# US 2019/0173892 A1 · Electronic mail security system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0173892 A1
- Document ID: US20190173892A1
- Status: Published application
- Kind: A1
- Application number: 15/833,396
- Filed: 2017-12-06
- Published: 2019-06-06
- Earliest claimed: 2017-12-06
- Assignees: Chicago Mercantile Exchange Inc.
- Applicants: Chicago Mercantile Exchange Inc.
- Inventors: Thomas Anthony Kemp; Metin Carlo DePaolis; William Robert Gemza, JR.; Ryan Jerome Whalen
- Web page: https://patentgrep.com/patent/US20190173892A1

## CPC

- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06F 21/554: {involving event detection and direct action}
- G06Q 10/107: Computer-aided management of electronic mailing [e-mailing]
- H04L 51/08: Annexed information, e.g. attachments
- H04L 51/18: Commands or executable codes
- H04L 51/212: using filtering or selective blocking
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

A method comprises, in response to receiving an email message, detecting one or more artifacts within an email message, wherein each of the artifacts is associated with a payload; for each artifact, generating, a descriptor object representing the artifact that does not include the payload, so that the processor is prevented from accessing the payload via the descriptor object; and at least one payload button based on the payload associated with the artifact for causing the payload to be transmitted to an external system for analysis of the payload; and presenting an artifact dashboard in a graphical user interface (GUI) rendered on a display of the email security system, the artifact dashboard displaying, for each artifact, the descriptor object representing the artifact and the at least one payload button based on the payload associated with the artifact.

## Claims

### Claim 1

A computer implemented method of an email security system processing an email message, the method comprising:
in response to receiving an email message, detecting, by a processor of the email security system, one or more artifacts within the email message, wherein each of the artifacts is associated with a payload;
for each artifact, generating, by the processor:
a descriptor object representing the artifact that does not include the payload, so that the processor is prevented from accessing the payload via the descriptor object; and
at least one payload button based on the payload associated with the artifact for causing the payload to be transmitted to an external system for analysis of the payload; and
presenting, by the processor, an artifact dashboard in a graphical user interface (GUI) rendered on a display of the email security system, the artifact dashboard displaying, for each artifact, the descriptor object representing the artifact and the at least one payload button based on the payload associated with the artifact.

### Claim 2 (depends on 1)

The computer implemented method of claim 1, wherein the artifact is one of an Internet link or an attachment to the email message.

### Claim 3 (depends on 2)

The computer implemented method of claim 2, wherein the payload for an Internet link is an Internet website, and wherein the payload for an attachment is a file.

### Claim 4 (depends on 1)

The computer implemented method of claim 1, wherein the artifact dashboard displays a classifier object for classifying the email message based on an analysis of the payload.

### Claim 5 (depends on 1)

The computer implemented method of claim 1, wherein the artifact dashboard displays a template object for transmitting a templated response to the email message.

### Claim 6 (depends on 1)

The computer implemented method of claim 1, wherein the email message includes a recipient, wherein the email security system is implemented on an email server, and wherein the method further comprises:
intercepting the email message before the email message is delivered to the recipient; and
transmitting the email message to the recipient only upon receiving authorization to transmit the email message to the recipient.

### Claim 7 (depends on 6)

The computer implemented method of claim 6, wherein the email security system releases the email message for delivery to the recipient after receiving authorization.

### Claim 8

An email security system comprising:
a processor;
a display communicatively coupled to the processor; and
a memory communicatively coupled to the processor, the memory comprising software that, when executed by the processor, performs operations that cause the processor to:
in response to receiving an email message, detect one or more artifacts within the email message, wherein each of the artifacts is associated with a payload;
for each artifact, generate:
a descriptor object representing the artifact that does not include the payload, so that the processor is prevented from accessing the payload via the descriptor object; and
at least one payload button based on the payload associated with the artifact for causing the payload to be transmitted to an external system for analysis of the payload; and
present an artifact dashboard in a graphical user interface (GUI) rendered on a display of the email security system, the artifact dashboard displaying, for each artifact, the descriptor object representing the artifact and the at least one payload button based on the payload associated with the artifact.

### Claim 9 (depends on 8)

The email security system of claim 8, wherein the artifact is one of an Internet link or an attachment to the email message.

### Claim 10 (depends on 9)

The email security system of claim 9, wherein the payload for an Internet link is an Internet website, and wherein the payload for an attachment is a file.

### Claim 11 (depends on 8)

The email security system of claim 8, wherein the artifact dashboard displays a classifier object for classifying the email message based on an analysis of the payload.

### Claim 12 (depends on 8)

The email security system of claim 8, wherein the artifact dashboard displays a template object for transmitting a templated response to the email message.

### Claim 13 (depends on 8)

The email security system of claim 8, wherein the email message includes a recipient, wherein the email security system is implemented on an email server, and wherein the processor is further configured to:
intercept the email message before the email message is delivered to the recipient; and
transmit the email message to the recipient only upon receiving authorization to transmit the email message to the recipient.

### Claim 14 (depends on 13)

The email security system of claim 13, which releases the email message for delivery to the recipient after receiving authorization.

### Claim 15

A non-transitory computer readable medium storing instructions that, when executed by a processor, cause the processor to:
in response to receiving an email message, detect one or more artifacts within the email message, wherein each of the artifacts is associated with a payload;
for each artifact, generate:
a descriptor object representing the artifact that does not include the payload, so that the processor is prevented from accessing the payload via the descriptor object; and
at least one payload button based on the payload associated with the artifact for causing the payload to be transmitted to an external system for analysis of the payload; and
present an artifact dashboard in a graphical user interface (GUI) rendered on a display of the email security system, the artifact dashboard displaying, for each artifact, the descriptor object representing the artifact and the at least one payload button based on the payload associated with the artifact.

### Claim 16 (depends on 15)

The non-transitory computer readable medium of claim 15, wherein the artifact is one of an Internet link or an attachment to the email message.

### Claim 17 (depends on 16)

The non-transitory computer readable medium of claim 16, wherein the payload for an Internet link is an Internet website, and wherein the payload for an attachment is a file.

### Claim 18 (depends on 15)

The non-transitory computer readable medium of claim 15, wherein the artifact dashboard displays a classifier object for classifying the email message based on an analysis of the payload.

### Claim 19 (depends on 15)

The non-transitory computer readable medium of claim 15, wherein the artifact dashboard displays a template object for transmitting a templated response to the email message.

### Claim 20 (depends on 15)

The non-transitory computer readable medium of claim 15, wherein the email message includes a recipient, wherein the email security system is implemented on an email server, and wherein the instructions cause the processor to:
intercept the email message before the email message is delivered to the recipient; and
transmit the email message to the recipient only upon receiving authorization to transmit the email message to the recipient.

### Claim 21 (depends on 20)

The non-transitory computer readable medium of claim 20, wherein the instructions cause the processor to release the email message for delivery to the recipient after receiving authorization.

### Claim 22

A computer system comprising:
in response to receiving an email message, means for detecting one or more artifacts within the email message, wherein each of the artifacts is associated with a payload;
means for generating, for each artifact:
a descriptor object representing the artifact that does not include the payload, preventing access to the payload via the descriptor object; and
at least one payload button based on the payload associated with the artifact for causing the payload to be transmitted to an external system for analysis of the payload; and
means for presenting an artifact dashboard in a graphical user interface (GUI) rendered on a display of the email security system, the artifact dashboard displaying, for each artifact, the descriptor object representing the artifact and the at least one payload button based on the payload associated with the artifact.