User-Device Malicious Message Detection with Pre-Arrival Hashes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems fail to effectively detect malicious messages due to insufficient information for assessing message legitimacy, allowing malicious actors to circumvent filters and deceive users.
Innovation Solution
Utilizing an external secure communication channel to provide additional message information to a computing device, enabling detection of malicious messages through comparison with known message hashes, timestamps, and formatting, and employing machine learning models to verify message authenticity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional spam or phishing email filters are used to detect malicious messages, then message filtering is provided, but the filters frequently fail to detect malicious messages because they lack sufficient information to assess message legitimacy
Solution Approach 1:
The system performs preliminary actions by obtaining message information (hashes, timestamps, formatting data) from external communication channels before the actual message arrives. This advance preparation enables the filtering system to have reference data ready for immediate comparison when the message is received, eliminating the information deficit that causes conventional filters to fail.
Solution Approach 2:
The patent introduces an intermediary external communication channel that provides message information between the message source and the filtering system. This intermediary delivers additional contextual data (hashes, timestamps, formatting) that bridges the information gap, allowing the filter to assess message legitimacy more accurately without relying solely on the message content itself.
2Reliability
If message information is sent to a server for analysis, then malicious messages can be detected, but network bandwidth and server processing power are consumed and user privacy is reduced
Solution Approach 1:
The filtering system performs self-service by conducting all detection operations locally on the user device using the message information obtained from external channels. The device independently compares incoming messages against the pre-obtained reference data (hashes, timestamps, formatting) without requiring server intervention for each message analysis. This eliminates continuous network communication and server processing requirements, reducing energy consumption while maintaining detection reliability.
Solution Approach 2:
By obtaining message information in advance through external channels and storing it locally on the user device, the system prepares all necessary detection data beforehand. This preliminary action enables the device to perform autonomous detection without needing to query servers during message reception, thereby eliminating ongoing network bandwidth usage and server processing demands.
3Adaptability or versatility
If conventional filtering systems are used, then message filtering is provided, but malicious actors can easily circumvent filters by creating new imitation messages
Solution Approach 1:
The system implements feedback by continuously obtaining updated message information from external communication channels and comparing it against incoming messages. This feedback mechanism ensures that the filtering system adapts to new message formats and content from legitimate sources, making it difficult for malicious actors to create undetected imitation messages. The system learns from legitimate message patterns and uses this knowledge to identify anomalies.
Solution Approach 2:
The patent employs parameter changes by obtaining message information including hashes, timestamps, and formatting data that can vary based on legitimate message characteristics. By comparing multiple parameters rather than relying on a single filtering rule, the system becomes highly adaptable to different message types and formats while maintaining the ability to detect imitations. This multi-parameter approach increases complexity only as needed to match legitimate message diversity.
Data Source
AI summary
A user device may obtain message information that includes a first hash that was generated based on a portion of a future message that will be sent to the user device. The user device may determine whether new messages received at the user device appear to be associated with a corresponding entity. If a new message appears to be associated with the entity, the user device may use the message information to confirm whether the new message is malicious. Based on determining that the new message is malicious, the user device may display a notification to a user or perform a variety of other actions.