# US 8,752,172 B1 · Processing email messages based on authenticity analysis > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,752,172 B1 - Document ID: US8752172B1 - Status: Granted - Kind: B1 - Application number: 13/169,167 - Filed: 2011-06-27 - Granted: 2014-06-10 - Earliest claimed: 2011-06-27 - Assignees: EMC Corporation - Applicants: Yedidya Dotan; Lawrence N. Friedman - Inventors: Yedidya Dotan; Lawrence N. Friedman - Web page: https://patentgrep.com/patent/US8752172B1 ## CPC - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A technique processes an email message. The technique involves receiving the email message from a network, and performing an authenticity analysis operation to determine authenticity of the email message. The technique further involves forwarding a copy of the email message to an external central hub through the network when a result of the authenticity analysis operation indicates that the email message is not authentic, and refraining from sending the copy of the email message to the external central hub through the network when the result of the authenticity analysis operation indicates that the email message is authentic. Such an embodiment is well suited for identifying spear phishing attacks within email messages routinely handled by an email server. ## Claims ### Claim 1 In an electronic system, a method of processing an email message, the method comprising: receiving the email message from a network; performing an authenticity analysis operation to determine authenticity of the email message; and forwarding a copy of the email message to an external central hub through the network when a result of the authenticity analysis operation indicates that the email message is not authentic, and refraining from sending the copy of the email message to the external central hub through the network when the result of the authenticity analysis operation indicates that the email message is authentic; wherein performing the authenticity analysis operation to determine authenticity of the email message includes: generating a risk score based on the email message, and providing, as the result of the authenticity analysis operation, (i) a first value indicating that the email message is not authentic when the risk score exceeds a predetermined threshold, and (ii) a second value indicating that the email message is authentic when the risk score does not exceed the predetermined threshold. ### Claim 2 (depends on 1) A method as in claim 1 wherein the electronic system includes an agent and an email server; and wherein generating the risk score based on the email message is performed by the agent while the email server delivers the email message to an email client. ### Claim 3 (depends on 2) A method as in claim 2 wherein, when the result of the authenticity analysis operation indicates that the email message is not authentic, forwarding the copy of the email message to the external central hub through the network is performed by the agent after the email server delivers the email message to the email client. ### Claim 4 (depends on 1) A method as in claim 1 wherein the electronic system includes an enhancement module to an email server, the email server being constructed and arranged to deliver email messages to an email client; and wherein the enhancement module generates the risk score based on the email message prior to any delivery of the email message from the email server to the email client. ### Claim 5 (depends on 4) A method as in claim 4 wherein, when the result of the authenticity analysis operation indicates that the email message is not authentic, the enhancement module forwards the copy of the email message to the external central hub through the network and prevents delivery of the email message from the email server to the email client. ### Claim 6 (depends on 1) A method as in claim 1 wherein the electronic system includes a risk engine which is constructed and arranged to generate numerical risk scores for email messages, each numerical risk score being a quantitative measure which indicates a likelihood that a particular email message is fraudulent; and wherein the method further comprises: when the result of the authenticity analysis operation indicates that the email message is authentic, sending the email message to a client device via an email server based on a user address of the email message to enable a user to read the email message, the client device being external to the electronic system. ### Claim 7 (depends on 1) A method as in claim 1 wherein generating the risk score based on the email message includes: providing, as the risk score, a numerical aggregation of a set of sub-score values, each sub-score value being a respective measure of riskiness of the email message from a perspective of a different risk criteria. ### Claim 8 In an electronic system, a method of processing an email message, the method comprising: receiving the email message from a network; performing an authenticity analysis operation to determine authenticity of the email message; and forwarding a copy of the email message to an external central hub through the network when a result of the authenticity analysis operation indicates that the email message is not authentic, and refraining from sending the copy of the email message to the external central hub through the network when the result of the authenticity analysis operation indicates that the email message is authentic; wherein performing the authenticity analysis operation to determine authenticity of the email message includes: generating a risk score based on the email message, and providing, as the result of the authenticity analysis operation, (i) a first value indicating that the email message is not authentic when the risk score exceeds a predetermined threshold, and (ii) a second value indicating that the email message is authentic when the risk score does not exceed the predetermined threshold; and wherein generating the risk score based on the email message includes: generating multiple sub-scores corresponding to multiple risk criteria, each sub-score identifying a degree to which the email message fits a particular risk criteria, and outputting, as the risk score, an aggregate value including a sum of the multiple sub-scores corresponding to the multiple risk criteria. ### Claim 9 (depends on 8) A method as in claim 8 wherein the electronic system includes an email server; and wherein receiving the email message from the network includes: acquiring the email message en route to the email server from an external device on the network. ### Claim 10 (depends on 9) A method as in claim 9 wherein the external central hub includes an electronic critical incident response device which is constructed and arranged to receive, review and identify whether email messages en route to multiple email servers are fraudulent; and wherein forwarding the copy of the email message to the external central hub through the network includes automatically sending the copy of the email message to the electronic critical incident response device when the aggregate value including the sum of the multiple sub-scores corresponding to the multiple risk criteria is greater than the predetermined threshold. ### Claim 11 (depends on 10) A method as in claim 10, further comprising: after operating the electronic system for a period of time, adjusting the predetermined threshold to limit an amount of email messages received by the critical incident response device from the electronic system to a predefined percentage which is substantially less than 100%. ### Claim 12 (depends on 8) A method as in claim 8 wherein generating the multiple sub-scores corresponding to the multiple risk criteria includes: scanning the email message for high-risk keywords, and providing, as a keyword sub-score, a overall keyword value based on a number of high-risk keywords and weights of the high-risk keywords found in the email message, the keyword sub-score being a component of the risk score. ### Claim 13 (depends on 8) A method as in claim 8 wherein generating the multiple sub-scores corresponding to the multiple risk criteria includes: performing a set of comparison operations which compare email data contained within the email message to current facts regarding the email, and providing, as a consistency sub-score, a overall consistency value based on results of the set of comparison operations. ### Claim 14 (depends on 8) A method as in claim 8 wherein generating the multiple sub-scores corresponding to the multiple risk criteria includes: performing a set of search operations which search for predefined sender address data contained within the email message, and providing, as a sender address sub-score, a overall sender address value based on results of the set of search operations. ### Claim 15 (depends on 8) A method as in claim 8 wherein generating the multiple sub-scores corresponding to the multiple risk criteria includes: (i) scanning the email message for high-risk keywords, and (ii) providing, as a keyword sub-score, a overall keyword value based on a number of high-risk keywords and weights of the high-risk keywords found in the email message, the keyword sub-score being a component of the risk score; (i) performing a set of comparison operations which compare email data contained within the email message to current facts regarding the email, and (ii) providing, as a consistency sub-score, a overall consistency value based on results of the set of comparison operations; and (i) performing a set of search operations which search for predefined sender address data contained within the email message, and (ii) providing, as a sender address sub-score, a overall sender address value based on results of the set of search operations; the aggregate value including a sum of the overall keyword value, the overall consistency value, and the overall sender address value. ### Claim 16 An electronic system, comprising: a network interface which is constructed and arranged to connect to a network; and a controller coupled to the network interface, the controller being constructed and arranged to: receive an email message from the network through the network interface, perform an authenticity analysis operation to determine authenticity of the email message, and forward a copy of the email message to an external central hub through the network interface when a result of the authenticity analysis operation indicates that the email message is not authentic, and refrain from sending the copy of the email message to the external central hub through the network interface when the result of the authenticity analysis operation indicates that the email message is authentic; wherein the controller, when performing the authenticity analysis operation to determine authenticity of the email message, is constructed and arranged to: generate a risk score based on the email message, and provide, as the result of the authenticity analysis operation, (i) a first value indicating that the email message is not authentic when the risk score exceeds a predetermined threshold, and (ii) a second value indicating that the email message is authentic when the risk score does not exceed the predetermined threshold. ### Claim 17 (depends on 16) An electronic system as in claim 16 wherein the controller, when generating the risk score based on the email message, is constructed and arranged to: generate multiple sub-scores corresponding to multiple risk criteria, each sub-score identifying a degree to which the email message fits a particular risk criteria, and output, as the risk score, an aggregate value including a sum of the multiple sub-scores corresponding to the multiple risk criteria. ### Claim 18 (depends on 16) An electronic system as in claim 16 wherein the controller, when generating the risk score based on the email message, is constructed and arranged to: provide, as the risk score, a numerical aggregation of a set of sub-score values, each sub-score value being a respective measure of riskiness of the email message from a perspective of a different risk criteria. ### Claim 19 A computer program product having a non-transitory computer readable medium which stores a set of instructions that, when performed by a computerized device, cause the computerized device to: receive an email message from a network; perform an authenticity analysis operation to determine authenticity of the email message; and forward a copy of the email message to an external central hub through the network when a result of the authenticity analysis operation indicates that the email message is not authentic, and refrain from sending the copy of the email message to the external central hub through the network when the result of the authenticity analysis operation indicates that the email message is authentic; wherein performing the authenticity analysis operation to determine authenticity of the email message includes: generating a risk score based on the email message, and providing, as the result of the authenticity analysis operation, (i) a first value indicating that the email message is not authentic when the risk score exceeds a predetermined threshold, and (ii) a second value indicating that the email message is authentic when the risk score does not exceed the predetermined threshold. ### Claim 20 (depends on 19) A computer program product as in claim 19 wherein generating the risk score based on the email message includes: generating multiple sub-scores corresponding to multiple risk criteria, each sub-score identifying a degree to which the email message fits a particular risk criteria, and outputting, as the risk score, an aggregate value including a sum of the multiple sub-scores corresponding to the multiple risk criteria. ### Claim 21 (depends on 19) A computer program product as in claim 19 wherein generating the risk score based on the email message includes: providing, as the risk score, a numerical aggregation of a set of sub-score values, each sub-score value being a respective measure of riskiness of the email message from a perspective of a different risk criteria.