| CPC H04L 51/212 (2022.05) [G06F 21/566 (2013.01)] | 20 Claims |
|
1. A computer-implemented method comprising:
sending email scan requests to an email scanner, wherein each email scan request includes one or more emails of a plurality of emails;
receiving, from the email scanner, for each email of the plurality of emails, a verdict of suspicion and one or more data fragments, the one or more data fragments each including a count, wherein the one or more data fragments for each email are generated by the email scanner based on content of the email;
storing the one or more data fragments for each email of the plurality of emails in a datastore, wherein the datastore is indexed by one or more keys that are derived from the email and wherein one or more respective counts for the one or more data fragments are incremented responsive to receiving the verdict of suspicion;
receiving a new email;
deriving one or more new keys for the new email;
retrieving one or more matching data fragments from the datastore by matching the one or more new keys with the one or more keys stored in the datastore;
providing, to the email scanner, the new email, the one or more matching data fragments, and the one or more respective counts for the one or more matching data fragments; and
receiving, from the email scanner, a new verdict of suspicion and one or more new data fragments, wherein the new verdict of suspicion is based on the one or more respective counts for the one or more matching data fragments.
|