop appropriate real-time responses to combat the most serious cyber threats.

[0119] Cyber ​​defense systems have the ability to self-learn and detect normality to distinguish true anomalies, allowing organizations of any size to understand the behavior of users and machines on their networks at both individual and group levels. Monitoring behavior rather than using predefined descriptive objects and / or traits means that more attacks can be spotted in advance and very subtle signs of fraud can be detected. Unlike traditional, outdated defenses, a specific attack type or new malware does not need to be seen first before it is detected. Behavioral defense techniques mathematically model both machine email and human activity in terms of behavior, at the time of and after a security breach, to predict and understand today's increasingly sophisticated cyber attack vectors. Thus, it is possible to computationally establish what is normal in order to detect what is abnormal later. Furthermore, machine learning constantly rethinks assumptions about behavior using probability mathematics. Cyber ​​defense systems' unsupervised machine learning methods do not require training data with predefined labels. Instead, the methods are able to identify key patterns and trends in the data without the need for human input.

[0120] FIG. 4 illustrates a block diagram of one embodiment of an email module and / or cyber threat module that takes into account many factors including email content behavioral anomalies, network behavior anomalies, the recipient of the email, and the inbound or outbound direction of the email, and then works with one or more mathematical models to compare emails based on multiple aspects of the email to identify threats posed by outbound emails and their attachments and / or links.

[0121] FIG. 5 illustrates a block diagram of one embodiment of an email module and / or cyber threat module that takes into account many other exemplary factors including email content behavioral anomalies, email behavioral anomaly format, email generation in or out of the workplace, email properties including attached or linked files, and email type, and then interfaces with one or more mathematical models to identify threats posed by outbound email and its attachments and / or links.

[0122] The Email Module communicates with the Network Module to receive information about links and external locations accessed by internal users, and combines that information with its own intelligence about links observed in email traffic, all of which is stored in a compressed manner and can be queried to establish if something is "rare". The system can maintain a rolling "memory" of domains referenced by the Email Module in emails and from links, as well as host domains referenced by the Network Module on the network, allowing the Email Module to correlate the two.

[0123] Defense Systems FIG. 8 illustrates a block diagram of one embodiment of an exemplary cyber defense system protecting an exemplary network. FIG. 8 of the exemplary network illustrates a network of computer systems 50 using the cyber defense system. The system depicted by FIG. 8 is a simplified diagram provided to facilitate the description of the present invention. The system 50 comprises a first computer system 10 in a building, which uses the cyber defense system to detect threats to computing devices within its range and thereby attempt to prevent the threats. The first computer system 10 comprises three computing devices 1, 2, 3, a local server 4, and a multifunction device 5 that provides printing, scanning, and faxing capabilities to each of the computing devices 1, 2, 3. All of the devices in the first computer system 10 are communicatively coupled via a local area network 6. As a result, all of the computing devices 1, 2, 3 can access the local server 4 via a LAN 6 and use the functions of the multifunction device (MFD) 5 via the LAN 6.

[0124] The LAN 6 of the first computer system 10 is connected to the Internet 20, which provides computing devices 1, 2, 3 with access to a number of other computing devices, including a server 30 and a second computer system 40. The second computer system 40 also includes two computing devices 41, 42 connected by a second LAN 43.

[0125] In this exemplary embodiment, computing devices 1, 2, 3, and 41 and 42 have instances of the endpoint agent extension and therefore perform the threat detection method described herein. Each computing system thus comprises a processor configured to perform the steps of the process described herein, memory necessary to store information related to the execution of the process, and a network interface for collecting the required information. The method is described in more detail with reference to FIG. 8.

[0126] The computing device builds and maintains a dynamic, ever-changing model of the "normal behavior" of each user and machine in the system 10, and each user who uses the computing device. The approach is based on Bayesian mathematics and monitors all interactions, events, and communications within the system 10 - which computers are communicating with which files, which files are created, and which networks are being accessed.

[0127] For example, computing device 2 is based in the company's San Francisco office and operated by a marketing employee who regularly accesses the marketing network and typically communicates with a machine in the company's UK office in second computer system 40 from 9:30am to noon and is active from approximately 8:30am to 6pm. This same employee virtually never accesses an employee timesheet, rarely connects to the company's Atlanta network, and has no transactions in Southeast Asia. The cyber defense system takes all available information about this employee and establishes a "pattern of life" for that person, which is dynamically updated as more information is gathered. The "normal" model is used as a moving standard, enabling the system to spot behavior on the system that appears to deviate from this normal pattern of life and flag this behavior as anomalous and requiring further investigation.

[0128] Cyber ​​defense systems are built to address the fact that today's attackers are more cautious and may "hide" in a system using normal software protocols to ensure that the end user does not suspect anything, such as slowing down the user's machine. Any attacking process will therefore automatically stop or "back off" if the mouse or keyboard is used. However, more sophisticated attacks try the opposite and hide in memory disguised as normal processes and steal CPU cycles only when the machine is active, in an attempt to defeat relatively simple security processes. These sophisticated attackers look for activity that cannot be directly associated with user input. Advanced persistent threat (APT) attacks typically have very long mission windows, weeks, months, or even years, and such processor cycles may be stolen very infrequently so as not to affect machine performance. However, no matter how stealthy and sophisticated an attack may be, there will always be a measurable difference, even if very slight, in typical machine behavior between before and after a security breach. This difference in behavior can be observed and acted upon in the form of Bayesian mathematical analysis used by a cyber defense system installed on computer 1.

[0129] This intelligent system can make value decisions and perform higher value, more thoughtful tasks. Machine learning requires complex algorithms to be devised and a comprehensive framework to interpret the results produced. However, when applied correctly, these techniques make it easy for machines to make logical, probability-based decisions and take on thoughtful tasks.

[0130] The methods and systems are configured to be executed by one or more processing components having any portion of the software stored in executable form on a computer-readable medium. The computer-readable medium may be non-transitory and does not include radio or other carrier waves. The computer-readable medium may be a physical computer-readable medium, such as, for example, a semiconductor or solid-state memory, a magnetic tape, a removable computer diskette, a random access memory (RAM), a read-only memory (ROM), a rigid magnetic disk, and an optical disk, such as a CD-ROM, a CD-R / W, or a DVD.

[0131] The various methods described above may be implemented by a computer program product. The computer program product may include computer code configured to instruct a computer to perform one or more functions of the various methods described above. The computer program and / or code for performing such a method may be provided to an apparatus such as a computer on a computer-readable medium or a computer program product. In the case of a computer program product, the transitory computer-readable medium may include radio or other carrier waves.

[0132] An apparatus, such as a computer, may be configured to execute such code to perform one or more processes in accordance with the various methods described herein.

[0133] Computing Systems FIG. 9 illustrates a diagram of an exemplary endpoint computing device that may implement an instance of an endpoint agent extension of a cyber defense system for email that includes two or more modules and interfaces with a machine learning model.

[0134] Components of an endpoint computing device include, but are not limited to, a processing unit having one or more processing cores, a system memory, and a system bus that couples various system components including the system memory to the processing unit. The system bus can be any of several types of bus structures selected from a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures. See Figure 2 for some exemplary endpoint computing devices.

[0135] An endpoint computing device typically includes a variety of computing machine-readable media. Computing machine-readable media may be any available media, including both volatile and non-volatile media, and both removable and non-removable media, that can be accessed by an endpoint computing device. By way of example and not limitation, use of computing machine-readable media includes storage of information, such as computer-readable instructions, data structures, other executable software, or other data. Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other tangible medium that can be used to store desired information and that can be accessed by the computing device 900. Transient media, such as wireless channels, are not included as machine-readable media. Communication media typically embodies computer-readable instructions, data structures, other executable software, or other transport mechanisms and includes any information delivery media.

[0136] It should be noted that the design may be executed on a single endpoint computing device and / or on a distributed system where different parts of the design are executed on different parts of distributed endpoint computing devices.

[0137] It should be noted that applications described herein include, but are not limited to, software applications, mobile apps, and programs that are part of an operating system application. Portions of this description are presented in terms of algorithms and symbolic representations of operations on data bits within a computer memory. These algorithmic descriptions and representations are the means used by those skilled in the data processing arts to most effectively convey the substance of their work to others skilled in the art. An algorithm is here, and generally, conceived to be a self-consistent sequence of steps leading to a desired result. The steps are those requiring physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, transferred, combined, compared, and otherwise manipulated. As is apparent from the above, unless otherwise stated, throughout the description, descriptions utilizing terms such as "processing" or "calculating" or "computing" or "determining" or "displaying" will be understood to refer to the actions and processes of a computer system or similar electronic computing device in which data represented as physical (electronic) quantities in the registers and memory of the computer system are manipulated and transformed into other data also represented as physical quantities in the memory or registers of the computer system, or other such information storage, information transmission, or information display device. It has proven convenient at times, primarily for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like. These algorithms may be written in a number of different software programming languages, such as Python, C, C++, or other similar languages. Also, the algorithms may be implemented using lines of code in software, configured logic gates in software, or a combination of both. In one embodiment, the logic consists of electronic circuits that follow the rules of Boolean logic, software containing patterns of instructions, or any combination of both.

[0138] Although the foregoing designs and embodiments thereof have been provided in considerable detail, it is not the applicant's intention that the designs and embodiments provided herein be limited. Additional adaptations and / or modifications are possible, and the broader aspects also encompass these adaptations and / or modifications. Thus, departures may be made from the foregoing designs and embodiments without departing from the scope provided by the following claims, which scope is limited only by the claims when properly interpreted.

Claims

1. 1. An endpoint agent extension for a cyber defense system for email, the endpoint agent extension comprising: two or more modules and one or more machine learning models, an integration module of the endpoint agent extension configured to integrate the endpoint agent extension with an email client application on an endpoint computing device to detect email cyber threats in emails at the email client application and to police outbound emails; and a behavior module of said endpoint agent extension configured to interact with said email client application and, when a cyber threat module determines that an outbound email containing an attachment and / or linked file is (a) a data exfiltration threat, (b) malicious and anomalous behavior compared to a user's modeled email behavior, and (c) any combination of these two determinations, to direct an autonomous behavior by the behavior module with respect to at least the outbound email containing the attachment and / or linked file under analysis, rather than a human taking an action, said behavior module of said endpoint agent extension being configured to interact with said email client application and, when a cyber threat module determines that the outbound email containing the attachment and / or linked file is (a) a data exfiltration threat, (b) malicious and anomalous behavior compared to a user's modeled email behavior, and (c) any combination of these two determinations, to direct an autonomous behavior by the behavior module with respect to at least the outbound email containing the attachment and / or linked file under analysis, rather than a human taking an action, 11. The apparatus of claim 1, wherein the autonomous actions with respect to at least the outbound email and the file include one or more actions selected from the group consisting of: i) logging a user off the email client application, ii) preventing the outbound email from being sent, iii) stripping the attachments and / or disabling links to the files from the outbound email, and iv) sending a notification regarding the outbound email to an organization's cyber security officer.

2. 2. The apparatus of claim 1, further comprising an attachment analyzer of the endpoint agent extension configured to scan the files i) attached and / or ii) linked to the outbound email about to be sent in an outbox to analyze the file content and meta data via file structure inspection, meta data analysis tools, and machine learning analysis to gather information about the file itself and the content within the file.

3. The device of claim 1, wherein the cyber defense system is configured to use a first model trained on normal behavior of email activity and user activity associated with an email system, the cyber defense system is configured to use a first machine learning model trained on the normal behavior of email activity and user activity associated with the email system, and ii) the behavioral module is configured to cause the autonomous action to be taken to thwart a cyber threat rather than the human taking the action.

4. 10. The apparatus of claim 1, further comprising: a secure communications module in the endpoint agent extension configured to securely communicate with one or more modules in a cyber security appliance of a cyber defense system in a network connected to the endpoint computing device, the module of the endpoint agent extension configured to receive and take into account both knowledge outside an email domain and metrics and other information from the email domain collected by the one or more modules of the cyber security appliance on the network, the module of the endpoint agent extension also configured to use computing power of the one or more modules of the cyber security appliance for one or more of the machine learning models, the endpoint agent extension using both external computing power and additional knowledge collected outside the email domain to analyze contextual information about the outbound email under analysis, contextual information about user behavior of a user generating the outbound email, and / or contextual information about specific files i) attached or ii) linked to the outbound email.

5. 10. The apparatus of claim 1, further comprising a secure communications module in the endpoint agent extension configured to securely communicate with one or more modules in the cyber security appliance of the cyber defense system in a network connected to the endpoint computing device to receive contextual information outside of an email domain regarding the outbound email under analysis, and to receive instructions or additional information regarding what autonomous action should be taken on the outbound email to mitigate threats posed by the outbound email and its attachments and / or links from an autonomous response module of the cyber security appliance.

6. 5. The apparatus of claim 4, wherein a cyber security appliance of a cyber threat defense system is disposed in an IT network, an OT network, a SaaS environment, a cloud network, and / or any combination of these networks to exchange secure communications with said endpoint agent extension and provide additional contextual information regarding user behavior outside of said email domain, regarding files attached to said email under analysis to determine whether said outbound email under analysis and its attachments and / or links are i) abnormal or ii) not abnormal in the context of the current user behavior under analysis to prevent data loss and occurrence of improperly addressed recipients.

7. 5. The apparatus of claim 4, further comprising an email module of the cyber security device that can cooperate with one or more machine learning models in the cyber security device to perform machine learning analysis on all inbound and outbound email flows of an organization to increase awareness of patterns of life for i) each individual user, ii) the organization as a whole, and iii) clustered user groups that machine learning has identified as being closely related to a given user, wherein the email module is configured to communicate the information to the module in the endpoint agent extension via the secure communications module.

8. 2. The apparatus of claim 1, wherein the endpoint agent extension and the cyber security appliance on a network cooperate to track and maintain a dynamic profile modeled for each email user in a domain that creates emails, the dynamic profile being derived from a pattern of life for: i) corresponding email users of the email domain, ii) organizations to which individual users of the email domain belong, and iii) for each user, smaller clustered peer groups that are closely related to a given user, and 2) taking into account network metrics along with email domain metrics to make a determination that behavior deviates from the pattern of life for the email under analysis and any of its attachments or linked files, and wherein the cyber security appliance is configured to communicate information associated with the dynamic profile modeled for each email user and network metrics along with the email domain metrics to the module in the endpoint agent extension via a secure communications module.

9. an email module in said cyber security appliance is configured to track and maintain a dynamic profile modeled with a user model for each email user in a domain that creates email, and to interface with the email activity and network activity models of each peer group in the organization, and the email activity model of the organization in general, and inputs from all three of these different modeled insights are taken into account in said dynamic profile when determining whether an outbound email about to be sent by a user is unusual and triggers further analysis; 2. The apparatus of claim 1, wherein a secure communications module in the endpoint agent extension is configured to securely receive an instance of the dynamic profile for each email user in the domain that creates the email and a memory that stores the instances of the dynamic profile, one for each user on the endpoint device, for more rapid processing of each outbound email under analysis, and wherein the email module is configured to generate the dynamic profile that is sent to the secure communications module.

10. 2. The apparatus of claim 1, wherein in addition to prescribing actions to prevent (a) data exfiltration threats, (b) malicious anomalous behavior threats, and (c) any combination of these two decisions, the behavioral module of the endpoint agent extension is further configured to prescribing autonomous actions on the outbound email and its files when additional decisions are made, including (d) sending a notification to the user regarding whether to send an outbound email to a suspected erroneous email recipient address, and (e) sending a notification to the user when the email under analysis, including any attached or linked files, is determined to violate an email policy implemented by an organization that includes the user.

11. configuring an endpoint agent extension for an email cyber defense system that includes two or more modules and that interfaces with one or more machine learning models for installation on an endpoint computing device; configuring the endpoint agent extension to integrate with an email client application on the endpoint computing device to detect email cyber threats in emails at the email client application and to police outbound email; and configuring the endpoint agent extension to interact with the email client application to direct an autonomous action by a behavior module, rather than a human action, with respect to at least the outbound email containing the attachment and / or linked file under analysis when a cyber threat module determines that the outbound email containing the attachment and / or linked file is (a) a data exfiltration threat, (b) malicious and anomalous behavior compared to a user's modeled email behavior, and (c) any combination of the two determinations, wherein the autonomous action with respect to at least the outbound email and the file includes one or more actions selected from the group consisting of: i) logging a user off the email client application, ii) preventing the outbound email from being sent, iii) stripping the attachment and / or disabling links to the file from the outbound email, and iv) sending a notification regarding the outbound email to an organization's cyber security personnel.

12. 12. The method of claim 11, further comprising configuring the endpoint agent extension to scan the files i) attached and / or ii) linked to the outbound email about to be sent in an outbox to analyze the file content and meta data via file structure inspection, meta data analysis tools, and machine learning analysis to gather information about the file itself and the content within the file.

13. A method for detecting a plurality of email messages comprising: using a first model that is trained on normal behavior of email activity and user activity associated with an email system; 12. The method of claim 11, further comprising using a first machine learning model trained on the normally behaving email and user activity associated with the email system and having the behavioral module take the autonomous action to thwart cyber threats rather than the human taking the action.

14. configuring the endpoint agent extension to securely communicate with one or more modules in a cyber security appliance of the cyber defense system that is in a network connected to the endpoint computing device; 12. The method of claim 11, wherein the endpoint agent extension is also configured to receive and take into account both knowledge outside the email domain and metrics and other information from the email domain collected by the one or more modules of the cyber security appliance on the network, and the module of the endpoint agent extension is configured to use computing power of the one or more modules of the cyber security appliance for one or more of the machine learning models, and wherein the endpoint agent extension uses both external computing power and additional knowledge collected outside the email domain to analyze contextual information regarding the outbound email under analysis, contextual information regarding user behavior of a user generating the outbound email, and / or contextual information regarding specific files i) attached or ii) linked to the outbound email.

15. 12. The method of claim 11, further comprising configuring the endpoint agent extension to securely communicate with one or more modules in the cyber security appliance of the cyber defense system in a network connected to the endpoint computing device to receive contextual information outside of an email domain regarding the outbound email under analysis, and to receive instructions or additional information regarding what autonomous action should be taken on the outbound email to mitigate threats posed by the outbound email and its attachments and / or links from an autonomous response module of the cyber security appliance.

16. 15. The method of claim 14, wherein cyber security appliances of a cyber threat defense system are located in an IT network, an OT network, a SaaS environment, a cloud network, and / or any combination of these networks to exchange secure communications with said endpoint agent extension and provide additional contextual information regarding user behavior outside of said email domain, and regarding files attached to said email under analysis to determine whether said outbound email under analysis and its attachments and / or links are i) abnormal or ii) not abnormal in the context of the current user behavior under analysis to prevent data loss and occurrence of improperly addressed recipients.

17. 15. The method of claim 14, further comprising: configuring the cyber security appliance to interface with one or more machine learning models in the cyber security appliance to perform machine learning analysis on all inbound and outbound email flows of an organization to increase awareness of patterns of life for i) each individual user, ii) the organization as a whole, and iii) clustered groups of users that machine learning has identified as being closely related to a given user; and then communicating information associated with the dynamic profile modeled for each email user and network metrics with the email domain metrics to the module in the endpoint agent extension via a secure communication module.

18. 12. The method of claim 11, further comprising configuring the endpoint agent extension and the cyber security appliances on the network to track and maintain a modeled dynamic profile for each email user in a domain that creates emails, the dynamic profile being derived from 1) patterns of life for i) corresponding email users of the email domain, ii) organizations to which individual users of the email domain belong, and iii) for each user, smaller clustered peer groups that are closely related to a given user, and 2) taking into account network metrics along with email domain metrics to make a determination that behavior deviates from the patterns of life for the email under analysis and any of its attachments or linked files.

19. 12. The method of claim 11, further comprising the steps of tracking and maintaining a dynamic profile modeled with a user model for each email user in a domain that creates email, and coordinating with models of email activity and network activity of each peer group within the organization, as well as a model of email activity of the organization in general, wherein inputs from all three of these different modeled insights are taken into account in the dynamic profile when determining whether an outbound email about to be sent by a user is unusual and triggers further analysis.

20. A non-transitory computer readable medium comprising instructions that, when executed by a computing machine, cause the computing machine to perform the method of claim 11.

Images