Granted Patent B2

US 12,388,846 · App. 18/191,614 · Granted Aug 12, 2025

Inventors: Jack Chapman (London, GB); Thomas Hazell (London, GB)

Assignee: Egress Software Technologies IP Limited

H04L63/1416G06F16/285H04L45/74H04L51/212H04L63/0245H04L63/123H04L69/22

Abstract

Claims (47)

1. A method for analyzing a data package received by a recipient, using a framework, the framework comprising:

at least one adjuster; and

a processing component configured to execute instructions for processing the received data package using the at least one adjuster;

wherein the at least one adjuster is configured to perform the steps of:

obtaining payload data of the received data package;

analyzing the payload data for recipient interactive content, wherein the recipient interactive content provides access to remote content;

substituting the recipient interactive content with sanitized recipient interactive content;

detecting recipient interaction with the sanitized recipient interactive content;

performing a content check when recipient interaction with the sanitized recipient interactive content is detected, wherein the content check comprises analyzing the remote content and determining a difference between the remote content at a time of the analysis of the payload data and the remote content at a time when the recipient interaction with the sanitized recipient interactive content is detected; and

determining, based on the content check whether the data package represents a security threat.

2. The method of claim 1 , wherein the step of analyzing the payload data is undertaken at a first time, where the first time is when the data package is received by the recipient.

3. The method of claim 2 , wherein the step of performing the content check is undertaken at a second time, the second time being after the first time.

4. The method of claim 1 , wherein, based on the determination of whether the data package represents a security threat, processing the data package comprises at least one of:

notifying a recipient of the data package of a potential security threat; and

forwarding the recipient to the remote content linked to by the recipient interactive content.

5. The method of claim 1 , wherein determining whether the data package represents a security threat comprises determining if the difference exceeds a predetermined threshold.

6. The method of claim 1 , wherein the content check comprises applying at least one of:

a geographical check;

a hygiene check;

a blacklist check; and

a linguistic and contextual check.

7. A device for analyzing a received data package received, the device comprising:

a user interface; and

a processor configured to execute instructions to process the data package using at least one adjuster, wherein the at least one adjuster is configured to:

obtain payload data of the received data package;

analyze the payload data for recipient interactive content, wherein the recipient interactive content provides access to remote content;

substitute the recipient interactive content with sanitized recipient interactive content;

detect recipient interaction via the user interface with the sanitized recipient interactive content;

perform a content check via the sanitized recipient interactive content when recipient interaction with the sanitized recipient-interactive content is detected, wherein the content check comprises analyzing the remote content linked to by the recipient interactive content and determining a difference between the remote content at a time of the analysis of the payload data and the remote content at a time when the recipient interaction with the sanitized recipient interactive content is detected; and

determine, based on the content check whether the data package represents a security threat.

8. The device of claim 7 , wherein the analysis of the payload data is undertaken at a first time, where the first time is when the data package is received by the recipient.

9. The device of claim 8 , wherein the content check is performed at a second time, the second time being after the first time.

10. The device of claim 7 , further comprising an output module, wherein, based on the determination of whether the data package represents a security threat, the output module is arranged to:

notify the recipient of the data package of a potential security threat; and

forward the recipient to the remote content linked to by the recipient-interactive content.

11. The device of claim 7 wherein determining whether the data package represents a security threat comprises determining if the difference exceeds a predetermined threshold.

12. The device of claim 7 , further comprising storage for storing data for use by the content check.

13. A non-transitory computer-readable storage medium comprising a set of computer-readable instructions stored thereon, which when executed by at least one processor are arranged to analyze a data package received by a recipient via a framework, the framework comprising:

at least one adjuster; and

a processing component for processing the received data package using the at least one adjuster;

wherein the at least one adjuster is configured to perform the steps of:

obtaining payload data of the received data package;

analyzing the payload data for recipient interactive content, wherein the recipient interactive content provides access to remote content;

substituting the recipient interactive content with sanitized recipient interactive content;

detecting recipient interaction with the sanitized recipient interactive content;

performing a content check when recipient interaction with the sanitized recipient interactive content is detected, wherein the content check comprises analyzing the remote content and determining a difference between the remote content at a time of the analysis of the payload data and the remote content at a time when the recipient interaction with the sanitized recipient interactive content is detected; and

determining, based on the content check whether the data package represents a security threat.

Assignments (3)

Priority Claims (4)

Continuity (1)

References Cited (9)