Suspicious Data Analysis Through Layered Email Threat Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional methods fail to effectively analyze and prevent suspicious data in electronic communications, particularly in identifying malicious code and data exfiltration attempts, and lack thorough analysis of email attachments and sender behavior.

Innovation Solution

A system and method for identifying and analyzing suspicious data in electronic networks through behavioral, static, and metadata analyses, isolating extraneous characteristics, and creating analytics logs to track and manage potential threats.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If conventional methods are used to detect suspicious data in electronic communications, then the system is simpler to operate, but the detection accuracy and ability to identify malicious code is insufficient

Engineering Contradiction:

Improvedetection accuracyVSAvoidsystem complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The system segments the analysis process into multiple specialized modules: static analysis engine for code structure examination, behavioral analysis engine for execution monitoring, and metadata analysis for communication patterns. Each module focuses on specific detection tasks, improving overall detection accuracy while maintaining manageable complexity through modular design.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

An isolated environment acts as an intermediary between suspicious electronic communications and the host system. The isolated environment safely executes and analyzes potentially malicious code without risking the host system, enabling accurate detection while protecting system integrity.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Measurement precision

If comprehensive behavioral and static analysis is performed on all electronic communications, then detection accuracy improves, but computing resources and network load increase

Engineering Contradiction:

Improvedetection accuracyVSAvoidcomputing resources

Core Design Contradiction:

Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The system applies partial analysis by performing static analysis on all communications and reserved analysis (behavioral analysis in isolated environment) only on communications exhibiting suspicious characteristics. This selective approach maintains high detection accuracy for malicious content while significantly reducing overall computing resource consumption compared to analyzing every communication exhaustively.

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

Different analysis depths are applied to different communications based on their risk characteristics. High-risk communications receive comprehensive behavioral analysis in isolated environments, while low-risk communications receive only lightweight static analysis, optimizing resource allocation according to local needs.

Inventive Principle:

Principle #3Local quality

3Reliability

If extraneous characteristics are isolated and executed in an isolated environment, then security is enhanced, but the process time and system complexity increase

Engineering Contradiction:

ImprovesecurityVSAvoidprocess time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary static analysis and metadata analysis before isolating extraneous characteristics. This preliminary screening identifies communications that truly require isolated environment execution, so that only necessary cases undergo time-consuming isolation and behavioral analysis, reducing overall process time while maintaining security.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The isolated environment is created, used for behavioral analysis, and then dismantled in periodic cycles rather than maintaining continuous isolated environments. This periodic approach enhances security through proper isolation when needed while reducing system complexity and resource overhead by eliminating isolated environments when not actively analyzing suspicious content.

Inventive Principle:

Principle #19Periodic action

Data Source

PatentUS12452271B2System and method for identification and analysis of suspicious data in an electronic network environment

Publication Date: 2025.10.21 BANK OF AMERICA CORP

AI summary

Systems, computer program products, and methods are described herein for identification and analysis of suspicious data in an electronic network environment. For instance, the system may include a processing device configured to: receive a transmission of an electronic communication through a communication gateway; determining if the electronic communication contains one or more extraneous characteristics; and, in response to determining that the electronic communication contains one or more extraneous characteristics, initiating at least one of a behavioral analysis, a static analysis, or a metadata analysis. The system may further configure the processor to create, in response to initiating at least one of the behavioral analysis, the static analysis, or the metadata analysis, an analytics log associated with the electronic communication.