Email Gateway Hold Decisions for Scalable Threat Screening
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing electronic message processing systems are computationally expensive, time-consuming, and do not scale well, leading to delays and inefficiencies in handling email traffic.
Innovation Solution
Implementing a message-hold decision maker (MHDM) that leverages synchronous and asynchronous classifiers to make near-real-time decisions on whether to hold, block, or allow electronic messages, using a pluggable framework of classification engines and a results cache to enhance processing efficiency and scalability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sandboxing is used to scan suspicious files and URLs in emails, then threat detection capability is improved, but processing time and computational cost increase significantly
Solution Approach 1:
The system performs preliminary classification of emails using multiple classification engines (heuristic, reputation, content-based) before sandboxing. This preliminary action filters out clearly safe or obviously malicious emails, reserving sandboxing only for borderline cases, thus reducing overall sandboxing time while maintaining detection capability
Solution Approach 2:
The email processing system is segmented into multiple independent classification engines that operate in parallel: heuristic classification, reputation-based classification, content-based classification, and sandboxing. This segmentation allows different types of emails to be processed by appropriate engines simultaneously, reducing total processing time
2Measurement precision
If sandboxing is applied to all incoming emails for thorough security scanning, then detection accuracy improves, but system scalability deteriorates
Solution Approach 1:
Instead of applying sandboxing to all emails (excessive action), the system applies partial sandboxing only to emails that pass through multiple classification engines and remain in the borderline risk category. This partial action maintains high detection accuracy for suspicious emails while preserving system scalability
Solution Approach 2:
The system implements multiple classification engines with different methodologies (heuristic, reputation, content-based) that can handle various types of emails differently. This multi-functionality allows the system to process high volumes of email traffic efficiently while maintaining high detection accuracy through specialized engines
3Reliability
If multiple classification engines are deployed to improve email sorting accuracy, then threat detection reliability improves, but system complexity increases
Solution Approach 1:
The system introduces a central coordination mechanism that acts as an intermediary between multiple independent classification engines. This mediator manages the workflow, routes emails to appropriate engines, and aggregates results, thereby managing system complexity while maintaining high classification accuracy through coordinated multi-engine operation
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
A message-hold decision maker system (102) used with an electronic mail processing system that processes electronic messages for a protected computer network improves the electronic mail processing system's performance by increasing the throughput performance of the system. The improvements are achieved by providing an electronic mail processing gateway (104) with additional logic that makes fast and intelligent decisions on whether to hold, block, allow, or sandbox electronic messages in view of potential threats such as viruses or URL-based threats. A message hold decision maker (106) uses current and stored information from a plurality of specialized classification engines (108, 110) to quickly make the decisions. In some examples, the message hold decision maker (106) will instruct an email gateway (104) to hold an electronic mail message while the classification engines (108, 110) perform further analysis.