US 12,430,617 B2
Business email compromise detection system
Umalatha Batchu, Cupertino, CA (US); Torsten Zeppenfeld, Emerald Hills, CA (US); Blake Darche, Finksburg, MD (US); and Philip Syme, Ellicott City, MD (US)
Assigned to CLOUDFLARE, INC., San Francisco, CA (US)
Filed by CLOUDFLARE, INC., San Francisco, CA (US)
Filed on Dec. 22, 2023, as Appl. No. 18/395,400.
Application 18/395,400 is a continuation of application No. 17/150,853, filed on Jan. 15, 2021, granted, now 11,861,563.
Prior Publication US 2024/0144190 A1, May 2, 2024
This patent is subject to a terminal disclaimer.
Int. Cl. G06Q 10/107 (2023.01); G06F 40/205 (2020.01); G06N 7/01 (2023.01); G06Q 30/018 (2023.01); G06Q 40/02 (2023.01); H04L 9/40 (2022.01)
CPC G06Q 10/107 (2013.01) [G06F 40/205 (2020.01); G06N 7/01 (2023.01); G06Q 30/018 (2013.01); G06Q 40/02 (2013.01); H04L 63/1416 (2013.01); H04L 63/1425 (2013.01)] 18 Claims
OG exemplary drawing
 
1. A method, comprising:
receiving an email that is directed to an email recipient and is from an email sender;
extracting, from the email, a triple, the extracted triple including a display name of the email sender, an email address of the email sender, and an email domain of the email sender;
identifying a triple identifier associated with the extracted triple;
determining a name score for the email based on the triple identifier by accessing the name score for the triple identifier in a database, wherein the name score indicates a probability that the email is from a legitimate sender, and wherein the name score is updated based on frequency counting;
inputting message content of the email into a plurality of classifiers, wherein each of the plurality of classifiers is machine-learned to recognize a particular message type;
determining a message type of the email based on output of the plurality of classifiers; and
determining, based on at least the determined name score for the email, the determined message type of the email, and a reputation score associated with an IP address of the email sender, whether the email is associated with a business email compromise (BEC) attack.