Email Link Filtering via URL Replacement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for filtering unsolicited emails with maliciously-crafted web links are inefficient and prone to processing delays, as they often require analyzing data from third-party sites and may not effectively distinguish between legitimate and malicious URLs.
Innovation Solution
A method that interrupts email transmission, identifies and analyzes links based on intrinsic attributes of the email, selectively modifying suspicious links by replacing them with secure URLs, and performing a two-stage analysis to validate the classification of emails as unsolicited or solicited, thereby minimizing processing delays and ensuring only risky emails are modified.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If analysis is performed on data from third-party sites to identify malicious URLs, then detection accuracy is improved, but processing time and computational effort increase significantly
Solution Approach 1:
The patent applies preliminary action by pre-analyzing URLs and categorizing them as safe, suspicious, or malicious before they appear in emails. This is achieved through maintaining updated databases of known malicious URLs and analyzing URL patterns in advance, so that when emails are processed, the classification can be quickly determined without performing full analysis on every URL encountered.
Solution Approach 2:
The patent segments the URL analysis process into multiple stages: initial filtering based on known malicious URL databases, pattern matching against suspicious URL characteristics, and selective deep analysis only for URLs that pass initial filters. This segmentation allows the system to achieve high detection accuracy while minimizing processing time for the majority of safe URLs.
2Reliability
If all emails containing URLs are analyzed and modified, then protection against malicious links is improved, but processing effort and system load increase
Solution Approach 1:
The patent applies local quality by selectively applying different levels of analysis and modification to different emails based on their characteristics. Emails containing URLs that match known malicious patterns receive full analysis and modification, while emails with URLs from trusted sources or exhibiting safe characteristics undergo minimal or no processing. This ensures high protection effectiveness for risky emails while maintaining processing efficiency for safe emails.
Solution Approach 2:
The patent changes parameters such as URL replacement, email routing, and analysis depth based on the risk classification of each email. For high-risk emails, the system replaces URLs with safe alternatives and performs comprehensive analysis. For low-risk emails, the system may skip URL replacement entirely or use simplified verification, thereby adjusting processing effort according to the actual threat level.
3Reliability
If URLs are replaced with alternative network locations, then security against malicious sites is improved, but email delivery complexity increases
Solution Approach 1:
The patent introduces an intermediary component that acts as a URL translation service between the email system and external websites. When a URL is identified as malicious or suspicious, the intermediary replaces it with a safe alternative URL that redirects to a warning page or blocks access. This intermediary layer provides security protection while maintaining a relatively simple email delivery system, as the complexity is isolated to the URL translation component rather than the entire email infrastructure.
Data Source
AI summary
Embodiments of the invention provide a system and methods for filtering electronic messages having data therein identifying a link to a remote processing system. One embodiment provides a method which includes interrupting the transmission of the electronic message, identifying a link within the electronic message, and analyzing the electronic message on the basis of at least one of an attribute of the link and of at least an attribute intrinsic to the received electronic message so as to classify the message as either a suspect message or acceptable message. The method further includes modifying the electronic message so as to replace the link with an alternative network location corresponding to a remote processing system different from that corresponding to the link if the message is classified as a suspect message. The method further includes transmitting the electronic message unmodified if the message is classified as an acceptable message.