AI Email Security System for Account Takeover Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing email security solutions are ineffective in detecting email account takeover attacks, as they cannot monitor or stop internal emails and are unable to detect attacks that emulate legitimate user behavior, leading to undetected password spraying attacks and privacy concerns with data anonymization affecting model accuracy.
Innovation Solution
A system utilizing an AI engine that continuously monitors user communication patterns on an electronic messaging platform via API calls, combining features like sender and recipient identities, IP logins, and link likelihood to detect compromised accounts in real-time, allowing for immediate remediation by blocking or quarantining malicious emails and resetting mailbox rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional email security solutions are used to detect attacks, then detection capability is limited, but the system cannot monitor internal emails or detect attacks that emulate legitimate user behavior
Solution Approach 1:
The system segments email security monitoring into two distinct components: (1) gateway-based filtering for external emails using traditional security solutions, and (2) internal message queue monitoring using AI/ML analysis. This segmentation allows each component to specialize in its strengths while collectively providing comprehensive coverage of both external and internal email threats.
Solution Approach 2:
The system introduces an intermediary AI/ML analysis layer that sits between the email server and the message queue. This intermediary analyzes internal email traffic independently from traditional gateway solutions, enabling detection of attacks that originate within the organization or emulate legitimate user behavior without interfering with existing security infrastructure.
2Measurement precision
If user login data is collected for password spraying attack detection, then detection accuracy improves, but privacy concerns arise
Solution Approach 1:
The system extracts and analyzes only the necessary behavioral patterns and statistical features from user login data (such as login frequency, time patterns, and device information) while excluding personally identifiable information. This extraction approach maintains detection accuracy for password spraying attacks while removing privacy-sensitive data before analysis.
Solution Approach 2:
The system transforms raw user login data into aggregated statistical parameters and behavioral metrics that preserve detection capability while reducing privacy risks. By changing the data representation from individual user records to population-level statistics and patterns, the system maintains measurement precision for attack detection while minimizing information loss regarding user privacy.
3Loss of information
If data is anonymized to preserve privacy, then user privacy is protected, but machine learning model accuracy decreases
Solution Approach 1:
The system performs preliminary analysis to identify which data elements are essential for detecting password spraying attacks versus those that represent privacy risks. By预先 determining the minimum necessary data requirements for effective detection, the system can anonymize or aggregate only the non-essential elements, preserving both privacy and model accuracy.
Solution Approach 2:
The system applies partial anonymization strategies where only specific sensitive fields are obscured while other behavioral indicators remain intact. This partial action approach maintains sufficient information for machine learning models to detect attack patterns while adequately protecting user privacy, avoiding excessive anonymization that would degrade model performance.
Data Source
AI summary
A new approach is proposed to support account takeover (ATO) detection based on login attempts by users. The approach relies on assessing fraudulence confidence level of login IP addresses to classify the login attempts by the users. A plurality of attributes/features in one or more user login data logs are extracted and used to build a labeled dataset for training a machine learning (ML) model that relies on statistics of the login attempts to classify and detect fraudulent logins. These attributes make it possible to ascertain if a login attempt or instance by a user is suspicious based on the ML model. In some embodiments, the ML model is trained using anonymized user login data to preserve privacy of the users and a proper level of data anonymization is determined based on the ML model's accuracy in detecting the ATO attacks when trained with different versions of the anonymized data.