Email Forgery Detection via Domain Mutation Ratios
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods struggle to effectively identify forged emails, particularly those with mutated domain names that authentication schemes cannot distinguish from legitimate addresses, leading to difficulties in assigning a bad reputation to phishing emails without access to malicious activity data.
Innovation Solution
The system extracts email address parts (account name, subdomain, and base domain) and calculates mutation ratios relative to reference strings, comparing these ratios to thresholds to identify suspicious emails, which are then correlated with other security information to detect forged emails.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication schemes are used to verify email addresses, then legitimate emails can be authenticated, but forged emails with mutated domain names cannot be distinguished from legitimate addresses
Solution Approach 1:
The email address is segmented into multiple parts (local part, domain part, subdomain, base domain) and each part is analyzed separately using mutation ratio calculations. This allows the system to detect subtle mutations in domain names that authentication schemes miss, while still maintaining the ability to authenticate legitimate emails through their structured components.
Solution Approach 2:
The system introduces mutation ratio as a new parameter to measure the similarity between email address parts and known legitimate patterns. By calculating mutation ratios for domain parts, subdomains, and base domains, the system can identify forged emails with mutated domain names that traditional authentication schemes cannot detect.
2Measurement precision
If mutation ratio calculation is performed on all email addresses, then forged emails can be identified, but the system complexity increases
Solution Approach 1:
The mutation ratio calculation is applied selectively to specific parts of the email address (domain part, subdomain, base domain) rather than the entire address. This localized approach maintains high detection accuracy for forged emails while reducing unnecessary computational complexity in processing each email component.
Solution Approach 2:
The system pre-establishes reference strings for legitimate email address patterns and organizes them by domain, subdomain, and base domain. This preliminary preparation allows for efficient mutation ratio calculations during email detection, reducing real-time computational complexity while maintaining high detection precision.
3Measurement precision
If email address parts are extracted and analyzed, then similarity to reference strings can be determined, but the processing time increases
Solution Approach 1:
The email address is divided into distinct parts (local part, domain part, subdomain, base domain) that can be extracted and analyzed independently. This segmentation allows for parallel processing of different components and enables the system to focus computational resources only on the domain-related parts that are most susceptible to mutation in forged emails.
Solution Approach 2:
The mutation ratio calculation mechanism serves multiple functions: it detects forged emails with mutated domain names, validates email address structure, and compares against reference strings for known legitimate patterns. This multi-functionality reduces the need for separate processing steps, thereby minimizing additional processing time while maintaining high detection accuracy.
Data Source
AI summary
Forged emails are detected by extracting email address parts of a sender email address. The email address parts include an account name, a subdomain, and a base domain of the sender email address. The mutation ratio of the email address parts relative to reference strings are calculated to determine similarity of the email address parts to the reference strings. The mutation ratios are compared to ratio thresholds to identify suspicious email addresses, and the results of identifying suspicious email addresses are correlated with other computer security information to identify forged emails.