Abstract: An embodiment of the present invention is directed to a typosquat detection system configured to: receive SMTP telemetry data from enterprise email communications; extract domain names and email addresses from the SMTP telemetry data; access a domain observation cache that stores previously observed domains and email addresses with corresponding observation context information to determine one or more newly observed domains and email addresses; route the one or more newly observed domains to a domain typosquat detector subsystem that applies a first set of filters and a first string similarity algorithm to determine whether to generate a domain typosquat alert; route the one or more newly observed email addresses to a webmail typosquat detector subsystem that applies a second set of filters and a second string similarity algorithm to determine whether to generate a webmail typosquat alert; and transmit alerts for analyst review and triage.

Abstract: An embodiment of the present invention is directed to an extraction and analysis system that comprises a network sensor configured to capture network traffic, a source document processor configured to extract text from source documents in the captured network traffic, an artificial intelligence (AI) inference engine configured to extract structured banking information from the extracted text, and an interface to a security information and event management (SIEM) system configured to receive the extracted structured banking information and generate alerts based on the extracted structured banking information. The system enables automated extraction and analysis of banking details from various document types within network traffic for enhanced security monitoring and threat detection.