Patent Application
20240054214
This system is directed to a computerized system for the detection and remediation of potential and actual unauthorized access to an electronic message system by analysis of outbound addresses and domains associated with a potential recipient.
The use of electronic messages, especially email, is prevalent in today's society. It is estimated that billions of emails are sent per day. Email is being used for several purposes including personal communications, business communications, marketing, advertising, multi-party communications, collaboration, transmitting attachments, document or any other information interactions, and many other uses. Because of its increased use as well as the increase in security risks with modern communications, a system that can assist with the identification of security risks, analysis of weaknesses and the ability to provide recommendations would be desirable.
Some of the undesirable uses of email addresses by those such as hackers can include phishing attempts, spam, attempts to obtain financial and personal information, and other undesirable or even illegal activities. Generally, phishing refers to an attempt to gather private, confidential, or protected information by social engineering which seeks to have potential victims disclose sensitive information under false pretenses. Phishing attacks are usually carried out via communication channels such as email or instant messaging by fraudulent or misleading actors posing as legitimate and trustworthy entities so that the victim “trusts” the bad actor and discloses such information. It is desirable to identify risks that can lead to successful phishing attempts and provide preventive measures so that these attempts can be reduced if not eliminated.
The “industry” of spam, phishing, penetration, and other attacks rely upon mass emails being sent to a user in an attempt to gain access to the recipient's account. It has been reported that 3.4 billion phishing emails are sent each day worldwide and 45.37% of all emails sent in 2021 were phishing emails. Phishing attempts are one of the more severe and widespread type of cybercrime reported. The same report stated that approximately 90% of all data breaches are the result of successful phishing attempts.
Spammers and hackers use a variety of tools to obtain emails addresses so that an undesirable message can be sent to such users. The gathering of email addresses can include crawling websites looking for the “@” sign resulting in the harvest of the email. For example, if a website includes a “Contact Us” field and there is an associated link to this text to contact@company.com, the email address contact@company.com will most likely be included in an email list used by, traded, sold, and transferred to spammers and other entities. Further, hackers, including spammers, can breach a message system and use the message system for any number of undesirable actions. One such action is to access a content list and add these to a spam list. Another action is to use the breached message system for sending large amounts of electronic mailings to those on your contact list as well as to recipients unknown to the actual sender. These unauthorized emails sent from the sender message system can be used for phishing, seek sensitive information, defeat multifactor authentication, degrade online reputation, identify theft, impersonate the actual account holder and more. It would be advantageous to determine when an account or message system has been breached and implement an appropriate response when such a breach is detected or suspended.
There have been attempts to automatically filter or identify undesirable electronic messages such as shown in U.S. Pat. No. 9,501,746 which discloses a system related to detecting bad actors impersonate other people's identity in order to increase the likelihood of recipients opening those bad actors' messages and attachments. This patent states that this undesirable activity is generally referred to as “phishing” and specifically “spear phishing” when the recipient is targeted by the fake sender who is referred to as a “phisher.” This patent also states that these phishers send these “fake emails” seeking to increase their likelihood of successfully gaining unauthorized access to confidential data, trade secrets, state secrets, military information, and other information. The motivation of these phishers is typically for financial gain through fraud, identity theft and/or data theft as well as those which wish to disrupt normal operations. Phishing attempts have been associated with private entities as well as being state sponsored and even from foreign governments themselves.
One attempt to detect and/or handle targeted attacks is shown in U.S. Pat. Nos. 9,686,308 and 10,181,957 which disclose a system for detecting and/or handling target attacks in an enterprise's email channel. This patent discloses receiving aspects of an incoming electronic message addressed to a first email account holder, selecting a recipient interaction profile and/or a sender profile from a plurality of predetermined profiles stored in a memory, determining a message trust rating associated with the incoming email message based upon the incoming email message and the selected recipient interaction profile and/or the sender profile; and generating an alert identifying the incoming email message as including a security risk based upon the determined message trust rating. However, these techniques are limited to the message being received by the electronic message system and limited to the relationship between the sender and the recipient. It would be advantageous to have a system that can reduce the risks of such attacks and other security risks so that the email owner's security protection can be increased.
Another attempt to detect, prevent, and provide notification of phishing attempts is shown in U.S. Pat. No. 10,404,745 which discloses the use of natural language techniques and information present in an email (namely the header, links, and text in the body) to detect phishing. This system is limited to an analysis of the email itself and occurs once the phishing attempt or attack has been initiated. It would be advantageous to reduce the ability of a phishing attempt to occur in the first place, rather than an “after-the-fact” solution as in the prior art.
One attempt to prevent online fraud is shown in U.S. Pat. No. 10,628,797 that states that the system can receive and categorize incoming email messages and attempts to determine that the incoming email is being used to attempt an unauthorized access to data, accounts, information, and the like. However, this system focuses on the incoming email message and cannot determine if the target message system has been breached.
Historically, attempts to prevent breaches are just that, preventive and have not been focused on detecting breaches or other unauthorized access. Such attempts have focused on incoming attempts and devices. U.S. Pat. No. 9,916,481 states that it is systems and methods for detecting the loss, theft, or unauthorized use of a device and/or altering the functionality of the device in response. The system described in this reference reacts to a detection that a security compromise event has occurred for a mobile device, not an electronic message system, local or enterprise wide.
As shown above, email protection strategies are not as simple as subscribing to a spam filter and require a layered approach, which reduces risks. Generally, the more layers, the greater the reduction in risk. Layers include the systems, techniques, frameworks, and other methods discussed above. Further, changes in the email system can result in one or more of the installed schemes being changes, outdated, improperly configured or otherwise less than optimal. Understanding what is installed, configured, and properly operating would be beneficial for the reduction in the risks associated with email communications.
Therefore, it is an object of the system to provide for a system that can determine if the recipient is attempting to send an electronic message to a detection email address potentially indicating that an unauthorized access has occurred.
It is another object of the system to provide a response to actual or potential unauthorized access of an electronic system.
The construction designed to carry out the invention will hereinafter be described, together with other features thereof. The invention will be more readily understood from a reading of the following specification and by reference to the accompanying drawings forming a part thereof, wherein an example of the invention is shown and wherein:
With reference to the drawings, the invention will now be described in more detail.
Referring to
The gateway system can analyze or receive one or more outbound electronic messages 104. In any case, the gateway system can retrieve from the header, or other information, the intended recipient of the outbound electronic message. The electronic message system can then determine the recipient location or path associated with delivery of the message using a DNS server 108. If delivery is permitted, the electronic message can be sent to the recipient domain 110 and on to the recipient message system 112. In one embodiment, the outbound electronic message 104 can be modified by the gateway system or an application programming interface along the travel path so that an altered message is transmitted to the recipient message system 112. The altered message can be delivered to the recipient account 114 and accessed by the recipient client 116 or other access such as webmail 118.
Referring to
The gateway system can determine the domain of the intended recipient and determine if this is a valid email or not according to several methods. In one embodiment, the gateway system can seek to retrieve the MX record associated with the “domain.com,” such as with computer readable instructions combined with a computer system. It results in a message system domain name verification computer by implementing the following commands, in one example:
If the response to gateway system includes an IP address, the gateway system can determine that the domain is in existence by attempting to receive information from a system such as DNS server 208. If the response represents that the domain name is not in existence, then the gateway system can determine that the sender message server is attempting to send an email to a non-existent recipient and that the sender message system may be subject to an unauthorized access. The gateway system may also determine that the domain is invalid as being geographically disallowed. The gateway system can also have a threshold that if a predetermined number of recipient domains are non-existent or invalid, that the sender message server can be subject to unauthorized access.
In one embodiment, the gateway system can determine that the email address has a valid domain, but the recipient (e.g., username) is invalid. In this case, the message can be delivered to the intended recipient message system and the recipient message system can indicate that the username is not valid or that the user account does not exist. The gateway system can calculate and track the number of undeliverable responses received from the intended recipient's message system. An error message can include one or more of the following, according to configuration of the recipient message system:
The gateway system can create bait user accounts that have bait email addresses and publish these to one or more websites. For example, the gateway system can access a website and modify an email address periodically to include a bait email address. For example, the gateway system can auto generate email address such as bait-A@domain.com. This generated email address has certain properties that can include that it has not been previously used. The generated email address may not match the pattern of email addresses that are used for the sender message system. For example, if usernames are first initial and last name, the example generated email address does not match this pattern. The generated email access could be a generic username such as info@, help@, support@, contact@, and the like. Typically, spammers and hackers are attracted to these accounts. The generated email may include a subdomain such as @company.bait.com. The gateway system can generate these email addresses or can receive these from an outside source. In one embodiment, the gateway system can access databases of other sources of bait email such as other spam or “honey pot” system that have identified certain email addresses as bait emails.
Once generated or received, in one embodiment, the gateway system can publish the email address in a number of ways. In one embodiment, the gateway system can access the website under the domain company.com and add the generated address to the website. When a spammer or hacker is scraping the email address, the generated email address will likely be found and added to a distribution list of the spammer or hacker. For example, the website can include the following HTML code:
In one embodiment, the generated email can be placed on the website with the same font, foreground, background, and highlighted color so that a spammer or hacker would find the generated email, but the email is not visible to a human user. The gateway system can also update a separate webpage, such as one associated with the sub domain, indexing is disabled to further conceal the generated email address.
In one embodiment, the gateway system can access an existing listing of bait email addresses though a third-party database. The gateway system can either provide the third-party database with the generated email or use an email that is generated by the third party.
When the gateway system determines that the sender account is being used to send a generated email or other bait email, it can indicate that the sender account has been subject to unauthorized access. In this case, the gateway system can take any number of actions including the following:
Referring to
During the process of analyzing the email that the sender message system has attempted to send, the gateway system can analyze components of header seeking information about the recipient.
From an analysis of the information for this email header, it can be seen that the intended recipient is recipient@companytwo.com.
Referring to
The gateway system can also be connected to multiple message systems and multiple domains. Referring to
Referring to
Referring to
The determination of sensitive content or attachment can be determined by the content itself, information in a subject line, keywords, message header information, file names, file types, attachment types, and any number of methods.
When the message or attachment is sent out of band to the remote storage locations, a storage message can be sent to the account holder at 704 that can arrive in the inbox alerting the account holder that sensitive content or attachment was intended for the account holder but was placed on remote secure storage and not delivered to the inbox. The account holder can then take action to retrieve the message or content at 706. If the account holder wishes to retrieve the message or attachment, the account holder can send a reply message, access a third-party site, sent an original message, provide validation, provide multifactor authentication, and others and any number of combinations of these methods. The message can be delivered to the account holder at 708. The remote storage location can have perimeters concerning the storage sensitive messages, content and attachments that can include additional identification for retrieval, autodeletion upon failed attempts, autodeletion upon some period of time and any combination.
The system described herein is directed to a series of acts that can protect a computer or computer system from electronic communication that may contain malicious code of other undesirable content. The computerized system is one that is at least directed to a process. The system can identify and potentially isolate electronic messages in an electronic message system according to the edge value and/or the confidence values. The edge value and confidence values associated with a sender or electronic message can be stored in a database that can be accessible by a second analytical computer system that does not have to be in direct communications with the first analytical computer system. The processes and procedures that are described herein can be actuated by a computer processor that executes computer readable instructions to provide the functionality herein.
It is understood that the above descriptions and illustrations are intended to be illustrative and not restrictive. It is to be understood that changes and variations may be made without departing from the spirit or scope of the following claims. Other embodiments as well as many applications besides the examples provided will be apparent to those of skill in the art upon reading the above description. The scope of the invention should, therefore, be determined not with reference to the above description, but should instead be determined with reference to the appended claims, along with the full scope of equivalents to which such claims are entitled. The disclosures of all articles and references, including patent applications and publications, are incorporated by reference for all purposes. The omission in the following claims of any aspect of subject matter that is disclosed herein is not a disclaimer of such subject matter, nor should it be regarded that the inventor did not consider such subject matter to be part of the disclosed inventive subject matter.
This application claims priority from U.S. Provisional Patent Application 63/398,142 filed Aug. 15, 2022, U.S. Provisional Patent Application 63/398,137 filed Aug. 15, 2022, U.S. Provisional Patent Application 63/398,132 filed Aug. 15, 2022, U.S. Provisional Patent Application 63/398,127 filed Aug. 15, 2022, and U.S. Utility patent application Ser. No. 17/883,941 filed Aug. 9, 2022, each incorporated herein by reference.
| Number | Date | Country | |
|---|---|---|---|
| 63398142 | Aug 2022 | US |
