Email Security Using LLM Organizational Context Embeddings
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computerized systems face challenges in effectively distinguishing between legitimate and phishing emails, especially with the increasing use of generative Artificial Intelligence (AI) engines that compose high-quality phishing messages.
Innovation Solution
The implementation of an email security system that utilizes Organizational Context (OC) embeddings and Large Language Model (LLM) analysis to evaluate incoming emails. This system performs tokenization, enriches messages with OC data, and uses pre-defined questions to generate features for Machine Learning (ML) classification, ultimately determining the likelihood of an email being phishing-related.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional email filtering systems are used, then processing speed is maintained, but detection precision deteriorates due to inability to distinguish sophisticated phishing emails from legitimate ones
Solution Approach 1:
The patent introduces an intermediary LLM-based analysis layer between traditional email filtering and final classification. This intermediary enriches email data with organizational context embeddings and generates probabilistic assessments, improving detection precision without requiring complete system redesign. The intermediary processes only suspicious emails identified by traditional filters, maintaining overall system efficiency.
Solution Approach 2:
The email security system is segmented into multiple specialized components: traditional spam filters for initial screening, LLM-based organizational context analysis for suspicious emails, and ML classification for final determination. This segmentation allows each component to specialize in specific detection tasks, improving overall precision while managing complexity through modular architecture.
2Measurement precision
If LLM-based analysis with organizational context is implemented, then detection precision improves, but processing time increases
Solution Approach 1:
The system applies LLM-based organizational context analysis only to emails flagged as suspicious by traditional filters, rather than analyzing all incoming emails. This partial action approach maintains high detection precision for problematic emails while avoiding unnecessary processing time for clearly legitimate or obviously spam emails, thus balancing precision and speed.
Solution Approach 2:
Traditional spam filters perform preliminary screening to identify suspicious emails before they reach the LLM-based analysis stage. This preliminary action filters out obvious cases, allowing the more time-consuming LLM analysis to focus only on borderline cases where precision is most critical, thereby reducing overall processing time while maintaining high detection accuracy.
3Reliability
If sophisticated ML classification with multiple features is used, then detection reliability improves, but ease of operation deteriorates due to complex configuration and maintenance
Solution Approach 1:
The LLM-based analysis component serves multiple functions: it enriches emails with organizational context, generates probabilistic phishing assessments, and provides features for ML classification. This multi-functionality improves detection reliability through comprehensive analysis while simplifying operation by consolidating multiple detection mechanisms into a single versatile component that requires unified configuration and maintenance.
Data Source
AI summary
Improved email security and prevention of phishing attacks using a Large Language Model (LLM) engine. A computerized method includes evaluating whether a digital message received at a Protected Entity is malicious or legitimate, by performing: (a) obtaining extracted data from documents and data repositories of the Protected Entity; feeding the extracted data into an LLM engine; and constructing an Organizational Context Index having vectors of LLM-generated embeddings that describe relations and roles of members and objects of the Protected Entity; (b) prompting the LLM to evaluate whether the digital message is malicious or legitimate, based on LLM analysis of a query envelope that includes at least: (i) content of the digital message, and (ii) meta-data of the digital message, and (iii) a set of LLM-based embeddings from the Organizational Context Index that pertain to that digital message.