Malicious Attachment Detection via Metadata Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Endpoint security methods are insufficient in detecting malware, particularly in macro embedded attachments, due to techniques employed by malware programmers such as encryption, polymorphism, and code obfuscation, which hinder effective detection and prevention.
Innovation Solution
A computing device analyzes characteristics of electronic messages and attachments, including send time, creation time, and length, to determine if an attachment is malicious, allowing for preemptive security actions independent of application de-compilation, thereby reducing latency and overhead in antimalware detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If endpoint security methods are used to detect malware, then detection capability is provided, but detection effectiveness deteriorates due to encryption, polymorphism, and code obfuscation techniques
Solution Approach 1:
The patent performs preliminary analysis of attachment characteristics (file name, size, creation time, edit time, macro information) before the attachment is opened or executed. This preliminary action allows the system to identify potentially malicious attachments based on suspicious temporal relationships and metadata patterns, enabling detection before the malware can execute its encrypted or obfuscated payload.
Solution Approach 2:
Instead of analyzing the attachment content directly (which is encrypted or obfuscated), the patent inverts the approach by analyzing the metadata and temporal characteristics of the attachment. By examining when the attachment was created, edited, and when the email was sent, the system can detect malware without needing to decode the protected content.
2Measurement precision
If application de-compilation is used for malware detection, then detection thoroughness is improved, but detection latency and system overhead increase
Solution Approach 1:
The patent extracts and analyzes only the critical metadata characteristics (file name, size, creation time, edit time, macro information) from the attachment, rather than performing full de-compilation of the attachment content. This extraction approach provides sufficient detection thoroughness by focusing on the temporal and structural indicators of malware while avoiding the time-consuming process of complete content analysis.
3Measurement precision
If comprehensive attachment analysis is performed, then detection accuracy is improved, but processing complexity increases
Solution Approach 1:
The patent applies local quality analysis by examining specific localized characteristics of the attachment (metadata fields and temporal relationships) rather than performing uniform comprehensive analysis of the entire attachment content. This approach achieves high detection accuracy by focusing on the specific local properties (creation time, edit time, file name patterns) that are most indicative of malware while keeping processing complexity manageable.
Data Source
AI summary
A method for determining malicious attachments on messages is described. A computing device may receive an electronic message, including one or more unopened attachments, and identify one or more characteristic values of the message header, message body, or attachments of the message. The computing device may analyze the identified characteristics and in some instances compare at least a portion of the characteristics, individually or in combination, with one or more configured thresholds of the computing device. The computing device may determine an attachment is embedded with a macro. The macro may be associated with a visual basic application (VBA) and contain malicious code. Based on the determination, the computing device may initiate a security protocol, including notification via a user interface of the device.