Email Attack Detection via Protocol-Specific Traffic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting email attacks are inaccurate due to the inclusion of non-email data in traffic statistics, leading to incorrect identification and handling of email attacks, which can cause network congestion and affect normal email operations.
Innovation Solution
A method that determines email traffic parameters by analyzing the protocol type of received data flows, identifying email traffic, and detecting email attacks when specific thresholds are exceeded, including the identification of target and attacker addresses through statistical analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If statistics are collected on traffic of the specific port of the E-mail server, then the detection coverage is improved, but the measurement precision deteriorates because non-email data is included in the statistics
Solution Approach 1:
The patent segments the data flow analysis by protocol type, separating email traffic (SMTP protocol) from other data traffic. The detection device divides the statistical analysis into different protocol categories, allowing email traffic to be measured independently from command data and other non-email traffic, thereby improving measurement precision without requiring complex overall traffic analysis
Solution Approach 2:
The patent introduces protocol type analysis as an intermediary step between raw traffic collection and attack detection. By adding this intermediate classification layer, the system can filter and identify email-specific traffic patterns without being contaminated by other data types, resolving the contradiction between comprehensive monitoring and accurate measurement
2Speed
If traffic threshold limiting is applied to the specific port, then the response speed to email attacks is improved, but the loss of information increases due to incorrect identification of normal traffic
Solution Approach 1:
The patent performs preliminary protocol type analysis and email traffic identification before applying threshold-based detection and limiting measures. By pre-classifying traffic as email or non-email based on protocol characteristics, the system ensures that subsequent threshold comparisons and limiting actions are applied only to actual email traffic, preventing false positives that would otherwise cause loss of normal email information
Solution Approach 2:
The patent implements feedback through continuous monitoring of email traffic parameters (number of emails, SMTP connections, concurrent connections) and comparing them against thresholds. The system adjusts its response based on the feedback from protocol analysis, ensuring that limiting actions are triggered only when email-specific metrics exceed thresholds, thereby maintaining normal email flow while responding to attacks
3Measurement precision
If protocol type analysis is performed on each data flow, then the measurement precision of email traffic is improved, but the productivity decreases due to increased processing time
Solution Approach 1:
The patent applies partial action by performing protocol type analysis only on data flows that are relevant to email traffic detection. Rather than analyzing every single data packet in detail, the system focuses protocol analysis on traffic patterns and characteristics specific to email protocols, achieving sufficient measurement precision for attack detection while minimizing unnecessary processing overhead
Solution Approach 2:
The patent changes the detection parameter from raw traffic volume to protocol-type-specific metrics (number of emails, SMTP connections, concurrent connections). By transforming the measurement parameters to be protocol-aware, the system achieves high precision in email traffic identification without requiring exhaustive analysis of all data flow characteristics, thereby maintaining processing efficiency
Data Source
AI summary
A method, an apparatus, and a device for detecting an E-mail attack. The device receives a data flow; obtains an E-mail traffic parameter of each statistic period within a predetermined number of statistic periods, where within each statistic period, the E-mail traffic parameter of each of the statistic periods is determined according to a protocol type of the received data flow; and determines that an E-mail attack is detected when the E-mail traffic parameter of each statistic period within the predetermined number of statistic periods matches a first threshold. By applying the disclosed embodiments, a detection result of the E-mail attack is more accurate.