Patent ID: 11936604
Assignee: AGARI DATA, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 17:
18. A method, comprising:
identifying that an electronic message includes an encrypted message content item;
determining whether to generate a wrapped version of the encrypted message content item based on an initial risk of the electronic message, comprising:
determining the initial risk based on scores associated with one or more of the following: trust, reputation, authenticity, and/or risk, wherein:
a score associated with the trust is determined based on a number of messages sent between an apparent sender and a recipient;
a score associated with the reputation is determined based on an extent to which a sender is recognized based on historical traffic;
a score associated with the authenticity is determined based on an analysis of a header of the electronic message, determining whether an originating server is associated with an IP address that has been previously utilized by a sender of the electronic message, whether the electronic message has a valid digital signature, or any combination thereof; and/or
a score associated with the risk is determined based on a heuristically computed score that depends on whether a sender has a Domain-based Message Authentication, Reporting & Conformance (DMARC) reject policy, whether message contents of the electronic message includes a uniform resource locator (URL), whether message contents of the electronic message include a potentially executable attachment, whether message contents of the electronic message include keywords associated with high risk, or any combination thereof;

determining to modify the electronic message by determining that a potential security threat that requires further analysis has been detected for the electronic message, and wherein determining that the potential security threat has been detected comprises:
determining both that the initial risk does not correspond to a first category of being a near-certainty benevolent electronic message and that the initial risk does not correspond to a second category of being a near-certainty malice electronic message; and
determining that the initial risk belongs to a third category of being a remainder portion that is to be modified and further inspected;

modifying the electronic message to include the wrapped version of the encrypted message content item instead of the original encrypted message content item, comprising:
determining a risk profile of an intended recipient of the electronic message based on a number of electronic messages received by the intended recipient, a reaction of the intended recipient to a received electronic message, or both;
dynamically determining a modification to be made based at least in part on a first risk profile of the intended recipient or a second risk profile of the intended recipient; and
applying the modification to the electronic message to form a modified version of the electronic message; and

allowing the electronic message with the wrapped version of the encrypted message content item to be delivered;
wherein, in response to a user attempting to access content of the wrapped version of the encrypted message content item after the electronic message with the wrapped version of the encrypted message content item is delivered, the user is provided a request for a decryption password by a wrapper program of the wrapped version and the decryption password is utilized in analyzing a computer security threat of the encrypted message content item prior to allowing the user access to decrypted content of the encrypted message content item, wherein analyzing the computer security threat includes determining whether a result of the analyzing indicates a sufficient detected security threat for the electronic message, and in an event the result of the analyzing does not indicate the sufficient detected security threat, allowing the intended recipient to fully access the decrypted content of the encrypted message content item.