Systems and methods of detecting email-based attacks through machine learning

• US 10,397,272 B1
• Filed: 10/23/2018
• Issued: 08/27/2019
• Est. Priority Date: 05/10/2018
• Status: Active Grant

• Current Assignee: Capital One Services LLC (Capital One Financial Corporation)
• Original Assignee: Capital One Services LLC (Capital One Financial Corporation)
• Inventors: Bruss, Christopher Bayan, Fletcher, Stephen, Yu, Lei, Kressel, Jakob
• Primary Examiner(s): Shayanfar, Ali
• Application Number:
  US16/168,055
• Time in Patent Office: 308 Days
• Field of Search: None
• CPC Class Codes: G06F 18/214 Generating training patterns; Bootstrap methods, e.g. bagging or boosting
• CPC Class Codes: G06F 18/241 relating to the classification model, e.g. parametric or non-parametric approaches
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 20/20 Ensemble learning
• CPC Class Codes: G06N 3/044 Recurrent networks, e.g. Hopfield networks
• CPC Class Codes: G06N 5/01 Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks
• CPC Class Codes: G06V 30/19173 Classification techniques
• CPC Class Codes: H04L 51/08 Annexed information, e.g. attachments
• CPC Class Codes: H04L 51/18 Commands or executable codes
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A system including at least one processor; and at least one memory having stored thereon computer program code that, when executed by the at least one processor, controls the at least one processor to: receive an email addressed to a user; separate the email into a plurality of email components; analyze, using respective machine-learning techniques, each of the plurality of email components; feed the analysis of each of the plurality of email components into a stacked ensemble analyzer; and based on an output of the stacked ensemble analyzer, determine whether the email is malicious.

Claims

1. A system comprising:

at least one processor; and

at least one memory having stored thereon computer program code that, when executed by the at least one processor, controls the at least one processor to;

receive an email addressed to a user;

separate the email into a plurality of email components, the email components comprising a first link;

analyze, using machine-learning techniques, each of the plurality of email components, by;

virtually navigating to an end-point of the first link;

tracking re-routing by the first link between a starting point and the end-point;

receiving an automatic download triggered by the virtual navigation;

isolating the automatic download;

analyzing the automatic download; and

analyzing a content of the end-point; and

provide the analysis of each of the plurality of email components into a stacked ensemble analyzer; and

based on an output of the stacked ensemble analyzer, determine that the email is potentially malicious.

2. The system of claim 1, wherein the stacked ensemble analyzer comprises a nonparametric model.

3. The system of claim 1, wherein the plurality of email components comprises one or more of an email header, an email body, a subject line, or one or more attachments.

4. The system of claim 3, wherein the computer program code, when executed by the at least one processor, controls the at least one processor to analyze at least one of the email body and the subject line using term frequency-inverse document frequency (TF-IDF) logistic regression trained with an email corpus.

5. The system of claim 4, wherein the computer program code, when executed by the at least one processor, controls the at least one processor to analyze the subject line to determine an implied urgency of the subject line.

6. The system of claim 3, wherein the computer program code, when executed by the at least one processor, controls the at least one processor to analyze the e-mail header using a random decision forest classifier.

7. The system of claim 3, wherein the computer program code, when executed by the at least one processor, controls the at least one processor to analyze the email header by analyzing a path of delivery of the email.

8. The system of claim 1, wherein the computer program code, when executed by the at least one processor, controls the at least one processor to compare a universal resource locator (URL) of the first link with a domain of a sender of the email.

9. The system of claim 1, wherein the stacked ensemble analyzer comprises at least one of random-forest classifier and a gradient boosting machine.

10. The system of claim 1, wherein the computer program code, when executed by the at least one processor, further controls the at least one processor to isolate the potentially malicious email from a user account of the user.

11. The system of claim 1, wherein the system provides at least one of gateway filtering and second-level malicious email detection.

12. A system comprising:

at least one processor; and

at least one memory having stored thereon computer program code that, when executed by the at least one processor, controls the at least one processor to;

receive an email addressed to a user;

separate the email into a plurality of email components;

analyze each of the plurality of email components using machine-learning techniques;

provide the analysis of each of the plurality of email components into a stacked ensemble analyzer;

determine that the email is potentially malicious based on an output of the stacked ensemble analyzer;

output, to a systems operations console, the email;

receive, from the systems operations console, an external indication that the email is malicious; and

update the machine-learning techniques, based on the comparison of the external indication from the systems operations console and the determination that the email is potentially malicious from the ensemble analyzer, by;

updating a training corpus of emails to include the email; and

incrementally retraining the machine-learning techniques based on the updated training corpus.

13. The system of claim 12, wherein the computer program code, when executed by the at least one processor, further controls the at least one processor to isolate the malicious email from a user account of the user.

14. The system of claim 12, wherein the system provides at least one of gateway filtering and second-level malicious email detection.

15. The system of claim 12, wherein the computer program code, when executed by the at least one processor, further controls the at least one processor to update the stacked ensemble analyzer with the email analysis, based on the comparison of the external indication and the determination that the email is potentially malicious from the stacked ensemble analyzer.

16. A system comprising:

at least one processor; and

at least one memory having stored thereon computer program code that, when executed by the at least one processor, controls the at least one processor to;

receive an email addressed to a user;

separate the email into a plurality of email components;

analyze each of the plurality of email components, using machine-learning techniques;

provide the analysis of each of the plurality of email components into a stacked ensemble analyzer;

determine that the email is malicious, based on an output of the stacked ensemble analyzer;

generate a sanitized version of the malicious email, based on the determination that the email is malicious; and

replace, within a user account of the user, a copy of the malicious email with the generated sanitized version of the email.

17. The system of claim 16, wherein the plurality of components comprises at least one from among an email header, an email body, a subject line, one or more links, and one or more attachments.

18. The system of claim 16, wherein the computer program code, when executed by the at least one processor, further controls the at least one processor to isolate the malicious email from a user account of the user based on the determination that the email is malicious.

19. The system of claim 16, wherein the system provides at least one of gateway filtering and second-level malicious email detection.