Email Domain Verification for Phishing Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current countermeasures against phishing attacks are ineffective in reliably identifying and blocking fraudulent e-mail messages that appear to originate from recognized domains, as they do not prevent spoofing of legitimate site addresses and fail to authenticate links within messages.
Innovation Solution
A message manager system that monitors incoming e-mail messages, verifies the sender domain against a list of recognized domains, and compares embedded links to a white list of authorized domains to determine the message's legitimacy, blocking or alerting the user if unauthorized links are detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current countermeasures (antispam standards, trademark owner notification) are used to protect against phishing, then some level of protection is provided, but they fail to reliably identify and block fraudulent e-mail messages that spoof legitimate site addresses
Solution Approach 1:
The system performs preliminary authentication by comparing the sender's domain and embedded links against pre-established lists of authorized domains and white-listed URLs before the user interacts with the message. This advance verification prevents phishing messages from reaching users, as the system proactively identifies fraudulent content by checking whether domains match authorized entries or links appear on the white list.
Solution Approach 2:
The patent introduces an intermediary authentication layer between the user and phishing content. The message manager acts as a mediator that intercepts incoming messages, extracts domains and links, and compares them against authorized lists. This intermediary system provides reliable phishing detection without requiring direct user involvement in the authentication process, thereby maintaining simplicity while improving reliability.
2Ease of operation
If users are prompted to verify confidential information transmission (e.g., Norton Privacy Control), then user control is improved, but users believe they are transmitting to reputable websites and circumvent the intervention, authorizing release to illicit destinations
Solution Approach 1:
The system applies preliminary anti-action by preemptively blocking phishing messages before users can be deceived. Instead of relying on users to verify legitimacy at the point of information transmission, the system beforehand identifies and prevents delivery of messages containing spoofed domains or unauthorized links. This eliminates the need for user verification prompts, as fraudulent content is stopped at the gateway level.
Solution Approach 2:
The authentication system operates autonomously without requiring user intervention. The message manager automatically extracts domains and links from incoming messages, compares them against authorized lists, and makes authentication decisions independently. This self-service approach eliminates the vulnerability where users might be deceived into authorizing transmissions to illicit destinations, as the system performs verification without user involvement.
3Measurement precision
If the system monitors and compares all incoming e-mail messages against authorized domain lists, then detection precision is improved, but processing time and system resources increase
Solution Approach 1:
The system extracts only the critical authentication elements (sender domain and embedded links) from incoming messages for comparison against authorized lists. Rather than analyzing entire message content, the message manager isolates and processes only the domain and link components that are relevant for phishing detection. This extraction approach maintains high detection precision while minimizing processing time and resource consumption.
Solution Approach 2:
The system performs partial authentication by focusing verification efforts on specific high-risk elements (domains and links) rather than analyzing every aspect of incoming messages. The message manager applies authentication checks selectively to extracted domains and links, providing sufficient precision for phishing detection without the overhead of comprehensive message analysis, thereby balancing accuracy with processing efficiency.
Data Source
AI summary
A message manager monitors incoming e-mail messages. The message manager determines whether the from field of each incoming e-mail message indicates that the e-mail message originates from a recognized domain. Responsive to determining that the from field indicates that the e-mail originates from a recognized domain, the message manager compares at least one domain associated with at least one link found embedded in the text of the e-mail message to a list of authorized domains. Based on the results of the comparison, the message manager determines whether the e-mail message originates from a recognized domain.