Targeted Attack Detection via Email URL Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Targeted attacks, particularly spear-phishing emails, pose a challenge as they often go undetected, allowing hackers to gain access to organizational systems without triggering security alerts, leading to potential data breaches.
Innovation Solution
A method and system that detect requests from computing devices during communication sessions, identify URLs, compute unique identifiers, and compare them against a database of known email-borne URLs to elevate threat levels and perform selective Deep Packet Inspection (DPI) on potentially malicious sessions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Deep Packet Inspection (DPI) is applied to all communication sessions to detect targeted attacks, then detection capability is improved, but resource consumption increases significantly
Solution Approach 1:
The system performs preliminary analysis by extracting URLs from email bodies before the communication session occurs, and creates unique identifiers for these URLs in advance. When a communication session is established, the system compares the session's URL against these pre-computed identifiers, enabling rapid detection without performing resource-intensive DPI on all sessions.
Solution Approach 2:
The system applies DPI selectively only to communication sessions that match URLs found in received emails, rather than uniformly applying it to all sessions. This localized approach concentrates security resources on high-risk sessions while leaving low-risk sessions to be handled with lighter inspection methods.
2Reliability
If security monitoring is applied to all communication sessions, then security coverage is improved, but system performance deteriorates
Solution Approach 1:
The system prepares a database of unique identifiers corresponding to URLs from received emails before communication sessions occur. This pre-computation allows the system to quickly compare incoming session URLs against the prepared database, maintaining comprehensive security coverage while minimizing the time and resources spent during actual session monitoring.
Solution Approach 2:
The system performs full security analysis only on sessions that match suspicious URLs, while using lighter-weight URL comparison for initial filtering. This partial application of intensive security measures maintains high security coverage for relevant sessions without degrading overall system performance.
3Measurement precision
If URL comparison against all received emails is performed, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The system extracts only the URL components from email bodies, discarding the rest of the email content for the purpose of URL matching. This extraction creates a focused dataset of unique identifiers that can be compared against session URLs without the overhead of analyzing complete email messages, thereby maintaining detection accuracy while reducing processing time.
Solution Approach 2:
The system creates simplified copies of URLs in the form of unique identifiers (such as hash values) that can be stored and compared efficiently. These identifier copies preserve the essential matching capability while occupying minimal storage space and enabling rapid comparison operations during session monitoring.
Data Source
AI summary
The disclosed computer-implemented method may include (1) detecting a request from a computing device of a member of an organization in connection with a communication session between the computing device and at least one additional computing device, (2) identifying, within the request, a URL that the computing device is attempting to access, (3) computing a unique identifier that represents the URL, (4) comparing the unique identifier against a database that includes unique identifiers that represent URLs embedded in emails received by members of the organization, (5) determining, based at least in part on the comparison, that the URL was included in an email received by the member of the organization, and then in response, (6) elevating a threat level of the communication session between the computing device and the additional computing device. Various other methods, systems, and apparatuses are also disclosed.