Reported Message Prioritization With Defanging and Impact Scores
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity systems struggle to prioritize reported phishing messages effectively, relying on phish identification scores that are based on a percentage of actual phishing messages, leading to inefficiencies in threat detection and analysis.
Innovation Solution
A method for prioritizing reported messages based on impact scores, involving conversion of malicious messages to defanged messages, tracking user interactions, and determining impact scores to prioritize user reporting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If organizations rely on employees to report suspected phishing messages, then security awareness is improved, but the volume of reported messages increases making prioritization difficult
Solution Approach 1:
The system implements feedback loops where users receive notifications about the status of their reported messages and the impact of their reports. This includes informing users when their reports lead to message blocking or when they are identified as reliable reporters, thereby reinforcing security awareness while managing report volume through engaged users
Solution Approach 2:
The system changes the parameter for prioritization from static phish identification scores to dynamic impact scores that evolve based on user reporting accuracy and message characteristics. This allows the system to adapt prioritization criteria as more data becomes available, improving both security awareness and analysis efficiency
2Measurement precision
If threat detection platforms analyze all reported messages, then detection accuracy is improved, but processing time and resources increase
Solution Approach 1:
The system segments reported messages into different priority levels based on impact scores, allowing threat detection platforms to focus detailed analysis on high-impact messages while applying faster, automated analysis to lower-impact messages. This segmentation maintains detection accuracy for critical threats while reducing overall processing time
Solution Approach 2:
The system performs preliminary filtering and scoring of reported messages before they reach the full threat detection platform. By pre-calculating impact scores and identifying obvious threats or false positives, the system prepares messages in advance, reducing the time required for comprehensive analysis when messages are prioritized
3Productivity
If phish identification scores are used for prioritization, then some filtering is achieved, but the scoring system is flawed and reduces reliability
Solution Approach 1:
The system fundamentally changes the prioritization parameter from flawed phish identification scores to impact scores that incorporate multiple factors including user reporting history, message characteristics, and verification outcomes. This parameter change directly addresses the reliability issue while maintaining prioritization functionality
Solution Approach 2:
The system implements feedback mechanisms where users are informed about the accuracy and impact of their reports over time. This feedback loop allows the system to learn from user performance and continuously refine the impact scoring system, improving both prioritization accuracy and user engagement
Data Source
AI summary
Systems and methods for prioritization of reported messages and rewarding reporting users are disclosed. The systems and methods leverage knowledge and security awareness of the most informed users in an organization to protect an organization from serious harm from new malicious messages, give credit to the most informed users, and optimize threat triage and analysis. The system converts a reported malicious message to a defanged message. The system communicates the defanged message to a plurality of users. The system determines an impact score for the user based on interactions with the defanged message by the plurality of users, and with the impact score gives credit to the reporter and optimizes threat triage and analysis.