Malware detection system based on stored data
A malware detection system based on stored data that analyzes an electronic message for threats by comparing it to previously received messages in a message archive or to a contacts list. Threat protection rules may be generated dynamically based on the message and contacts history. A message that appears suspicious may be blocked, or the system may insert warnings to the receiver not to provide personal information without verifying the message. Threat checks may look for unknown senders, senders with identities that are similar to but not identical to previous senders or to known contacts, or senders that were added only recently as contacts. Links embedded in messages may be checked by comparing them to links previously received or to domain names of known contacts. The system may flag messages as potential threats if they contradict previous messages, or if they appear unusual compared to the patterns of previous messages.
1. A malware detection system based on stored data, comprising:
a messaging system database comprising at least one or more computing devices for storing at least one of an archive of electronic messages, a contacts list, and summary data derived from one or more of said archive of electronic messages and said contacts list,
wherein said archive of electronic messages comprises electronic messages previously sent, received, and/or drafted, and wherein said summary data comprises a consolidation of information from said message archive of electronic messages and said contacts list; and
a message filter comprising a computing device configured to communicate and exchange data with said messaging system database and configured to:
receive an electronic message from a sender comprising one or more message parts, said message parts comprising sender information, recipient information, message contents, a subject line, one or more attachments, one or more links to web sites, and a message thread;
determine whether said electronic message represents a potential threat based, at least in part, on an analysis of said message parts and said messaging system database, said analysis is based, at least in part, on one or more of pattern analysis, parsing, classification, trend analysis, statistical analysis, and artificial intelligence;
wherein said computing device of said message filter is configured to classify said electronic message as a potential threat when either:
a length of time said sender having been in said contacts list falls below a threshold value; or
when said electronic message requests said user to perform an action that has never been requested in any prior received message from said archive of electronic messages from said sender;
wherein, when said electronic message is determined to represent a potential threat, said computing device of said message filter is further configured to either entirely block access to said electronic message or to one or more of said message parts, thereby preventing said user from accessing said electronic message, or transform said electronic message to provide a warning to a user who attempts to access said electronic message or attempts to access said one or more message parts by inserting text or graphic warning about a potential threat into at least one of a subject line and/or message contents of said electronic message and/or by transforming a link to a website included in said electronic message to a protected link configured to display a warning alert to said user prior to connecting to said website upon a user clicking said protected link and further configured to provide said user with an option to proceed to said website and an option to not connect to said website, wherein said website warning comprises a warning to said user not to provide personal information to said website;
wherein said computing device of said message filter is configured to:
identify personal, sensitive, or confidential information in said one or more message parts; and
transform said electronic message to protect said personal, sensitive, or confidential information if said personal, sensitive, or confidential information is present in said one or more message parts, said transforming comprises transforming said personal, sensitive, or confidential information into an encoded form.
2. The malware detection system of claim 1 , wherein said personal, sensitive, or confidential information is identified using natural language processing.
3. The malware detection system of claim 1 , wherein said personal, sensitive, or confidential information is identified by tags inserted into said electronic message by said sender.
4. The malware detection system of claim 1 , wherein said transforming said electronic message to protect said personal, sensitive, or confidential information comprises determining whether one or more receivers is authorized to receive said personal, sensitive, or confidential information; and warning said sender or removing a receiver from said electronic message if said receiver of said one or more receivers is not authorized to receive said personal, sensitive, or confidential information, or warning said sender and removing said receiver from said electronic message.
5. The malware detection system of claim 4 , wherein said removing said receiver from said electronic message further comprises:
identifying an alternate email address for said receiver, wherein said alternate email address is authorized to receive said personal, sensitive, or confidential information; and
adding said alternate email address as a new receiver of said electronic message.