Messaging Server Suspicious Message Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods are inefficient in detecting malicious electronic messages, such as spam and malware, as they take time to identify and counter botnet attacks, allowing malicious content to spread widely before detection.
Innovation Solution
A method involving a messaging server that extracts and records message sender and content features, using a database to track temporal patterns and classify messages as suspicious if the number of associated senders exceeds a threshold, potentially blocking or quarantining such messages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional antimalware systems or spam filters are used to detect botnet attacks, then detection accuracy is improved, but detection time is excessive allowing widespread propagation
Solution Approach 1:
The system performs preliminary actions by continuously monitoring and recording message sender features and content features in advance, building a database of normal communication patterns before botnet attacks occur. This allows the system to quickly compare incoming messages against established baselines and detect anomalies immediately, rather than waiting for signatures to be created after detection
Solution Approach 2:
The system implements feedback mechanisms by continuously analyzing message features, comparing them against recorded patterns, and adjusting detection thresholds based on the number of senders associated with specific content features. The feedback loop enables real-time adaptation to new attack patterns while maintaining accurate detection
2Speed
If the system monitors and analyzes message features from multiple senders in real-time, then detection speed is improved, but system complexity increases
Solution Approach 1:
The system segments the complex detection task into distinct components: extracting message sender features, extracting content features, recording features in a database, determining sender counts for specific content, and classifying messages as suspicious. Each component handles a specific aspect of the detection process, making the overall system more manageable and efficient
Solution Approach 2:
The patent introduces intermediary elements such as the database that stores message features and sender information, and the determining unit that acts as a mediator between feature extraction and classification. These intermediaries simplify the architecture by separating concerns and enabling modular processing of detection tasks
Data Source
AI summary
The disclosure relates to a method of detecting suspicious electronic messages. The method is performed in a messaging server which is in communication with a plurality of message senders and a plurality of message receivers, and comprises the steps of: receiving electronic messages sent from the plurality of message senders to at least one message receiver; extracting from each received message at least one message sender feature and at least one message content feature; recording the extracted message sender features and message content features in a database; determining, on the basis of the message content features recorded in the database, whether a specific content feature that can be associated with a current message has already been recorded in the past; if the specific content feature has already been recorded in the past, determining, on the basis of the message sender features recorded in the database, a number of message senders that can be associated with the specific content feature; and classifying the current message as suspicious if the determined number of message senders that can be associated with the specific content feature exceeds a predetermined threshold value. Also disclosed is a messaging server implementing the above described method.