Executable Link Detection in Phishing Emails Using AI and Virtual Machines
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus software is ineffective in detecting new or altered malicious code in phishing emails and malicious executable hyperlinks, often requiring users to fall victim to the attack before countermeasures are developed, and conventional methods operate after the fact, failing to prevent initial clicks that can cause damage.
Innovation Solution
Implementing a system that uses artificial intelligence and virtual machines to isolate and monitor the behavior of executable code or links within a user device, comparing them against blacklists and whitelists, and simulating user actions to detect malicious intent before allowing execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional antivirus software is used to detect malicious code, then known viruses can be identified, but new or altered malicious code remains undetected and causes damage
Solution Approach 1:
The system performs preliminary analysis of executable code by extracting features and comparing them against multiple blacklists and whitelists before execution occurs. This advance detection approach identifies new and altered malicious code patterns that conventional post-execution antivirus methods miss, preventing damage before it happens.
Solution Approach 2:
The system creates a virtual machine environment that copies and isolates the executable code for safe analysis. By copying the code into a controlled virtual space, the system can thoroughly examine its behavior and features without risking damage to the host system, enabling comprehensive detection of novel threats.
2Reliability
If users are warned about potential threats, then some damage can be prevented, but users may still click malicious links and fall victim to attacks
Solution Approach 1:
The system provides self-service security by automatically analyzing executable code, extracting features, and comparing them against databases without requiring user intervention. It autonomously makes detection decisions and blocks malicious content, eliminating the need for users to manually check warnings or understand security threats.
Solution Approach 2:
The system introduces an intermediary layer between the user and potential malicious content. By placing a virtual machine and feature extraction system in between, it automatically filters and evaluates code before it reaches the user, preventing clicks on malicious links without requiring user awareness or action.
3Reliability
If conventional antivirus methods are used, then existing malware can be blocked, but new malware variants slip through and cause harm
Solution Approach 1:
The system performs preliminary feature extraction and comparison against multiple blacklists and whitelists before execution, enabling rapid identification of new malware variants. This advance analysis significantly speeds up the response time compared to conventional methods that only react after damage occurs or after signatures are updated.
Solution Approach 2:
The system dynamically extracts and analyzes features from executable code in real-time, adapting its detection approach based on the specific characteristics of each piece of code. This dynamic analysis enables the system to quickly identify novel malware variants without relying on pre-existing signatures, greatly improving response speed.
4Ease of operation
If code is executed in a normal environment, then functionality can be verified, but malicious code can cause damage to the device
Solution Approach 1:
The system segments the code execution environment by isolating executable code within a separate virtual machine. This segmentation allows the code to be executed and its functionality verified while containing any potential damage within the isolated virtual environment, protecting the host device from harm.
Solution Approach 2:
The virtual machine acts as an intermediary layer between the code and the host device. It enables code execution and functionality verification while mediating any potential harmful effects, blocking malicious code from accessing or damaging the host system's resources.
Data Source
AI summary
Aspects of the subject disclosure may include, for example, receiving, at a device, a message over a communication network from a remote source, determining if the message includes executable code and initiating a virtual machine in an isolated portion of the memory of the device responsive to the determining the message include executable code. Aspects of the subject disclosure further include executing, by the virtual machine, the executable code within the isolated portion of the memory, monitoring, by an artificial intelligence module, activities of the executable code during the executing the executable code and determining if the executable code comprises malicious code responsive to the monitoring activities of the executable code. Aspects of the disclosure further include deleting the executable code from the device in response to a determination that the executable code comprises malicious code. Other embodiments are disclosed.