US 11,683,284 B2
Discovering graymail through real-time analysis of incoming email
Rami F. Habal, San Francisco, CA (US); Kevin Lau, San Francisco, CA (US); Sharan Dev Sankar, Brooklyn, NY (US); Yea So Jung, San Mateo, CA (US); Dhruv Purushottam, San Mateo, CA (US); Venkat Krishnamoorthi, San Jose, CA (US); Franklin X. Wang, Bellevue, WA (US); Jeshua Alexis Bratman, San Francisco, CA (US); Jocelyn Mikael Raphael Beauchesne, San Francisco, CA (US); Abhijit Bagri, San Francisco, CA (US); and Sanjay Jeyakumar, Berkeley, CA (US)
Assigned to Abnormal Security Corporation, San Francisco, CA (US)
Filed by Abnormal Security Corporation, San Francisco, CA (US)
Filed on May 12, 2022, as Appl. No. 17/743,048.
Application 17/743,048 is a continuation of application No. 17/509,772, filed on Oct. 25, 2021, granted, now 11,528,242.
Claims priority of provisional application 63/105,020, filed on Oct. 23, 2020.
Prior Publication US 2022/0272062 A1, Aug. 25, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 51/08 (2022.01); H04L 51/42 (2022.01); H04L 51/212 (2022.01); G06Q 10/107 (2023.01); G06F 9/54 (2006.01)
CPC H04L 51/08 (2013.01) [G06F 9/544 (2013.01); G06Q 10/107 (2013.01); H04L 51/212 (2022.05); H04L 51/42 (2022.05)] 23 Claims
OG exemplary drawing
 
1. A system, comprising:
a processor configured to:
establish, on behalf of an enterprise, a connection with and using an application programming interface (API) to access an electronic message store that includes a series of communications received by an employee of the enterprise;
determine that a first message included in the electronic message store represents graymail, including by accessing a profile associated with an addressee of the first message, and including by applying a set of machine learning models trained using a plurality of different types of graymail as ground truth training data wherein the set of machine learning models can collectively identify graymail and further classify the graymail into one or more of a variety of subcategories;
take a remedial action in response to determining that the first message represents graymail; and
at a time subsequent to when the remedial action is taken, receive an indication that the addressee has taken an action with respect to the first message, and in response to receiving the indication that the addressee has taken the action, update a rule regarding future remedial actions; and
a memory coupled to the processor and configured to provide the processor with instructions.