# US 2019/0319983 A1 · Method and apparatus for neutralizing real cyber threats to training materials > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0319983 A1 - Document ID: US20190319983A1 - Status: Published application - Kind: A1 - Application number: 16/358,537 - Filed: 2019-03-19 - Published: 2019-10-17 - Earliest claimed: 2018-04-11 - Assignees: Barracuda Networks, Inc. - Applicants: Barracuda Networks, Inc. - Inventors: Fleming SHI - Web page: https://patentgrep.com/patent/US20190319983A1 ## CPC - G09B 19/0053: {Computers, e.g. programming} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - G09B: EDUCATIONAL OR DEMONSTRATION APPLIANCES; APPLIANCES FOR TEACHING, OR COMMUNICATING WITH, THE BLIND, DEAF OR MUTE; MODELS; PLANETARIA; GLOBES; MAPS; DIAGRAMS (devices for psychotechnics or for testing reaction times A61B5/16; games, sports, amusements A63; projectors, projector screens G03B) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An approach is proposed to support neutralizing real cyber threats to training materials by intercepting, modifying and redistributing active content(s) of an email arrived at a recipient's email account. Specifically, when the recipient triggers an active content such as an URL link embedded in and/or opens an attachment to the email, the triggered active content is synchronously intercepted and examined in real time for potential malicious intent of a phishing attack. If the active content is determined to be malicious, the malicious active content in the email is then disassembled and deactivated while the payload is reconstructed with links and markings for training purposes. The recipient is then provided with an anti-phishing training exercise, wherein content of the training exercise is specifically customized for the recipient based on the reconstructed payload of the received email and/or the recipient's security posture and awareness. ## Claims ### Claim 1 A system to support neutralizing real cyber threats to training materials, comprising: a content filtering and interception engine running on a host and configured to intercept and detect an active content in a payload of an email arriving at a recipient's email account within an entity or corporation; a security protection engine running on a host and configured to synchronously examine the active content of the email in real time for potential malicious intent of a phishing attack when the recipient attempts to access the active content of the email; block the recipient from accessing the active content of the email if the active content is identified to be malicious to prevent the recipient from falling victim to the phishing attack; an anti-phishing training engine running on a host and configured to disassemble, isolate, and deactivate the malicious active content of the email once the active content of an email has been identified and blocked; replace the malicious active content in the email with training data, wherein the training data is benign active content that is not harmful to the recipient even when he or she accesses the training data; reconstruct payload of the email with the replaced benign training data and deliver the reconstructed payload of the email to the recipient in place of the original email for an anti-phishing training exercise. ### Claim 2 (depends on 1) The system of claim 1, wherein: the active content of the email is an embedded URL link directing to a website or macros in an attached document to the email. ### Claim 3 (depends on 2) The system of claim 2, wherein: the anti-phishing training engine is configured to neutralize the URL link directed to the fake website and/or the attached document with malicious content so that such link and/or document no longer pose a security threat to the recipient even if the recipient chooses to click on the link and/or open the document. ### Claim 4 (depends on 3) The system of claim 3, wherein: the training data includes neutralized active links and/or active code that are not harmful to the recipient even when he or she clicks on it. ### Claim 5 (depends on 3) The system of claim 3, wherein: the anti-phishing training engine is configured to keep the neutralized URL link and/or document in place within the email as the training data; allow the recipient to access them without prior alert or warning in order to monitor the recipient's behavior when facing the phishing attack. ### Claim 6 (depends on 5) The system of claim 5, wherein: the anti-phishing training engine is configured to maintain the neutralized URL link and/or document and/or the behaviors of the recipient during the anti-phishing training exercise into the user behavior database. ### Claim 7 (depends on 6) The system of claim 6, wherein: the anti-phishing training engine is configured to access and retrieve the recipient's pattern of behavior of accessing malicious content in the past from the user behavior database to determine the type of anti-phishing training exercise the recipient needs. ### Claim 8 (depends on 6) The system of claim 6, wherein: the anti-phishing training engine is configured to import information related to the behavior of the user/recipient from the user behavior database to personalize the reconstructed payload of the email prescriptively to tailor the training data specific to the recipient. ### Claim 9 (depends on 5) The system of claim 5, wherein: the anti-phishing training engine is configured to track and report the behaviors of the recipient during the anti-phishing training exercise when the recipient accesses the neutralized active content in the benign training data. ### Claim 10 (depends on 1) The system of claim 1, wherein: the anti-phishing training engine is configured to customize the training data of the anti-phishing training exercise specifically for the recipient based on the blocked phishing attack the recipient received in the email and/or the recipient's security posture and awareness. ### Claim 11 A method to support neutralizing real cyber threats to training materials, comprising: intercepting and detecting an active content in a payload of an email arriving at a recipient's email account within an entity or corporation; synchronously examining the active content of the email in real time for potential malicious intent of a phishing attack when the recipient attempts to access the active content of the email; blocking the recipient from accessing the active content of the email if the active content is identified to be malicious to prevent the recipient from falling victim to the phishing attack; disassembling, isolating, and deactivating the malicious active content of the email once the active content of an email has been identified and blocked; replacing the malicious active content in the email with training data, wherein the training data is benign active content that is not harmful to the recipient even when he or she accesses the training data; reconstructing the payload of the email with the replaced benign training data and delivering the reconstructed payload of the email to the recipient in place of the original email for an anti-phishing training exercise. ### Claim 12 (depends on 11) The method of claim 11, wherein: the active content of the email is an embedded URL link directing to a website or macros in an attached document to the email. ### Claim 13 (depends on 12) The method of claim 12, further comprising: neutralizing the URL link directed to the fake website and/or the attached document with malicious content so that such link and/or document no longer pose a security threat to the recipient even if the recipient chooses to click on the link and/or open the document. ### Claim 14 (depends on 13) The method of claim 13, further comprising: including in the training data the neutralized active links and/or active code that are not harmful to the recipient even when he or she clicks on it. ### Claim 15 (depends on 13) The method of claim 13, further comprising: keeping the neutralized URL link and/or document in place within the email as the training data; allowing the recipient to access them without prior alert or warning in order to monitor the recipient's behavior when facing the phishing attack. ### Claim 16 (depends on 15) The method of claim 15, further comprising: maintaining the neutralized URL link and/or document and/or the behaviors of the recipient during the anti-phishing training exercise into the user behavior database. ### Claim 17 (depends on 16) The method of claim 16, further comprising: accessing and retrieving the recipient's pattern of behavior of accessing malicious content in the past from the user behavior database to determine the type of anti-phishing training exercise the recipient needs. ### Claim 18 (depends on 16) The method of claim 16, further comprising: importing information related to the behavior of the user/recipient from the user behavior database to personalize the reconstructed payload of the email prescriptively to tailor the training data specific to the recipient. ### Claim 19 (depends on 15) The method of claim 15, further comprising: tracking and reporting the behaviors of the recipient during the anti-phishing training exercise when the recipient accesses the neutralized active content in the benign training data. ### Claim 20 (depends on 11) The method of claim 11, further comprising: customizing the training data of the anti-phishing training exercise specifically for the recipient based on the blocked phishing attack the recipient received in the email and/or the recipient's security posture and awareness. ### Claim 21 A non-transitory storage medium having software instructions stored thereon that when executed cause a system to: intercept and detect an active content in a payload of an email arriving at a recipient's email account within an entity or corporation; synchronously examine the active content of the email in real time for potential malicious intent of a phishing attack when the recipient attempts to access the active content of the email; block the recipient from accessing the active content of the email if the active content is identified to be malicious to prevent the recipient from falling victim to the phishing attack; disassemble, isolate, and deactivate the malicious active content of the email once the active content of an email has been identified and blocked; replace the malicious active content in the email with training data, wherein the training data is benign active content that is not harmful to the recipient even when he or she accesses the training data; reconstruct the payload of the email with the replaced benign training data and deliver the reconstructed payload of the email to the recipient in place of the original email for an anti-phishing training exercise.