The aim of the thesis is to analyze data flows of email records in the cloud obtained by the Safetica product. The student will propose innovative machine-learning-based algorithms for detecting unusual events with a primary focus on security incidents. Subsequently, the student will evaluate the suitability of the proposed algorithms by running them on real-world data. Based on the analysis results, the student will determine the key features and create models describing ordinary email flows for the entire company and individual users.
The individual tasks are as follows:

1. Analyze selected data flows of email records. Determine which features are suitable for creating a model of common email flows (e.g., sender and receiver domain, number and size of attachments)
2. Based on the analysis, propose a way to describe email flows and how to use this description to create a model of common data flows of emails in the customer environment.
3. Using the created model, propose machine learning algorithms to identify flows significantly different from common email flows. This task includes experimenting with different detection methods and assessing their suitability.
4. Evaluate the success of the proposed algorithms on unseen email flows.