Email Security SMTP ID Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Sophisticated phishing attacks evade human detection by mimicking authentic emails from credible organizations, and tracing malicious mail servers is complicated due to the use of multiple real or virtualized mail servers, including dynamically provisioned ones, which existing techniques struggle to address effectively.
Innovation Solution
A computer-implemented method using a supervised machine learning classifier to process the Simple Mail Transfer Protocol (SMTP) ID and optionally the mail exchanger (MX) record to classify the authenticity of an email, identifying malicious messages by determining if they originate from the purported sender domain, and performing protective actions such as deletion, marking, or isolation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple real or virtualized mail servers are used for an organization, then email service availability and scalability are improved, but the ability to trace and identify malicious mail servers is worsened
Solution Approach 1:
The patent segments the mail server identification problem by extracting and analyzing specific protocol-level features (SMTP IDs, HELO/EHLO responses, banner messages) from each server instance. Instead of treating the organization as a single entity, the system divides the analysis into individual server characteristics that can be independently classified and traced.
Solution Approach 2:
The patent introduces machine learning classifiers as intermediary components that bridge the gap between multiple mail servers and security analysis. These classifiers act as mediators that process server responses and generate standardized threat assessments, enabling consistent identification across diverse server configurations.
2Reliability
If phishing emails replicate authentic correspondence perfectly, then the realism and deception effectiveness are improved, but the ability to detect malicious content through traditional methods is worsened
Solution Approach 1:
The patent replaces traditional mechanical filtering methods (keyword blocking, signature-based detection) with machine learning-based classification. The system uses supervised learning models that analyze patterns in SMTP protocol exchanges to distinguish authentic from malicious emails, substituting rule-based mechanics with intelligent pattern recognition.
Solution Approach 2:
The patent changes the detection parameters from content-based analysis to protocol-behavior analysis. Instead of examining email body content or sender addresses, the system analyzes SMTP transaction parameters such as response times, banner formats, and identifier patterns, detecting malicious emails through behavioral anomalies rather than content inspection.
3Adaptability or versatility
If dynamic mail server provisioning is implemented, then system flexibility and resource utilization are improved, but consistency of server identification features is worsened
Solution Approach 1:
The patent creates a universal classification system that handles multiple server types and provisioning methods through a single framework. The machine learning models are trained to recognize patterns across diverse server configurations, making the identification system multi-functional and adaptable to various deployment scenarios including dynamic provisioning.
Solution Approach 2:
The system compensates for feature inconsistency by changing from static identifier reliance to dynamic pattern recognition. The machine learning classifiers adapt to varying server configurations by learning from training data that includes diverse server responses, enabling consistent identification despite changes in server composition.
Data Source
Figure 1~2
Figure 3
AI summary
A computer implemented method of detecting malicious electronic mail comprising: receiving an electronic mail message including an indication of a purported sender network domain and a Simple Mail Transfer Protocol identifier (SMTP ID); processing the SMTP ID with a classifier, wherein the classifier is implemented using a supervised machine learning method trained to classify the SMTP ID as originating from the purported sender domain based on a training data set including authentic electronic mail messages from the domain; and responsive to a classification, by the classifier, of the received message indicating that the received message originates from a sender other than the purported sender domain, identifying the received message as malicious.