On-Demand Email Attachment Scanning via HTML Conversion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus measures often fail to detect malicious email attachments due to 'zero-day' vulnerabilities, and techniques like attachment rewriting raise privacy concerns and latency issues, making it difficult for end users to detect and manage suspicious attachments effectively.
Innovation Solution
Converting email attachments into HTML files that allow users to preview, scan, or extract data locally, enabling on-demand scanning and reducing data leakage by keeping the attachment within the user's control, with the option to send it for further analysis to a backend server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If attachment rewriting is used to detect malicious attachments, then detection capability is improved, but data privacy is compromised and latency increases
Solution Approach 1:
The patent creates a copy of the attachment in HTML format that preserves the content and functionality for scanning purposes, while the original attachment remains on the user's system. This copying approach enables remote scanning without requiring the original file to be transferred or stored on external servers, thus maintaining data privacy while achieving detection capability.
Solution Approach 2:
The patent transforms the attachment from its original binary format into HTML format with embedded JavaScript. This parameter change in file format and structure allows the attachment to be executed in a browser environment, enabling remote scanning while maintaining the same functional behavior and detection accuracy.
2Difficulty of detecting and measuring
If attachment rewriting stores attachments on remote servers, then scanning capability is improved, but user control and privacy are reduced
Solution Approach 1:
The patent enables the attachment to scan itself by embedding JavaScript code within the HTML representation that automatically executes scanning functions when the HTML file is opened in a browser. This self-service mechanism allows the attachment to perform its own security scanning without requiring external server infrastructure or user intervention to upload files to remote systems.
3Loss of time
If attachments are scanned immediately upon receipt, then security response time is improved, but detection accuracy for zero-day threats is reduced
Solution Approach 1:
The patent performs preliminary conversion of the attachment to HTML format with embedded scanning JavaScript at the time of receipt, but delays the actual execution of the scanning function until the user opens the HTML file in a browser. This preliminary preparation allows the system to have the attachment ready for immediate scanning while enabling the user to trigger the scan at a later time when updated virus patterns may be available, thus achieving both quick response preparation and accurate detection.
Data Source
AI summary
An attachment to an e-mail message received at an e-mail gateway is scanned by a scan server and then is converted into an HTML file. The HTML file includes preview data of the attachment (minus any macro scripts), the entire original data of the attachment, scan functionality enabling a user to send the attachment back to a scan server for a second scan, or extract functionality enabling a user to extract the original attachment data for saving or opening in an application. The recipient is able to open or save the attachment directly if he or she believes it comes from a trusted sender. If the attachment seems suspicious, the recipient previews the attachment first before performing a scan, opening the attachment or deleting it. The recipient performs a scan of the attachment by clicking a “scan” button to send the attachment to a backend server for a second scan where an updated virus pattern file may be available to detect any zero-day malware.