Patent ID: 11936604
Assignee: AGARI DATA, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 16:
17. A system, comprising:
a processor configured to:
determine an initial risk of an electronic message, comprising to:
determine the initial risk based on scores associated with one or more of the following: trust, reputation, authenticity, and/or risk, wherein:
a score associated with the trust is determined based on a number of messages sent between an apparent sender and a recipient;
a score associated with the reputation is determined based on an extent to which a sender is recognized based on historical traffic;
a score associated with the authenticity is determined based on an analysis of a header of the electronic message, determining whether an originating server is associated with an IP address that has been previously utilized by a sender of the electronic message, whether the electronic message has a valid digital signature, or any combination thereof; and/or
a score associated with the risk is determined based on a heuristically computed score that depends on whether a sender has a Domain-based Message Authentication, Reporting & Conformance (DMARC) reject policy, whether message contents of the electronic message includes a uniform resource locator (URL), whether message contents of the electronic message include a potentially executable attachment, whether message contents of the electronic message include keywords associated with high risk, or any combination thereof;

based on the initial risk, determine whether to modify the electronic message, wherein determining to modify the electronic message includes determining that a potential security threat that requires further analysis has been detected for the electronic message, and wherein determining that the potential security threat has been detected comprises:
determining both that the initial risk does not correspond to a first category of being a near-certainty benevolent electronic message and that the initial risk does not correspond to a second category of being a near-certainty malice electronic message; and
determining that the initial risk belongs to a third category of being a remainder portion that is to be modified and further inspected; and

in an event it is determined to modify the electronic message:
modify the electronic message, comprising to:
determine a risk profile of an intended recipient of the electronic message based on a number of electronic messages received by the intended recipient, a reaction of the intended recipient to a received electronic message, or both;
dynamically determine a modification to be made based at least in part on a first risk profile of the intended recipient or a second risk profile of the intended recipient; and
apply the modification to the electronic message to form a modified version of the electronic message;

allow the modified version of the electronic message to be delivered to the intended recipient of the electronic message;
after the modified version of the electronic message is delivered to the intended recipient, automatically perform a secondary computer security risk assessment of the electronic message, wherein the secondary computer security risk assessment includes an anti-virus test, a malware test, or both; and
based on the secondary computer security risk assessment, update the modified version of the electronic message, wherein updating the modified version of the electronic message based on the secondary computer security risk assessment includes determining whether a result of the secondary computer security risk assessment indicates a sufficient detected security threat for the electronic message, and in an event the result of the secondary computer security risk assessment does not indicate the sufficient detected security threat, allowing the intended recipient to fully access the electronic message without at least a portion of a modification made in the modified version of the electronic message; and

a memory coupled to the processor and configured to provide the processor with instructions.