Method and system for misuse detection
View Patent ↗This disclosure discusses methods, systems, and an apparatus that can determine whether email content is potentially malicious, contains potentially malicious content, has originated from a potentially malicious entity, or contains links or other references to potentially malicious web content. The disclosure discusses some embodiments that include evaluating text in the email content to determine if predetermined suspected malicious phrases are present in the text, evaluating one or more links in the email content using an IP address, URL, or DNS to determine if the links reference potentially malicious web content, and evaluating metadata in the email content to determine if the email content is potentially malicious.
1. A method for determining whether email content is potentially malicious, contains potentially malicious content, has originated from a potentially malicious entity, or contains links or other references to potentially malicious web content, comprising:
evaluating text in the email content to determine if predetermined suspected malicious phrases are present in the text;
evaluating at least one link in the email content using at least one of an IP address, URL, and a domain name to determine if said at least one link references potentially malicious web content, the evaluating being a two step process of performing an initial analysis based on existing identification information about the at least one link, which includes IP address, URL, and the domain name, before accepting a remaining portion of the email content, which includes message body data; and
evaluating metadata in the email content to determine if the email content is potentially malicious;
using and configuring a scoring engine for a scoring process by providing a page score for a digital document representing a likelihood that the digital document includes potentially malicious content, the scoring engine uses a Word Expression equation, which includes at least one variable to represent a number of occurrences of at least specific keywords, and patterns in the potentially malicious content in the digital document, the using and configuring the scoring engine includes comparing information extracted from the digital document and forwarding the digital document for analysis and review, and the scoring engine providing at least one of realtime and post-production evaluation of the digital document and provides an output value, including the page score.
2. The method of claim 1 , further comprising:
determining whether the evaluated metadata indicates that the email content originated from a suspicious entity, including at least one of a suspicious individual, organization, and a geographic region.
3. The method of claim 1 , further comprising:
evaluating at least one of an embedded link contained in a hyperlink, an image file, a video file, and an audio file.
4. The method of claim 1 , further comprising:
evaluating whether potentially malicious downloadable content attached to the email content is malicious.
5. The method of claim 1 , further comprising:
evaluating the email content remotely by a third party entity.
6. The method of claim 1 , further comprising:
evaluating the email content by a third party entity that monitors email content traffic directly filtered through a sub-system of the third party entity.
7. The method of claim 1 , further comprising:
evaluating the email content by an application running on the machine that one of receives and displays the email content.
8. A system for determining whether email content is potentially malicious, contains potentially malicious content, has originated from a potentially malicious entity, or contains links or other references to potentially malicious web content, comprising:
a first module determining if the email content contains predetermined suspected malicious phrases, the first module includes a scoring engine, a security device, at least one mail server, and an intelligence database;
a second module determining if at least one link in the email content references potentially malicious web content using at least one of an IP address, URL, and domain name, the second module including a search engine, the security device, the email crawler, a web crawler, and the exclusion processor,
the determining being a two step process of performing an initial analysis based on existing identification information about said at least one link, which includes IP address, URL, and the domain name, before accepting a remaining portion of the email content, which includes message body data; and
a third module evaluating metadata in the email content to determine if the email content is potentially malicious, the third module includes a scoring engine, the security device, and the email crawler,
the scoring engine performing a scoring process and providing a page score for a digital document to represent a likelihood that the digital document includes potentially malicious content, the scoring engine using a Word Expression equation, which includes at least one variable to represent a number of occurrences of at least specific keywords, and patterning in the potentially malicious content in the digital document,
the scoring engine comparing information extracted from the digital document and forwards the digital document for review and analysis, and
the scoring engine providing at least one of real-time and post-production evaluation of the digital document and provides an output value, including the page score.
9. The system of claim 8 , wherein the third module also determines whether the evaluated metadata indicates that the email content originated from a suspicious entity, including at least one of a suspicious individual, organization, and a geographic region.
10. The system of claim 8 , wherein the second module evaluates at least one of an embedded link contained in a hyperlink, an image file, a video file, and an audio file.
11. The system of claim 8 , wherein a fourth module evaluates whether potentially malicious downloadable content attached to the email content is malicious.
12. The system of claim 8 , wherein the email content is evaluated remotely by a third party entity.
13. The system of claim 8 , wherein the email content is evaluated by a third party entity that monitors email content traffic directly as the email content is filtered through a sub-system of the third party entity.
14. The system of claim 8 , wherein the email content is evaluated by an application running on the machine that one of receives and displays the email content.
15. An apparatus for determining whether email content is potentially malicious, contains potentially malicious content, has originated from a potentially malicious entity, or contains links or other references to potentially malicious web content, comprising:
a first module determining if the email content contains predetermined suspected malicious phrases, the first module including a scoring engine, a security device, at least one mail server and an intelligent database;
a second module determining if at least one link in the email content references potentially malicious web content using at least one of an IP address, URL, and a domain name, the second module including a search engine, the security device, the email crawler, a web crawler, and the exclusion processor, the determining being a two step process of performing an initial analysis based on existing identification information about said at least one link, which includes IP address, URL, and the domain name, before accepting a remaining portion of the email content, which includes message body data; and
a third module evaluating metadata in the email content to determine if the email content is potentially malicious, the third module includes a scoring engine, the security device, and the email crawler, the scoring engine performing a scoring process and providing a page score for a digital document to represent a likelihood that the digital document includes potentially malicious content, the scoring engine using a Word Expression equation, which includes at least one variable to represent a number of occurrences of at least specific keywords, and patterning in the potentially malicious content in the digital document, the scoring engine comparing information extracted from the digital document and forwards the digital document for review and analysis, and the scoring engine providing at least one of real-time and post-production evaluation of the digital document and provides an output value, including the page score.
16. The apparatus of claim 15 , wherein the third module also determines whether the evaluated metadata indicates that the email content originated from a suspicious entity, including at least one of a suspicious individual, organization, and a geographic region.
17. The apparatus of claim 15 , wherein the second module evaluates at least one of an embedded link contained in a hyperlink, an image file, a video file, and an audio file.
18. The apparatus of claim 15 , wherein a fourth module evaluates whether potentially malicious downloadable content attached to the email content is malicious.
19. The apparatus of claim 15 , wherein the email content is evaluated remotely by a third party entity.
20. The apparatus of claim 15 , wherein the email content is evaluated by a third party entity that monitors email content traffic directly as the email content is filtered through a sub-apparatus of the third party entity.
21. The apparatus of claim 15 , wherein the email content is evaluated by an application running on the machine that one of receives and displays the email content.