Just-in-Time Email URL Reputation Check System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-malware systems fail to accurately determine the reputation of hyperlinks in emails due to a lack of timely information, potentially allowing phishing or unwanted emails to bypass security checks, as the reputation of emails or URLs can change over time and may not be fully known at the time of initial scanning.
Innovation Solution
Implementing a 'just-in-time' reputation check system that encodes information into URLs, allowing for real-time reputation assessment at the time of hyperlink traversal by modifying the URL with identification information and meta-data, enabling the web gateway to re-evaluate the email's reputation using updated information from reputation servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If real-time reputation checking is implemented at hyperlink traversal time, then measurement precision of reputation assessment is improved, but device complexity increases due to URL encoding and decoding mechanisms
Solution Approach 1:
The email gateway performs preliminary actions by encoding email identification information into the URL before the email is delivered to the client. This pre-embedding of identification data enables the web gateway to later retrieve and check the email's reputation at the time of hyperlink traversal, ensuring accurate real-time assessment without requiring complex real-time communication infrastructure.
Solution Approach 2:
The patent introduces an intermediary mechanism where the URL itself carries embedded email identification information. This intermediary approach allows the web gateway to link the hyperlink traversal back to the original email for reputation checking without requiring direct integration between email and web gateway systems, thereby managing complexity while enabling precise reputation assessment.
2Loss of information
If URL modification with encoded information is performed, then information availability for reputation checking is improved, but loss of information increases due to URL encoding overhead
Solution Approach 1:
The patent extracts only the essential email identification information (such as message ID, sender address, or other unique identifiers) and embeds it into the URL. This selective extraction approach ensures that sufficient information is available for reputation checking without unnecessarily complicating the URL structure or processing requirements.
Solution Approach 2:
The email identification information is transformed into a format suitable for URL embedding through parameter encoding. This parameter change converts complex email data structures into simplified URL-compatible formats, maintaining information availability while reducing processing complexity during encoding and decoding operations.
3Reliability
If just-in-time reputation checking is implemented, then reliability of security determination is improved, but loss of time occurs during URL decoding and reputation re-evaluation
Solution Approach 1:
By pre-encoding the email identification information into the URL during the email delivery phase, the system eliminates the need for time-consuming real-time email retrieval and analysis when a user clicks a hyperlink. The web gateway can directly decode the embedded information and perform reputation checking, significantly reducing the time loss while maintaining high reliability.
Solution Approach 2:
The URL carries its own embedded email identification information, enabling the hyperlink traversal process to be self-sufficient. The web gateway can independently decode the URL and perform reputation assessment without requiring additional communication with the email gateway or retrieval of original email data, thereby minimizing time loss while ensuring reliable security determination.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system allows just-in-time checking of information about an email in which a hyperlink is embedded. Upon receipt of the email containing the hyperlink, the resource locator of the hyperlink is modified to allow checking the reputation of the email upon traversal of the hyperlink. At traversal of the hyperlink, the current reputation of the resource locator and the current reputation of the email are both determined, and one or more actions are performed responsive to the determination.