Email Inspection System for Detecting Compromised Messages

Solution Overview

Problem

Existing email inspection systems face challenges in detecting malicious content, particularly advanced persistent threats that appear normal until after delivery, and may fail to identify compromised emails that previously passed inspection.

Innovation Solution

An email inspection system that records security information of emails passing inspection, detects malicious content, and sends notification emails with SMTP headers to identify and block incoming emails with the same malicious content, facilitating the identification of compromised emails and public Mail Transfer Agents that send malicious emails.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If emails are inspected using traditional methods (pattern matching, sandbox evaluation, hash comparison), then known malicious content can be detected, but advanced persistent threats that appear normal initially cannot be detected

Engineering Contradiction:

Improvedetection accuracyVSAvoidability to detect advanced persistent threats

Core Design Contradiction:

Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The system performs preliminary inspection of emails and records security information (sender, recipient, subject, attachment hashes, URLs) for emails that pass inspection. This preliminary action creates a baseline database that enables later detection of compromised emails when the same malicious content is identified, allowing the system to detect advanced persistent threats that initially appeared normal.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements feedback by continuously monitoring incoming emails against the recorded security information database. When malicious content is detected in a new email, the system queries the database to identify compromised emails that previously passed inspection, sends notifications to recipients, and blocks future emails from the same sender or containing the same malicious content, creating a closed-loop feedback mechanism that improves detection capability over time.

Inventive Principle:

Principle #23Feedback

2Reliability

If security inspection is performed on all incoming emails, then malicious content can be identified, but compromised emails that previously passed inspection cannot be identified

Engineering Contradiction:

Improveemail securityVSAvoidinformation about compromised emails

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

The system performs preliminary inspection of emails and records security information (sender, recipient, subject, attachment hashes, URLs) for emails that pass inspection. This preliminary action creates a baseline database that enables later detection of compromised emails when the same malicious content is identified, allowing the system to detect advanced persistent threats that initially appeared normal.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements feedback by continuously monitoring incoming emails against the recorded security information database. When malicious content is detected in a new email, the system queries the database to identify compromised emails that previously passed inspection, sends notifications to recipients, and blocks future emails from the same sender or containing the same malicious content, creating a closed-loop feedback mechanism that improves detection capability over time.

Inventive Principle:

Principle #23Feedback

3Ease of operation

If notification emails are sent to recipients of compromised emails, then recipients can take responsive actions, but the system lacks mechanisms to block incoming emails with the same malicious content

Engineering Contradiction:

Improverecipient awarenessVSAvoidincoming malicious emails

Core Design Contradiction:

Ease of operationVSObject-generated harmful factors

Solution Approach 1:

The system implements feedback by continuously monitoring incoming emails against the recorded security information database. When malicious content is detected in a new email, the system queries the database to identify compromised emails that previously passed inspection, sends notifications to recipients, and blocks future emails from the same sender or containing the same malicious content, creating a closed-loop feedback mechanism that improves detection capability over time.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The system applies preliminary anti-action by blocking emails from senders who have previously sent malicious content or emails containing the same malicious content before they can reach recipients. This proactive blocking prevents harm before it occurs, complementing the notification system by providing automatic protective action.

Inventive Principle:

Principle #9Preliminary anti-action

Data Source

PatentUS10243989B1Systems and methods for inspecting emails for malicious content

Publication Date: 2019.03.26 TREND MICRO INC

AI summary

An email inspection system receives emails that are addressed to recipients of a private computer network. The emails are inspected for malicious content, and security information of emails that pass inspection is recorded. When an email is detected to have malicious content, the recorded security information of emails is checked to identify compromised emails, which are emails that previously passed inspection but include the same malicious content. A notification email is sent to recipients of compromised emails. The notification email includes Simple Mail Transfer Protocol headers that facilitate identification of the recipients, blocking of incoming emails with the same malicious content, and identification of public Mail Transfer Agents that send malicious emails, i.e., emails with malicious content.