Manasi M Bhattacharyya

7657935, Feb 2, 2010

Aug 16, 2002

10/222632

Salvatore J. Stolfo - Ridgewood NJ, US
Eleazar Eskin - Santa Monica CA, US
Manasi Bhattacharyya - Flushing NY, US

The Trustees of Columbia University in the City of New York - New York NY

G06F 11/00
G06F 12/14

726 22, 726 23, 726 25, 726 24, 709206, 709223, 709225

A system and methods of detecting an occurrence of a violation of an email security policy of a computer system. A model relating to the transmission of prior emails through the computer system is defined which is derived from statistics relating to the prior emails. For selected emails to be analyzed, statistics concerning the selected email are gathered. Such statistics may refer to the behavior or other features of the selected emails, attachments to emails, or email accounts. The determination of whether a violation of an email security policy has occurred is performed by applying the model of prior email transmission to the statistics relating to the selected email. The model may be statistical or probabilistic. A model of prior email transmission may include grouping email recipients into cliques. A determination of a violation of a security policy may occur if email recipients for a particular email are in more than one clique.

7979907, Jul 12, 2011

Dec 18, 2008

12/338479

Matthew G. Schultz - Ithaca NY, US
Eleazar Eskin - Santa Monica CA, US
Erez Zadok - Middle Island NY, US
Manasi Bhattacharyya - Flushing NY, US
Stolfo Salvatore J. - Ridgewood NJ, US

The Trustees of Columbia University in the City of New York - New York NY

G06F 11/00
G06F 12/14

726 24, 726 13, 713188

A system and methods for detecting malicious executable attachments at an email processing application of a computer system using data mining techniques. The email processing application may be located at the server or at the client or host. The executable attachments are filtered from said email, and byte sequence features are extracted from the executable attachment. The executable attachments are classified by comparing the byte sequence feature of the executable attachment to a classification rule set derived from byte sequence features of a data set of known executables having a predetermined class in a set of classes, e. g. , malicious or benign. The system is also able to classify executable attachments as borderline when the difference between the probability that the executable is malicious and the probability that the executable is benign are within a predetermined threshold. The system can notify the user when the number of borderline attachments exceeds the threshold in order to refine the classification rule set.

8443441, May 14, 2013

Dec 8, 2009

12/633493

Salvatore J. Stolfo - Ridgewood NJ, US
Eleazar Eskin - Santa Monica CA, US
Manasi Bhattacharyya - Flushing NY, US

The Trustees of Columbia University in the City of New York - New York NY

G06F 21/00

726 22, 709206

A system and methods of detecting an occurrence of a violation of an email security policy of a computer system. A model relating to the transmission of prior emails through the computer system is defined which is derived from statistics relating to the prior emails. For selected emails to be analyzed, statistics concerning the selected email are gathered. Such statistics may refer to the behavior or other features of the selected emails, attachments to emails, or email accounts. The determination of whether a violation of an email security policy has occurred is performed by applying the model of prior email transmission to the statistics relating to the selected email. The model may be statistical or probabilistic. A model of prior email transmission may include grouping email recipients into cliques. A determination of a violation of a security policy may occur if email recipients for a particular email are in more than one clique.

20030065926, Apr 3, 2003

Jul 30, 2002

10/208432

Matthew Schultz - Ithaca NY, US
Eleazar Eskin - Santa Monica CA, US
Erez Zadok - Middle Island NY, US
Manasi Bhattacharyya - Flushing NY, US
Stolfo Salvatore - Ridgewood NJ, US

G06F011/30

713/188000

A system and methods for detecting malicious executable attachments at an email processing application of a computer system using data mining techniques. The email processing application may be located at the server or at the client or host. The executable attachments are filtered from said email, and byte sequence features are extracted from the executable attachment. The executable attachments are classified by comparing the byte sequence feature of the executable attachment to a classification rule set derived from byte sequence features of a data set of known executables having a predetermined class in a set of classes, e.g., malicious or benign. The system is also able to classify executable attachments as borderline when the difference between the probability that the executable is malicious and the probability that the executable is benign are within a predetermined threshold. The system can notify the user when the number of borderline attachments exceeds the threshold in order to refine the classification rule set.

20130239210, Sep 12, 2013

Mar 21, 2013

13/848529

Eleazar Eskin - Santa Monica CA, US
Manasi Bhattacharyya - Flushing NY, US

Trustees of Columbia University in the City of New York - New York NY

H04L 29/06

726 22

A system and methods of detecting an occurrence of a violation of an email security policy of a computer system. A model relating to the transmission of prior emails through the computer system is defined which is derived from statistics relating to the prior emails. For selected emails to be analyzed, statistics concerning the selected email are gathered. Such statistics may refer to the behavior or other features of the selected emails, attachments to emails, or email accounts. The determination of whether a violation of an email security policy has occurred is performed by applying the model of prior email transmission to the statistics relating to the selected email. The model may be statistical or probabilistic. A model of prior email transmission may include grouping email recipients into cliques. A determination of a violation of a security policy may occur if email recipients for a particular email are in more than one clique.

20190020672, Jan 17, 2019

Jul 3, 2018

16/026801

- New York NY, US
Eleazar Eskin - Santa Monica CA, US
Manasi Bhattacharyya - Flushing NY, US

THE TRUSTEES OF COLUMBIA UNIVERSITY IN THE CITY OF NEW YORK - New York NY

H04L 29/06
H04L 12/58

A system and methods of detecting an occurrence of a violation of an email security policy of a computer system. A model relating to the transmission of prior emails through the computer system is defined which is derived from statistics relating to the prior emails. For selected emails to be analyzed, statistics concerning the selected email are gathered. Such statistics may refer to the behavior or other features of the selected emails, attachments to emails, or email accounts. The determination of whether a violation of an email security policy has occurred is performed by applying the model of prior email transmission to the statistics relating to the selected email. The model may be statistical or probabilistic. A model of prior email transmission may include grouping email recipients into cliques. A determination of a violation of a security policy may occur if email recipients for a particular email are in more than one clique.

20180124081, May 3, 2018

Jul 11, 2017

15/646733

- New York NY, US
Eleazar Eskin - Santa Monica CA, US
Manasi Bhattacharyya - Flushing NY, US

THE TRUSTEES OF COLUMBIA UNIVERSITY IN THE CITY OF NEW YORK - New York NY

H04L 29/06
H04L 12/58

A system and methods of detecting an occurrence of a violation of an email security policy of a computer system. A model relating to the transmission of prior emails through the computer system is defined which is derived from statistics relating to the prior emails. For selected emails to be analyzed, statistics concerning the selected email are gathered. Such statistics may refer to the behavior or other features of the selected emails, attachments to emails, or email accounts. The determination of whether a violation of an email security policy has occurred is performed by applying the model of prior email transmission to the statistics relating to the selected email. The model may be statistical or probabilistic. A model of prior email transmission may include grouping email recipients into cliques. A determination of a violation of a security policy may occur if email recipients for a particular email are in more than one clique.

20160366165, Dec 15, 2016

Sep 24, 2014

14/495168

- New York NY, US
Eleazar Eskin - Santa Monica CA, US
Manasi Bhattacharyya - Flushing NY, US

H04L 29/06
H04L 12/58

A system and methods of detecting an occurrence of a violation of an email security policy of a computer system. A model relating to the transmission of prior emails through the computer system is defined which is derived from statistics relating to the prior emails. For selected emails to be analyzed, statistics concerning the selected email are gathered. Such statistics may refer to the behavior or other features of the selected emails, attachments to emails, or email accounts. The determination of whether a violation of an email security policy has occurred is performed by applying the model of prior email transmission to the statistics relating to the selected email. The model may be statistical or probabilistic. A model of prior email transmission may include grouping email recipients into cliques. A determination of a violation of a security policy may occur if email recipients for a particular email are in more than one clique.