Email Campaign Threat Detection Using Message Group Behavior
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing email security systems struggle to effectively identify and block coordinated malicious email campaigns due to attackers varying message attributes to evade detection, leading to false negatives and positives.
Innovation Solution
A system analyzes messages for potential threats by identifying groups of related messages based on behavioral characteristics and message attributes, using machine learning and logical predicates to determine campaign membership, and performs appropriate security actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If email security systems analyze individual messages using traditional signature-based detection, then detection speed is maintained, but malicious campaigns with varied attributes evade detection causing false negatives
Solution Approach 1:
The patent combines multiple individual message analyses into a unified campaign-level analysis. By merging messages into campaigns based on shared attributes (sender, recipient, timing, content patterns), the system achieves more reliable detection of malicious campaigns while maintaining manageable complexity through standardized merging criteria.
Solution Approach 2:
The campaign analysis system serves multiple functions simultaneously: it detects malicious campaigns, identifies legitimate marketing campaigns, and provides attribution for security actions. This multi-functionality improves detection reliability across different message types while using a single unified analysis framework.
2Object-affected harmful factors
If the system blocks all messages in identified campaigns, then malicious messages are blocked effectively, but legitimate marketing campaigns are also blocked causing false positives
Solution Approach 1:
Instead of assuming all campaign messages are malicious and blocking them by default, the system inverts the approach by analyzing campaign attributes to determine legitimacy. Legitimate marketing campaigns are identified through positive attribution based on known patterns, allowing them to pass through while malicious campaigns are blocked.
Solution Approach 2:
The system changes the evaluation parameters from individual message content to campaign-level attributes such as sender behavior patterns, recipient lists, timing patterns, and content similarity metrics. This parameter change enables differentiation between malicious and legitimate campaigns, reducing false positives while maintaining threat blocking.
3Reliability
If the system analyzes campaign-level behavior patterns, then detection of coordinated attacks improves, but processing time and computational resources increase
Solution Approach 1:
The system performs preliminary actions by pre-identifying and grouping messages into campaigns before full security analysis. By establishing campaign memberships upfront using efficient attribute matching, the system reduces processing time for subsequent security analyses while maintaining reliable campaign-level detection capabilities.
Data Source
AI summary
Information associated with a received message is received. It is determined whether the received message is a part of a group of related messages. Based on a determination that the received message is a part of the group of related messages, a security action for one or more messages of the group of related messages is performed. The group of related messages has been identified as malicious based at least in part on identified behavior detected based on a plurality of messages of the group of related messages.