Intermediary Node Link Analysis for Email Security

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing systems fail to effectively detect and process malicious email messages, particularly those designed to deceive users into revealing sensitive information through spoofed links, which can lead to phishing attacks and data theft.

Innovation Solution

A cloud-based intermediary node analyzes email links to identify potentially malicious resources and replaces them with alternate trusted links, while also providing visual indicators of the true domain name and deactivating hyperlinks to prevent access to malicious sites.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If email links are left unmodified to maintain user access freedom, then user convenience is improved, but security against malicious sites deteriorates

Engineering Contradiction:
Improveuser convenienceVSAvoidsecurity risk
Core Design Contradiction:
Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The system introduces an intermediary node that acts as a mediator between the user and the email link destination. When a user clicks a link, the intermediary node intercepts the request, analyzes the destination URL against malicious site databases, and either allows passage or blocks the connection. This resolves the contradiction by maintaining user convenience (automatic interception without user action) while providing security (blocking malicious sites before access)

Inventive Principle:
Principle #24Intermediary (Mediator)

2Object-affected harmful factors

If all email links are blocked to ensure security, then security is improved, but user access to legitimate resources deteriorates

Engineering Contradiction:
ImprovesecurityVSAvoidaccess efficiency
Core Design Contradiction:
Object-affected harmful factorsVSProductivity

Solution Approach 1:

The system implements feedback mechanisms where link destinations are analyzed in real-time against updated databases of malicious and legitimate sites. The intermediary node receives feedback from security databases, analyzes the link destination, and makes intelligent decisions to allow or block access. This resolves the contradiction by providing security through active monitoring while maintaining productivity by allowing legitimate links to pass through unimpeded

Inventive Principle:
Principle #23Feedback

3Speed

If phishing links are not detected, then message delivery speed is improved, but information security deteriorates

Engineering Contradiction:
Improvemessage delivery speedVSAvoidinformation security
Core Design Contradiction:
SpeedVSReliability

Solution Approach 1:

The system performs preliminary analysis of email links during the email delivery process itself, before the recipient interacts with the message. The intermediary node pre-analyzes link destinations, identifies phishing attempts, and prepares security decisions in advance. This resolves the contradiction by maintaining fast delivery (analysis happens in parallel with delivery) while ensuring security (phishing links are identified and blocked before users can access them)

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP2859495B1Malicious message detection and processing
Publication Date: 2018.10.31 PROOFPOINT INC
  • EP2859495B1 patent drawingFigure 1
  • EP2859495B1 patent drawingFigure 2
  • EP2859495B1 patent drawingFigure 3

AI summary

Malicious message detection and processing systems and methods are provided herein. According to some embodiments, the messages are emails and the method for processing emails may be facilitated by way of an intermediary node which may be cloud-based. The intermediary node may be communicatively couplable with an email client and an email server. The intermediary node may execute a method that includes analyzing a link included in an email to determine if the link is associated with a potentially malicious resource, and replacing the link with an alternate link to a trusted resource if the link is associated with a potentially malicious resource.