Email Hidden-Trait Exposure for Phishing Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing email filtering systems fail to accurately distinguish between benign and malicious emails, leading to misclassification and manual evaluation that is time-consuming and error-prone, while deceptive messages exploit hidden traits to bypass these systems.
Innovation Solution
A technology that identifies and reveals hidden message traits, such as altered Cascading Style Sheets (CSS) and HTML style tags, to make deceptive characteristics visible in the rendered message, supported by additional analyses like link and virus scans.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If email filtering systems use natural language processing to classify emails, then automation is improved, but measurement precision of malicious content detection deteriorates
Solution Approach 1:
The system segments email analysis into multiple components: automated filtering for initial classification, hidden trait detection for suspicious pattern identification, and manual evaluation for final verification. This segmentation allows automation to handle routine cases while precision-critical cases receive additional scrutiny.
Solution Approach 2:
The system introduces an intermediary layer between automated filtering and final delivery/quarantine decisions. This intermediary analyzes hidden traits and provides additional signals to the filtering system, improving detection precision without eliminating automation.
2Measurement precision
If manual evaluation is used to assess quarantined emails, then measurement precision is improved, but loss of time increases
Solution Approach 1:
Instead of manually evaluating all quarantined emails, the system applies partial manual review only to emails exhibiting hidden suspicious traits. The majority of emails undergo automated analysis, with manual intervention reserved for borderline or high-risk cases.
Solution Approach 2:
The system performs preliminary automated analysis including hidden trait detection before manual evaluation. This preliminary action filters out clearly benign or malicious emails, reducing the volume requiring time-consuming manual review.
3Ease of manufacture
If hidden traits are used in deceptive emails to bypass filtering, then ease of manufacture of malicious messages is improved, but difficulty of detecting and measuring increases
Solution Approach 1:
The system converts the harmful hidden traits used by spammers into a beneficial detection mechanism. By specifically searching for these hidden elements (invisible text, hidden images, concealed links), the system transforms what spammers use for deception into identifiable markers of malicious content.
Solution Approach 2:
The system makes hidden traits visible through various rendering techniques, effectively changing their 'color' from invisible to detectable. Hidden text is revealed, concealed images are displayed, and hidden links are exposed, allowing users and filters to see what was previously concealed.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The technology described herein visibly depicts hidden message traits to help users determine whether an email is genuine or deceptive. The hidden message traits are revealed by identifying and changing attributes that keep the hidden traits from being displayed in a rendered message. Spam messages, phishing messages, and messages that include or link to malicious programs (e.g., malware, ransomware) are examples of unwanted messages that can harm a recipient. These messages often rely on deception to get past email filtering systems and to trick a user into acting on content in a message. The deception often involves including hidden traits in a message that fool an automated filtering system. The technology described herein shows the visible traits to a user by including them in the rendered version of the message.