Dynamic Message Analysis Platform for Enterprise Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing message analysis technologies face challenges in identifying compromised domains and impersonated domains within supply chain networks, leading to difficulties in balancing enterprise network security with computing resource constraints such as processing power and network bandwidth.
Innovation Solution
A computing platform identifies relationships between internal and external domains, applies a security scoring process, and executes enhanced protection actions based on weighted grades, using automated and manual methods to analyze message sender and recipient domains, and applies security measures such as SPF, DKIM, and DMARC.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If comprehensive domain analysis is applied to all messages, then security detection capability is improved, but computing resource consumption increases
Solution Approach 1:
The patent segments the message population into different groups based on domain characteristics. High-risk domains (external, compromised, impersonated) are separated from low-risk domains (internal, verified). Different analysis depths are applied to different segments, with comprehensive analysis only for high-risk segments and lighter analysis for low-risk segments, thereby reducing overall computing resource consumption while maintaining security detection capability.
Solution Approach 2:
The patent applies different quality levels of analysis to different parts of the message stream. For high-risk domains, full security analysis with multiple verification steps is applied. For low-risk domains, simplified analysis is used. This local differentiation of analysis quality optimizes resource allocation while maintaining overall security effectiveness.
2Reliability
If enhanced protection actions are applied to all domains, then security protection level is improved, but processing efficiency decreases
Solution Approach 1:
The patent segments domains into high-risk and low-risk categories based on domain type (internal/external), compromise status, and impersonation indicators. Enhanced protection actions (quarantine, block, additional verification) are applied only to high-risk domain segments, while standard processing continues for low-risk domains, thereby maintaining security protection levels for critical threats while preserving overall processing efficiency.
Solution Approach 2:
The patent applies enhanced protection actions partially, only to the subset of messages from high-risk domains, rather than applying them excessively to all messages. This partial action approach ensures adequate protection against threats while avoiding the processing efficiency degradation that would result from universal enhanced protection.
3Measurement precision
If manual relationship identification is used, then relationship accuracy is improved, but time consumption increases
Solution Approach 1:
The patent performs preliminary automated analysis of domain relationships using available message metadata, sender/recipient information, and domain characteristics. This preliminary action identifies high-probability relationships and flags uncertain cases for manual review, thereby reducing the overall time consumption while maintaining relationship identification accuracy through targeted manual verification of only the most ambiguous cases.
Solution Approach 2:
The system uses automatically collected message metadata, routing information, and domain attributes to self-determine relationship characteristics for most cases. Manual intervention is required only when automated analysis is insufficient, allowing the system to serve itself for the majority of relationship identifications while maintaining accuracy where needed.
Data Source
AI summary
Aspects of the disclosure relate to dynamic message analysis using machine learning. Using one or more automated methods, a computing platform may identify relationships between message sender domains and message recipient domains. After identifying the relationships, the computing platform may apply a security scoring process to a message sender domain to compute a weighted security score for the message sender domain. The computing platform may determine a weighted grade for the message sender domain based on the weighted security score for the message sender domain. Based on the weighted grade for the message sender domain, the computing platform may execute one or more enhanced protection actions associated with the message sender domain.