Phishing Detection via MTA Map Signature Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting phishing emails is challenging due to their similarity to legitimate emails, leading to high false positives, and the constant relocation of phishing sites complicates URL analysis.
Innovation Solution
Creating a message transfer agent (MTA) map that connects points based on emails with similar signatures, identifying reference MTA groups, and detecting phishing by identifying MTAs that send emails with signatures matching those of groups they do not belong to.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If phishing emails are detected by analyzing email content using pattern matching, then phishing detection capability is improved, but false positive rate increases to unacceptable levels
Solution Approach 1:
The patent segments the email authentication process into multiple independent components: SPF domain verification, MTA path validation, and signature matching. Each component operates separately and contributes to the overall authentication decision, allowing precise detection without triggering false positives from single-factor analysis
Solution Approach 2:
The patent introduces an intermediary MTA map that records and validates the communication path between MTAs. This intermediary structure acts as a mediator to verify whether emails follow legitimate routing patterns, reducing false positives by confirming path authenticity rather than relying solely on content analysis
2Measurement precision
If phishing detection relies on URL analysis, then phishing site identification is improved, but effectiveness deteriorates due to constant relocation and increasing numbers of phishing sites
Solution Approach 1:
The patent performs preliminary actions by pre-establishing the MTA map with legitimate MTA relationships and email signature patterns before phishing detection is needed. This preliminary structuring of authentication data enables rapid verification of phishing attempts without requiring real-time URL analysis or adaptation to new phishing sites
Solution Approach 2:
The patent transitions from analyzing phishing sites in the URL dimension to verifying authentication in the MTA communication path dimension. By shifting the detection focus to email infrastructure validation rather than content or URL analysis, the system becomes adaptable to phishing site relocation and proliferation
Data Source
AI summary
Phishing is detected by creating a message transfer agent (MTA) map, with each point on the MTA map referencing an MTA. Points on the MTA map are connected based on a number of emails with same signature sent by MTAs represented on the MTA map. Reference MTA groups are identified from the map. Phishing is detected when an MTA sent an email with the same signature as that of emails sent by MTAs belonging to a reference MTA group but the MTA is not a member of the reference MTA group.