Phishing Email Campaign Detection Using Normalized Attribute Hashes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to identify phishing emails from newly generated accounts with a clean sending reputation, as they rely on blacklisting methods that are easily circumvented by simple account creation, making it difficult to detect phishing campaigns effectively.
Innovation Solution
A method involving a computer-implemented process that normalizes specific attributes of emails within a phishing campaign, generates a hash representation, and compares it with stored hash representations to identify emails as part of a phishing campaign, using machine learning to detect patterns specific to the campaign.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If blacklisting methods are used to identify phishing accounts, then phishing messages from known accounts can be blocked, but phishing campaigns from newly generated accounts with clean sending reputation cannot be detected
Solution Approach 1:
The system performs preliminary analysis of email attributes and generates hash representations before phishing campaigns become widespread. By normalizing attributes and creating hash values in advance, the system can quickly identify and block phishing emails from newly generated accounts without relying on blacklists, thus detecting phishing campaigns at their inception rather than after accounts are blacklisted.
Solution Approach 2:
The system creates hash representations (copies) of email attribute patterns that can be stored and compared against future emails. Instead of tracking entire email contents or account histories, the system uses condensed hash copies of normalized attributes to efficiently identify phishing campaigns, allowing detection of patterned phishing emails from new accounts without requiring prior blacklisting.
2Object-affected harmful factors
If traditional virus scanning is used to analyze attachments and hyperlinks, then known malicious content can be identified, but phishing messages without attachments or hyperlinks cannot be detected
Solution Approach 1:
The system extracts and analyzes specific attributes from email messages independently of attachments or hyperlinks. By taking out key attributes (such as sender information, subject line patterns, email body characteristics) and normalizing them into hash representations, the system can detect phishing messages that contain no malicious code, attachments, or hyperlinks, thereby identifying phishing based on message characteristics rather than embedded threats.
Solution Approach 2:
Instead of detecting phishing by looking for malicious content within emails (the traditional approach), the system inverts the approach by detecting phishing through pattern analysis of normal email attributes. By analyzing what legitimate emails look like and identifying deviations through normalized attribute comparison, the system can detect phishing messages that appear superficially legitimate but follow phishing campaign patterns.
3Reliability
If account blacklisting is implemented, then phishing from established malicious accounts can be prevented, but resource usage increases and new phishing accounts are not identified
Solution Approach 1:
The system changes the parameter being monitored from account-level blacklisting to email attribute-level hash comparison. Instead of maintaining and querying large blacklist databases for every incoming email, the system normalizes email attributes and compares hash representations, which are computationally lighter and can be processed more efficiently, reducing resource usage while improving detection of new phishing accounts.
Solution Approach 2:
The system uses disposable hash representations of email attributes instead of maintaining persistent blacklist records. Each email is converted into a hash based on its normalized attributes, which can be quickly compared and discarded after use. This approach eliminates the need for long-term storage and maintenance of extensive blacklist databases, significantly reducing computational and storage resources while enabling detection of phishing from new accounts.
Data Source
AI summary
A computer-implemented method, executed by one or more email detection computers, receives from a computer network, a first email message from a first sender account to a first recipient account and having a plurality of attributes. The method determines that the first email message is a phishing email, extracts a subset of attributes, normalizes transformable attributes, and generates a hash representation from fixed attributes and the normalized transformable attributes, stores the hash representation in a database, receives a second email message, and determines that the second email message is a phishing email based on the stored hash representation.