Email Spoofing Detection via Writing Style Analysis

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Electronic messages are susceptible to spoofing attacks, where malicious sources disguise messages as coming from trusted vendors, leading to potential data breaches, malware spread, and network disruptions, as existing technologies fail to effectively detect and protect against such deceptive communications.

Innovation Solution

A computer-implemented method identifies and protects against malicious electronic messages by analyzing the writing style of legitimate messages from vendors, storing authentic styles in a database, and comparing them with new messages to detect differences, thereby determining the authenticity of the source and performing security actions such as notification or blocking.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If electronic messages are sent and received over networks, then communication efficiency and information exchange are improved, but susceptibility to spoofing attacks and security breaches increases

Engineering Contradiction:
Improvecommunication efficiencyVSAvoidspoofing attack susceptibility
Core Design Contradiction:
ProductivityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary analysis of the message content and writing style before delivering the message to the recipient. By proactively comparing the message against stored authentic writing styles of the purported sender, the system identifies spoofed messages before they can harm the recipient, thus preventing security breaches while maintaining communication efficiency

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The system introduces an intermediary security analysis layer between the message sender and recipient. This intermediary component analyzes the writing style and content of messages, comparing them against known authentic patterns, and determines whether to allow or block message delivery, thus protecting against spoofing without disrupting legitimate communication

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If message filtering and security analysis are implemented, then protection against spoofing is improved, but message delivery time and system processing load increase

Engineering Contradiction:
Improvespoofing detection accuracyVSAvoidmessage delivery time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The system extracts only the essential writing style characteristics from authentic messages and stores them as reference patterns. When analyzing incoming messages, it extracts and compares only these key stylistic features rather than performing comprehensive content analysis, thus achieving reliable spoofing detection with minimal processing time and reduced impact on message delivery speed

Inventive Principle:
Principle #2Taking out (Extraction)

Data Source

PatentUS12101352B1Identifying and protecting against malicious electronic messages that deceptively appear to originate from a trusted source
Publication Date: 2024.09.24 GEN DIGITAL INC
  • US12101352B1 patent drawing
  • US12101352B1 patent drawing
  • US12101352B1 patent drawing

AI summary

Identifying and protecting against malicious electronic messages that deceptively appear to originate from a trusted source. An authentic writing style contained within a legitimate electronic message that originates from a vender may be identified. The authentic writing style may be stored in a database. A new electronic message may be received that appears to originate from the vendor. The new electronic message may contain a new writing style. The new writing style may be compared with the authentic writing style stored in the database to identify any differences between the new writing style and the authentic writing style. A determination may be made that the new electronic message does not originate from the vender based, at least on part, on one or more differences identified between the writing styles. A security action may then be performed to protect against the new electronic message.