Email Spoofing Detection via Feature Amount Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing email security measures, such as antivirus software and sending domain authentication, are inadequate in detecting spoofed emails, particularly targeted attack mails that use unregistered program signatures and can evade filters due to carefully crafted attachments and text, leading to potential viral infections.
Innovation Solution
A method involving the generation and use of internal and external transmission secret key information and public key information to create verification information for emails, which is then added to the email headers, allowing client-side detection of spoofed mails by comparing feature amount information generated from header, text, and attached information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If antivirus software uses registered signatures to detect spoofed programs, then viral infection blocking is improved, but detection capability deteriorates for emails using unregistered program signatures
Solution Approach 1:
The patent applies preliminary action by pre-generating and storing feature amount information for email headers, text, and attachments before the email is received. This advance preparation allows the system to quickly compare incoming emails against pre-computed features without needing to analyze everything in real-time, improving detection speed and capability for previously unseen spoofed emails.
Solution Approach 2:
The patent replaces the traditional mechanical signature-based detection system with an information-processing approach using feature amount extraction and comparison. Instead of relying on pre-registered viral signatures, the system extracts numerical features from email components and compares them to detect anomalies, substituting the mechanical signature matching process with a more flexible information-based detection mechanism.
2Measurement precision
If antivirus software performs strict checking of email consistency, then detection accuracy is improved, but operational complexity increases for users
Solution Approach 1:
The patent applies self-service by enabling the email system to automatically perform consistency checking without requiring user intervention. The system autonomously extracts feature amounts from email headers, text, and attachments, compares them against pre-stored data, and determines spoofed status automatically, freeing users from manual verification tasks while maintaining high detection accuracy.
Solution Approach 2:
The patent introduces an intermediary layer between the user and the complex consistency checking process. This intermediary system handles the technical details of feature extraction, data comparison, and spoofed email identification, presenting users with simple received or rejected status notifications without exposing them to the underlying complexity of the detection mechanism.
3Reliability
If sending domain authentication is implemented on the server side, then email legitimacy verification is improved, but device complexity increases for clients
Solution Approach 1:
The patent applies preliminary action by pre-generating and storing feature amount information for email components before the email is received. This advance preparation shifts the complexity to the sending side where the features are created once and stored, allowing receiving devices to simply compare incoming email features against the pre-stored data without needing complex authentication logic.
Solution Approach 2:
The patent extracts the complex feature extraction and comparison logic from the receiving device and places it on the sending side. By taking out the complexity to where the email is originally created, the receiving devices only need to perform simple feature comparison operations, significantly reducing client-side complexity while maintaining verification reliability.
Data Source
AI summary
A method includes: generating object information that indicates an object designated from among a header item, text, and attached information of a received email, or feature amount information based on the object information and a predetermined function, when a source is an address in an internal network, decrypting verification information added to the received email using secret key information shared in the internal network, when the source is an address over an external network, decrypting the verification information using public key information shared with the source, and verifying whether or not the received email is a spoofed mail based on the object information or the feature amount information, and the decrypted verification information.