Fortra's Email Productivity Feature: Optimizing the Inbox

Overview 

When we think of email security, we often think of emails that are actively malicious: phishing attacks, financial scams, attempts to obtain confidential data, and so on. However, there is another, less direct element of email management that is often neglected: emails that reduce productivity by distracting employees, and, in sufficient numbers, leaving their inboxes cluttered and disorganized. Marketing emails e.g. "Up to 50% off! Sale ends at 5 p.m.!", social media notifications e.g. "Luke accepted your connection request, send a message!", disreputable spam e.g. "Subscribe NOW for REAL news!", and even ordinary automatic notifications e.g. "Mike accepted your invitation: Afternoon Project Sync", can all impact productivity, without ever being labeled or tracked by conventional email security software. This is the motivation for Fortra's Email Productivity Feature (EPF), a Machine Learning (ML) model that automatically identifies marketing, spam, and service notifications to facilitate tracking, and help to optimize the inbox. 

What the EPF Detects 

The EPF will be applied to every email received by customers using Fortra's Cloud Email Protection (CEP) service. The supervised ML model behind the EPF leverages linguistic knowledge, email subject line content, sender information, hand-crafted heuristics, and Fortra's in-house User Profiling Infrastructure (UPI) to tag each email with at most one of the three productivity concern labels: marketing, spam, and service notification. 

Marketing refers to any attempt to draw user engagement with or attention to some product or service, including directing users to advertising-supported platforms or subscription services. Such emails often come from reputable sources, which the user engages with frequently, such as social media and online shopping services. While such emails are generally not explicitly malicious, they may be distracting or unwanted. Moreover, identifying them can assist, for example, with broader analysis, by distinguishing between ordinary marketing, and malicious or spam emails. 

Service notifications are auto-generated emails from software services, such as MS Teams, Jira, calendar and reminder services, shipping services, and so on. If you receive an email suggesting that you buy something, it's marketing; if you buy it and receive a confirmation or shipping email, it's a service notification. This is an extremely common class among emails processed for Fortra clients, and while these emails are rarely malicious, their sheer volume makes identifying them a potentially useful optimization. 

Finally, spam is the label for unsolicited emails from senders without an established positive reputation or an established history with the recipient. Attention-grabbing emails from senders with minimal interaction history and whose legitimacy cannot be conclusively established are considered spam for the purposes of the EPF. This may be somewhat broader than the standard set by common spam detection tools, facilitating further fine-tuning of email productivity.  

Of course, not all emails fall into one of these three categories; in such cases, the EPF can simply indicate that none of the above apply. Equipped with these labels, our customers can quantify and act on these potential impactors to employee productivity and inbox optimization. 

Key Features 

The core of the model is an efficient, customized, multilingual embedding system that encodes the sender name, email address, and subject line of a given email. For example, an email from "[email protected]" indicating that an account has been created would be represented very differently than an email from "[email protected]" offering a limited-time discount rate. These representations are leveraged by the model to classify the former as a service notification, and the latter as marketing, assuming, of course, that the user has some history with example.com. 

On the topic of user history, Fortra's User Profiling Infrastructure (UPI) tracks interactions between users and organizations to distinguish known contacts from unknown senders. Higher history counts are indicative of service notifications or marketing. Contrariwise, minimal or zero history is a clue that the email was unsolicited, and so could indicate spam. 

Fortra also uses multiple models to assess the reputation of the sender of each email. As with UPI, this sets service notifications and marketing emails -- which typically come from senders with well-established reputations -- apart from spam, which often uses new domains, or domains known to be associated with undesirable activity.  

Finally, the model takes advantage of observed patterns found in email subject lines, encoded in what we call subject shape features. Long numeric or alphanumeric sequences, for example, are typical of service notifications (case numbers, order numbers, ticket numbers, and so on), while marketing and spam emails, being designed to quickly capture attention, tend to avoid long strings of digits. 

Taken together, the EPF is built on a robust set of features. It was developed using large quantities of training data labeled by a custom-built in-house agent, to deliver quality and efficiency for the convenience of our customers. 

Case Studies 

To better illustrate how the EPF functions, let's consider some examples. 

This first example shows how the model can distinguish between promotional emails that are reputable and solicited, and those which are more dubious and more likely to be unsolicited. (Note that, strictly speaking, a lack of email history need not preclude contact through other means, e.g. social media, customer service portals, and so on, and so is not, in itself, proof that the email is spam.) The known, reputable promotional email is labeled marketing; the first-contact promotional email from a more dubious sender is labeled spam. 

Emails 3 and 4 both originate from the same domain, linkedin.com. Thus, both have the same reputation, and in both cases, the sender and receiver have extensive history with LinkedIn. In addition, the exact email addresses, while distinct, both refer to "messaging"/"messages", and contain the string "noreply". Nevertheless, the EPF is able to correctly determine that Email 3 comes from a messaging service, while Email 4 is promotional. 

Performance 

Every email processed by Fortra's Cloud Email Protection platform (CEP) will be processed by the EPF. Evaluation using both automatic and manual analysis indicates that the model achieves at least 95% precision while maintaining 80% recall. Future versions of the model will pursue even higher scores, and may introduce additional labels such as social media and security alerts. Fortra is currently testing the EPF in-house for analysis, evaluation, and aggregation purposes.  

We believe the EPF will provide clear, reliable value for our customers, who will directly benefit from having more information about what goes into their inboxes.