Network Perimeter Phishing Detection via Vertex-Edge Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems for detecting and preventing phishing attempts are limited, as they primarily focus on message content and sender-recipient relationships, failing to provide comprehensive enterprise-wide protection and often allow malicious emails to reach recipients, and do not effectively intercept emails at the network perimeter.
Innovation Solution
A computerized system that analyzes electronic messages at the network perimeter by designating senders and recipients as nodes in a relationship network, determining edge values based on various attributes, and performing actions such as filtering or quarantining messages, using confidence values generated from these analyses to identify and mitigate phishing attempts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current phishing detection systems analyze only message content and sender-recipient relationships, then the system complexity is reduced, but the detection accuracy and enterprise-wide protection capability deteriorate
Solution Approach 1:
The system segments the analysis into multiple independent components: vertex analysis (sender/recipient profiles), edge analysis (relationship characteristics), and confidence value calculation. Each component processes specific attributes separately before integrating results, making the complex detection task manageable while improving accuracy through comprehensive multi-factor analysis
Solution Approach 2:
The patent transitions from traditional two-dimensional analysis (sender-recipient pairs and message content) to a three-dimensional framework by introducing relationship network edges as a separate dimension. This adds the dimension of relationship characteristics between vertices, enabling detection based on patterns across multiple dimensions simultaneously
2Loss of time
If the system intercepts emails at the network perimeter rather than at the message server, then the protection timing is improved, but the integration with existing email infrastructure becomes more complex
Solution Approach 1:
The system introduces an intermediary analysis layer between the network perimeter and the message server. Rather than directly modifying the email server infrastructure, the system acts as a mediator that receives emails at the perimeter, performs comprehensive analysis using vertex and edge data, and then makes filtering decisions, thereby improving timing without deeply integrating with complex server infrastructure
Solution Approach 2:
The system performs preliminary analysis of vertices and edges before email delivery to the message server. By pre-establishing relationship networks and confidence values in advance, the system can make rapid interception decisions at the perimeter without requiring complex real-time integration with the email server during message delivery
3Measurement precision
If the system uses comprehensive attributes (IP address, geographic region, velocity, attachments, encoding) to determine edge values, then the detection precision is improved, but the data processing requirements and system complexity increase
Solution Approach 1:
The system transforms diverse data types (IP addresses, geographic locations, message velocity, attachment properties, encoding methods) into a unified parameter space of edge values. By converting these varied attributes into comparable numerical values that can be aggregated and analyzed together, the system handles complex multi-type data systematically without overwhelming processing complexity
Solution Approach 2:
The patent merges multiple separate analysis functions into a unified vertex-edge-confidence framework. Instead of processing IP addresses, geographic data, velocity metrics, attachment analysis, and encoding detection as separate independent systems, the invention combines all these data sources into integrated vertex and edge representations that work together cohesively
Data Source
AI summary
A computerized system for analysis of vertices and edges of an electronic messaging system comprising: an analytical computer system configured to: receive an electronic message at the network perimeter and sent from a sender's electronic message system outside the perimeter wherein the electronic message is associated with a sender identity and a designated recipient wherein the recipient is within a network perimeter, designating the sender as a first node in a relationship network, designating the recipient as a second node in the relationship network, designating a historic communications pattern between the sender and the recipient as a third node, calculating a confidence value according to the first node, the second node and the third node. The system can create nodes and edges as part of a initial installation or can be connected to an existing system wherein historical data can be used to create nodes and calculate edges values.