Phishing Detection via Key Content Segments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to effectively identify and quarantine malicious communications in multiple message stores, particularly due to variations in phishing messages that can evade detection using exact content searches.
Innovation Solution
The system employs a threat detection system with a phishing message search engine that processes reported malicious messages to extract plain text, selects key content segments, and executes searches across messaging systems using match criteria to identify and quarantine corresponding malicious messages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If exact content search is used to identify malicious messages, then detection precision is improved, but phishing messages with variations can evade detection
Solution Approach 1:
The patent segments the malicious message content into multiple distinct components or features (e.g., subject line patterns, body text characteristics, metadata attributes). By dividing the search into multiple feature-based queries rather than relying on a single exact content match, the system can detect variations of phishing messages that share common characteristics while maintaining precision through multi-criteria matching.
2Adaptability or versatility
If multiple search queries are executed to identify all malicious message variations, then detection coverage is improved, but processing time increases
Solution Approach 1:
The system performs preliminary actions by pre-processing and indexing message content into searchable features before actual detection occurs. When a malicious message is identified, the pre-organized feature structure allows for rapid generation and execution of multiple targeted queries without the overhead of processing entire messages from scratch, thus achieving comprehensive coverage with reduced processing time.
3Adaptability or versatility
If comprehensive search criteria are applied to identify all malicious messages, then detection coverage is improved, but false positives increase
Solution Approach 1:
The patent applies different weightings or thresholds to different search criteria based on their reliability and specificity. Critical features that are highly indicative of phishing (such as specific suspicious patterns or known malicious indicators) are given higher weight, while less specific features are weighted lower. This localized quality adjustment allows comprehensive coverage while maintaining high reliability by emphasizing the most discriminative features.
Data Source
AI summary
Systems and methods are described for identifying other instances of messages corresponding to a reported malicious message. A report of a malicious message from a user of a plurality users using a messaging system is received. Responsive to the report of the malicious message, plain text of content selected from the malicious message is provided. Thereafter, one or more segments of the plain text are selected as key content for construction of a search. A search is then executed in the messaging system for one or more other malicious messages corresponding to the reported malicious message using the selected one or more segments of the plain text with one or more match criteria or no criteria. The one or more other malicious messages corresponding to the reported malicious message are identified in the messaging system.