	US 12,107,886 B2
	Systems and methods for intelligent phishing threat detection and phishing threat remediation in a cyber security threat detection and mitigation platform
Elisabeth Weber, Herndon, VA (US); Peter Silberman, Rockville, MD (US); and Shamus Field, Herndon, VA (US)
Assigned to Expel, Inc., Herndon, VA (US)
Filed by Expel, Inc., Herndon, VA (US)
Filed on Oct. 20, 2022, as Appl. No. 17/970,069.
Application 17/970,069 is a continuation of application No. 17/696,151, filed on Mar. 16, 2022, granted, now 11,509,689.
Application 17/696,151 is a continuation of application No. 17/501,708, filed on Oct. 14, 2021, granted, now 11,310,270, issued on Apr. 19, 2022.
Claims priority of provisional application 63/129,836, filed on Dec. 23, 2020.
Claims priority of provisional application 63/092,307, filed on Oct. 15, 2020.
Claims priority of provisional application 63/091,409, filed on Oct. 14, 2020.
Prior Publication US 2023/0038671 A1, Feb. 9, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); G06N 20/00 (2019.01)

CPC H04L 63/1483 (2013.01) [G06N 20/00 (2019.01); H04L 63/1425 (2013.01); H04L 63/1433 (2013.01)]

20 Claims

1. A method for accelerating a cybersecurity event detection and remediation, the method comprising:

computing, by a text embedding model, at least one text embedding value for a suspicious electronic communication based on a corpus of text data extracted from the suspicious electronic communication;

evaluating the at least one text embedding value computed for the suspicious electronic communication against an n-dimensional mapping of embedding vectors of a plurality of distinct historical electronic communications;

identifying a distinct embedding vector of the n-dimensional mapping associated with a historical electronic communication based on the evaluation of the at least one text embedding value against the n-dimensional mapping;

evaluating whether the suspicious electronic communication is one of a phishing electronic communication or a non-phishing electronic communication based on an evaluation of a message body of the suspicious electronic communication against a message body of the historical electronic communication associated with the distinct embedding vector; and

routing data associated with the suspicious electronic communication to one of a plurality of distinct cybersecurity threat mitigation routes based on evaluation of the suspicious electronic communication corresponding to the phishing electronic communication.