Message Scanning via Destination Reputation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Electronic messaging systems face vulnerabilities due to the lack of real-time scanning, allowing new malware to infect systems before updated definitions are available, leading to a window of exposure where messages may not be detected during transport or receipt.
Innovation Solution
Implementing a method that scans messages stored in a message store using the latest malware definitions, prioritizing high-risk messages and destinations, and utilizing a reputation-based system to optimize scanning efficiency and effectiveness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If messages are scanned during transport and receipt using traditional malware definitions, then existing malware can be detected, but new malware released after the last definition update cannot be detected, creating a window of vulnerability
Solution Approach 1:
The system performs preliminary scanning of messages in the message store before users retrieve them, using the latest malware definitions. This advance scanning action ensures that even if new malware is introduced after transport scanning, it will be detected before the user accesses the message, thereby eliminating the vulnerability window.
2Reliability
If all messages are scanned with the latest malware definitions before user access, then new malware can be detected, but the scanning time and system resources required increase significantly
Solution Approach 1:
The system applies different scanning strategies to different messages based on their characteristics. High-priority messages (from unknown senders, with suspicious attachments, or marked as important) are scanned with the latest malware definitions before user access, while low-priority messages rely on transport scanning. This localized quality approach ensures comprehensive protection for critical messages while minimizing unnecessary scanning of routine messages.
Solution Approach 2:
Instead of scanning all messages equally, the system performs partial scanning by focusing resources on high-risk messages that require the latest malware definitions. This partial action approach concentrates scanning efforts where they are most needed, reducing overall scanning time while maintaining high protection levels for vulnerable messages.
3Productivity
If messages are prioritized for scanning based on reputation and risk factors, then scanning efficiency is improved by focusing on high-risk content, but the complexity of the scanning system increases
Solution Approach 1:
The system changes the parameters used for message prioritization by incorporating reputation scores, sender history, message content analysis, and attachment type evaluation. Messages are assigned priority levels based on these parameters, with high-priority messages receiving pre-access scanning. This parameter-based prioritization improves scanning efficiency by focusing resources on the most vulnerable messages while adding manageable complexity through structured evaluation criteria.
Data Source
AI summary
Methods, computer program products, computer systems, and the like, which protect messages in an electronic messaging system, are disclosed. The methods, computer program products, computer systems, and the like include detecting an occurrence of an event, and, in response to the detecting the occurrence of the event, scanning a message. The occurrence of the event indicates that the message should be scanned. The message includes recipient information, which identifies a recipient of the message, and is stored in a message store. The message has been received at a message destination associated with the recipient. The scanning uses a malware definition. The scanning is performed prior to the message being retrieved from the message store in response to a request by the recipient to retrieve the message from the message store. The event is other than the request by the recipient to retrieve the message from the message store.