Targeted Email Attack Detection via Feature Combinations and Interflow Shapes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional signature matching and heuristic algorithms are ineffective in detecting targeted email attacks due to their similarity with normal emails, making it difficult to differentiate between legitimate and malicious communications.
Innovation Solution
The system detects targeted email attacks by analyzing feature combinations and interflow shapes formed by emails, comparing them against known abnormal and normal email features and patterns, using a traverse tree for efficient matching and a sandbox module for verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional signature matching and heuristic algorithms are used to detect email attacks, then the detection process is simple and fast, but the detection effectiveness is poor because targeted email attacks resemble normal emails
Solution Approach 1:
The patent segments the email detection problem into multiple independent analysis dimensions: header analysis, body content analysis, attachment analysis, and interflow shape analysis. Each dimension extracts specific features independently, and their results are combined to make the final detection decision. This segmentation allows the system to analyze targeted email attacks from multiple angles without requiring a single complex detection algorithm.
Solution Approach 2:
The patent introduces a new dimension of analysis by examining interflow shapes - the temporal and relational patterns formed by sequences of emails between senders and recipients. This transforms the detection problem from analyzing individual email characteristics to analyzing the dimensional patterns of email flows over time, enabling detection of targeted attacks that resemble normal emails in content but exhibit abnormal communication patterns.
2Measurement precision
If feature combinations and interflow shapes are analyzed to detect targeted email attacks, then detection precision is improved, but the computational complexity and processing time increase
Solution Approach 1:
The patent performs preliminary actions by pre-computing and storing interflow shape templates for both normal and malicious email patterns. When a new email arrives, the system compares its interflow shape against these pre-computed templates rather than performing complex real-time analysis. This preliminary preparation significantly reduces the processing time for incoming emails while maintaining high detection precision.
Solution Approach 2:
The patent implements a multi-layered detection approach where not all analysis methods are applied to every email. Instead, the system performs basic header and content analysis on all emails, and only applies more computationally intensive interflow shape analysis to emails that exhibit suspicious characteristics in the preliminary analysis. This partial application of complex analysis reduces overall processing time while maintaining high detection precision for targeted attacks.
Data Source
AI summary
Targeted email attacks are detected using feature combinations of known abnormal emails, interflow shapes formed by an email with other emails, or both. An email received in an endpoint computer system is scanned to identify abnormal features indicative of a targeted email attack and the abnormal features of the email are checked against abnormal feature combinations. The email can also be scanned to identify an interflow shape formed by the email with other emails and the interflow shape is checked against interflow shapes of known targeted email attacks.