Phishing Detection via Sender and Content Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing email filtering technologies are inadequate in detecting phishing attempts that appear legitimate, as they often rely on blacklist terms and struggle with customized scam messages that mimic trustworthy entities, making it difficult to protect users from fraud and spam.
Innovation Solution
A communication classification platform that assesses the likelihood of a message being associated with an authoritative entity by evaluating human-readable content, such as sender names, message text, and graphics, and matches it against a database of legitimate entities, while also checking for discrepancies in sender information and machine-readable indicators like digital signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If blacklisting terms is used to filter spam, then spam filtering is simple to implement, but it can be easily defeated by using alternative spellings or legitimate-sounding terms
Solution Approach 1:
The patent segments the email filtering process into multiple independent analysis components: header evaluation engine, content evaluation engine, and sender assessment engine. Each engine analyzes specific aspects of the email (headers, content, sender information) separately and combines results to make a comprehensive phishing determination, making the system more robust than simple blacklisting while maintaining implementability.
Solution Approach 2:
The patent introduces a verification service as an intermediary between email receipt and delivery to the user. This intermediary service performs comprehensive phishing analysis including DMARC verification, sender domain assessment, and content evaluation, acting as a mediator that filters out phishing attempts before they reach the user's inbox.
2Measurement precision
If comprehensive analysis of sender information and digital signatures is performed, then phishing detection accuracy is improved, but processing time and system complexity increase
Solution Approach 1:
The patent divides the complex phishing detection system into three specialized engines: header evaluation engine (handling DMARC, SPF, DKIM), content evaluation engine (analyzing message body and attachments), and sender assessment engine (evaluating sender domain and reputation). This segmentation makes the complex system more manageable and maintainable while achieving high detection accuracy.
Solution Approach 2:
The patent performs preliminary evaluation of obvious phishing indicators first (such as checking for missing DMARC signatures, suspicious sender domains, and blacklisted content) before conducting more complex analyses. This allows the system to quickly filter out clear phishing attempts without requiring full comprehensive analysis, reducing processing time for obvious cases while maintaining high accuracy.
Data Source
AI summary
Classifying electronic communications is disclosed. An electronic communication is received. A first likelihood that a potential recipient of the electronic communication would conclude that the communication was transmitted on behalf of an authoritative entity is determined. An assessment of a second likelihood that the received communication was transmitted with authorization from the purported authoritative entity is performed. The electronic communication is classified based at least in part on the first and second likelihoods.