US 12,388,869 B2
Message management platform for performing impersonation analysis and detection
Harold Nguyen, San Carlos, CA (US)
Assigned to Proofpoint, Inc., Sunnyvale, CA (US)
Filed by Proofpoint, Inc., Sunnyvale, CA (US)
Filed on Jun. 4, 2024, as Appl. No. 18/732,870.
Application 18/732,870 is a continuation of application No. 18/077,479, filed on Dec. 8, 2022, granted, now 12,041,086.
Application 18/077,479 is a continuation of application No. 16/697,918, filed on Nov. 27, 2019, granted, now 11,552,990, issued on Jan. 10, 2023.
Claims priority of provisional application 62/815,088, filed on Mar. 7, 2019.
Prior Publication US 2024/0422194 A1, Dec. 19, 2024
Int. Cl. H04L 9/40 (2022.01); G06N 5/04 (2023.01); G06N 20/00 (2019.01); H04L 51/212 (2022.01); H04L 51/224 (2022.01)
CPC H04L 63/1483 (2013.01) [G06N 5/04 (2013.01); G06N 20/00 (2019.01); H04L 51/212 (2022.05); H04L 51/224 (2022.05)] 19 Claims
OG exemplary drawing
 
1. A computing platform comprising:
at least one processor;
a communication interface communicatively coupled to the at least one processor; and
memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
generate, based on email data received from a plurality of user accounts, a plurality of user identification models;
intercept a first email message from a first user account of the plurality of user accounts to a second user account of the plurality of user accounts;
apply a first model of the plurality of user identification models to the first email message to calculate a first plurality of feature vectors for the first email message, wherein the first model of the plurality of user identification models is specific to the first user account of the plurality of user accounts;
apply one or more impersonation algorithms to the first plurality of feature vectors to determine results of the one or more impersonation algorithms, wherein applying the one or more impersonation algorithms to the first plurality of feature vectors indicates that the first email message is an impersonated message;
based on the results of the one or more impersonation algorithms, modify delivery of the first email message;
intercept a second email message from a third user account of the plurality of user accounts to the second user account of the plurality of user accounts;
apply a second model of the plurality of user identification models to the second email message to calculate a second plurality of feature vectors for the second email message, wherein the second model of the plurality of user identification models is specific to the third user account of the plurality of user accounts;
apply the one or more impersonation algorithms to the second plurality of feature vectors, wherein applying the one or more impersonation algorithms to the second plurality of feature vectors indicates that the second email message is a legitimate message; and
based on results of the one or more impersonation algorithms, permit delivery of the second email message.