Phishing Detection via Inverted Message Receipt Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing messaging security systems struggle to identify phishing accounts and malicious messages effectively, especially when the sending account has a clean sending reputation due to the ease of obtaining new accounts, which can be used for sending single malicious messages.
Innovation Solution
A method where a computing device receives an electronic digital message, identifies the sending account, and obtains metadata about the number of messages received by that account to determine if it satisfies a received message criteria, allowing for responsive actions such as quarantining or marking the account as potential phishing, even if it has a clean reputation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If blacklisting is used to identify phishing accounts, then known phishing accounts can be blocked, but new accounts with clean reputation cannot be detected
Solution Approach 1:
Instead of analyzing messages sent by an account (traditional approach), the patent analyzes messages received by the account. Phishing sender accounts typically receive very few or no messages, while legitimate accounts receive many messages. This inverted approach allows detection of new phishing accounts regardless of their sending history.
Solution Approach 2:
The system proactively checks the received message count of a sending account before delivering the message to the recipient. This preliminary verification allows the system to identify and block phishing messages from new accounts before they can cause harm, rather than waiting for the account to be added to a blacklist after sending multiple phishing messages.
2Reliability
If account verification is performed, then phishing messages can be blocked, but message delivery time increases
Solution Approach 1:
The received message count verification is performed as a preliminary check in the message delivery process. The system quickly queries whether the sending account has received a threshold number of messages and makes a blocking decision based on this single criterion, avoiding more time-consuming analysis methods.
Solution Approach 2:
The system applies different verification depths to different accounts based on their received message characteristics. Accounts that meet the threshold receive standard processing, while accounts below the threshold are immediately blocked without further analysis, optimizing the balance between security and speed.
Data Source
AI summary
Systems and methods for providing an improvement to computer security relating to electronic digital messages are provided. In an embodiment, a computing device receives an electronic digital message that is sent to a receiving account. The computing device identifies a sending account associated with the electronic digital message and from which the electronic digital message was sent. The computing device obtains metadata relating to the sending account, the metadata including received message data that is related to a number of messages that have been received by the sending account. The computing device determines that the sending account satisfies a received message criteria based, at least in part, on the received message data and, in response, performs a responsive action relating to the electronic digital message.