Abstract: A computer-implemented method of updating a set of clusters representative of a classification of a text-based dataset into a plurality of different text types for use in a cyber security system is described as part of a classification pipeline. The method comprises receiving text data associated with an entity. The method further comprises generating one or more vector embeddings representative of the text data. The method further comprises using incremental learning to update the set of clusters based on the one or more vector embeddings.

Abstract: The email system utilizes statistical analysis to assign an importance score to each user within an organization based on their email activity. The score is continuously updated to reflect changes in email flow and user status. The system identifies high-profile individuals who are likely to be targeted by external actors and assigns them a higher importance score. It also adjusts the scores based on several dampening factors related to the user's email behavior. The system uses these scores to determine vip users and tailors its response to malicious emails accordingly. Vip-specific threat handling rules, which are less disruptive or intrusive, are applied when a malicious email targets a vip user. The system intelligently derives user importance information, allowing it to identify a larger subset of important users within an organization. This approach minimizes disruption, tailors actions to key stakeholders, and does not require significant manual tuning.

Abstract: The email campaign detector checks whether clustered emails with similar characteristics are part of a targeted campaign of malicious emails. An email similarity classifier analyzes a group of emails in order to cluster emails with similar characteristics in the group of emails. A targeted campaign classifier analyzes the clustered emails with similar characteristics to check whether the clustered emails with similar characteristics are a) coming from a same threat actor b) going to a same intended target, and c) any combination of both, as well as ii) verify whether the clustered emails with similar characteristics are deemed malicious. The email campaign detector uses this information from the email similarity classifier and the targeted campaign classifier to provide an early warning system of a targeted campaign of malicious emails is underway. The email campaign detector cooperates with one or more machine learning models to identify emails that are deemed malicious.