Message Change Detection for Phishing Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing message security systems fail to detect changes in URLs within messages, such as those made using CSS modifications, which can lead to malicious links being overlooked by spam and security filters, potentially allowing phishing attacks.
Innovation Solution
An information processing apparatus that includes a notification unit to alert users when a received message has changed, utilizing a difference extraction module to compare the original message with the presented message, specifically storing the initial message state and performing a comparison to identify and notify of URL changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If message filtering systems are used to block spam and malicious content, then message security is improved, but attackers can alter messages after reception to bypass filters
Solution Approach 1:
The system performs preliminary actions by storing a snapshot of the message content at the time of reception before any potential alterations occur. This preliminary record serves as a reference point to detect subsequent changes, allowing the system to identify malicious modifications even after the message has been delivered and potentially altered by attackers.
Solution Approach 2:
The system implements feedback by continuously monitoring message content for changes and comparing current state against the stored snapshot. When changes are detected, the system provides feedback through notifications to users and can trigger security responses, creating a closed-loop security mechanism that adapts to detected threats.
2Measurement precision
If message content is monitored and stored for security checking, then detection capability is improved, but system complexity increases
Solution Approach 1:
The system extracts only the essential message content data needed for comparison purposes, storing it in a simplified snapshot format rather than implementing complex continuous monitoring of all message attributes. This extraction approach maintains high detection precision by capturing key change indicators while avoiding the complexity of monitoring every possible message parameter.
Data Source
AI summary
An information processing apparatus includes a notification unit that notifies that a received message has changed after reception or browsing of the message. In a further modification of the invention, the message may include a character string for guide to another link destination, and transfer to the link destination having undergone a change may be disabled.