Identifying and protecting against malicious electronic messages that deceptively appear to originate from a trusted source

Patent metadata

Field	Value
Publication number	US-12101352-B1
Application number	US-202117368347-A
Country	US
Kind code	B1
Filing date	Jul 6, 2021
Priority date	Jul 6, 2021
Publication date	Sep 24, 2024
Grant date	Sep 24, 2024

Abstract

Identifying and protecting against malicious electronic messages that deceptively appear to originate from a trusted source. An authentic writing style contained within a legitimate electronic message that originates from a vender may be identified. The authentic writing style may be stored in a database. A new electronic message may be received that appears to originate from the vendor. The new electronic message may contain a new writing style. The new writing style may be compared with the authentic writing style stored in the database to identify any differences between the new writing style and the authentic writing style. A determination may be made that the new electronic message does not originate from the vender based, at least on part, on one or more differences identified between the writing styles. A security action may then be performed to protect against the new electronic message.

First claim

The invention claimed is:

1. A computer-implemented method for identifying and protecting against malicious electronic messages that deceptively appear to originate from a trusted source, at least a portion of the method being performed by a computing device comprising one or more processors, the computer-implemented method comprising:
identifying an authentic writing style contained within one or more legitimate electronic messages that originate from a vender, the legitimate electronic messages being used by the vender to communicate with customers;
assigning a confidence level to the authentic writing style, wherein the confidence level is assigned based at least in part on a number of times that the authentic writing style is identified in the one or more legitimate electronic messages;
storing the authentic writing style in a database;
receiving a new electronic message that appears to originate from the vender, the new electronic message containing a new writing style and a selectable link;
comparing the new writing style contained within the new electronic message with the authentic writing style stored in the database to identify any differences between the new writing style and the authentic writing style;
determining that the new electronic message does not originate from the vender based, at least in part, on one or more differences identified between the new writing style and the authentic writing style and the confidence level assigned to the authentic writing style; and
protecting against the new electronic message by performing a security action, wherein the security action includes disabling the link so that it cannot be selected by an intended recipient.

2. The computer-implemented method of claim 1 , wherein the security action further includes modifying the new electronic message to include a notification that the new electronic message does not originate from the vender.

3. The computer-implemented method of claim 1 , wherein the authentic writing style includes standard language that is routinely used by the vender in communications with customers.

4. The computer-implemented method of claim 1 , wherein the new electronic message is a text message that is received over a cellular network and the text message appears to originate from a number that is associated with the vender.

5. The computer-implemented method of claim 4 , wherein the text message appears within a chain that includes the one or more legitimate electronic messages.

6. The computer-implemented method of claim 1 , wherein the one or more differences identified between the new writing style and the authentic writing style includes a use of different words, a different spelling of a word, or a different sequence of words.

7. One or more non-transitory computer-readable media comprising one or more computer-readable instructions that, when executed by one or more processors of a security server, cause the security server to perform a method for identifying and protecting against malicious electronic messages that deceptively appear to originate from a trusted source, the method comprising:
identifying an authentic writing style contained within one or more legitimate electronic messages that originate from a vender, the legitimate electronic messages being used by the vender to communicate with customers;
assigning a confidence level to the authentic writing style, wherein the confidence level is assigned based at least in part on a number of times that the authentic writing style is identified in the one or more legitimate electronic messages;
storing the authentic writing style in a database;
receiving a new electronic message that appears to originate from the vender, the new electronic message containing a new writing style and a selectable link;
comparing the new writing style contained within the new electronic message with the authentic writing style stored in the database to identify any differences between the new writing style and the authentic writing style;
determining that the new electronic message does not originate from the vender based, at least in part, on one or more differences identified between the new writing style and the authentic writing style and the confidence level assigned to the authentic writing style; and
protecting against the new electronic message by performing a security action, wherein the security action includes disabling the link so that it cannot be selected by an intended recipient.

8. The one or more non-transitory computer-readable media of claim 7 , wherein the security action further includes modifying the new electronic message to include a notification that the new electronic message does not originate from the vender.

9. The one or more non-transitory computer-readable media of claim 7 , wherein the authentic writing style includes standard language that is routinely used by the vender in communications with customers.

10. The one or more non-transitory computer-readable media of claim 7 , wherein the new electronic message is a text message that is received over a cellular network and the text message appears to originate from a number that is associated with the vender.

11. The one or more non-transitory computer-readable media of claim 10 , wherein the text message appears within a chain that includes the one or more legitimate electronic messages.

12. The one or more non-transitory computer-readable media of claim 7 , wherein the one or more differences identified between the new writing style and the authentic writing style includes a use of different words, a different spelling of a word, or a different sequence of words.

13. A computing device comprising:
one or more processors; and
one or more non-transitory computer-readable media comprising one or more computer-readable instructions that, when executed by the one or more processors, cause the computing device to perform a method for identifying and protecting against malicious electronic messages that deceptively appear to originate from a trusted source, the method comprising:
identifying an authentic writing style contained within one or more legitimate electronic messages that originate from a vender, the legitimate electronic messages being used by the vender to communicate with customers;
assigning a confidence level to the authentic writing style, wherein the confidence level is assigned based at least in part on a number of times that the authentic writing style is identified in the one or more legitimate electronic messages;
storing the authentic writing style in a database;
receiving a new electronic message that appears to originate from the vender, the new electronic message containing a new writing style and a selectable link;
comparing the new writing style contained within the new electronic message with the authentic writing style stored in the database to identify any differences between the new writing style and the authentic writing style;
determining that the new electronic message does not originate from the vender based, at least in part, on one or more differences identified between the new writing style and the authentic writing style and the confidence level assigned to the authentic writing style; and
protecting against the new electronic message by performing a security action, wherein the security action includes disabling the link so that it cannot be selected by an intended recipient.

14. The computing device of claim 13 , wherein the security action is further includes modifying the new electronic message to include a notification that the new electronic message does not originate from the vender.

Assignees

• Nortonlifelock Inc
• Gen Digital Inc

Inventors

• Opos Joshua M

Classifications

• H04L51/212

  using filtering or selective blocking · CPC title

• H04L63/1483 Primary

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• H04W4/14

  Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD] · CPC title

• H04L51/58

  Message adaptation for wireless communication · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title