Systems, methods, and media protecting a digital data processing device from attack
AssigneeThe Trustees of Columbia University in the City of New York
InventorsStylianos Sidiroglou, Angelos D. Keromytis, Salvatore J. Stolfo
Life of this patent
Estimating the term…
Abstract
In accordance with some embodiments of the disclosed subject matter, systems, methods, and media for protecting a digital data processing device from attack are provided. For example, in some embodiments, a method for protecting a digital data processing device from attach is provided, that includes, within a virtual environment; receiving at least one attachment to an electronic mail; and executing the al least one attachment; and based on the execution of the at least one attachment, determining whether anomalous behavior occurs.
Claims21
A method for protecting a digital data processing device from attack, the method comprising:
- receiving a first electronic mail;
- sending the first electronic mail to a first computing device that opens at least a first attachment in the first electronic mail, determines whether anomalous behavior occurs subsequent to opening the first attachment, and generates feedback when anomalous behavior is determined to have occurred;
- receiving a second electronic mail at a second computing device;
- and
- based on the feedback:
- determining that a second attachment in the second electronic mail matches the first attachment in the first electronic mail;
- and
- in response to determining that the second attachment matches the first attachment, performing filtering on the second electronic mail.
A system for protecting a digital data processing device from attack, the system comprising:
- at least one hardware processor that:
- receives a first electronic mail;
- sends the first electronic mail to a first computing device that opens at least a first attachment in the first electronic mail, determines whether anomalous behavior occurs subsequent to opening the first attachment, and generates feedback when anomalous behavior is determined to have occurred;
- receives a second electronic mail at a second computing device;
- and
- based on the feedback:
- determines that a second attachment in the second electronic mail matches the first attachment in the first electronic mail;
- and
- in response to determining that the second attachment matches the first attachment, performs filtering on the second electronic mail.
A non-transitory computer-readable medium containing computer executable instructions that, when executed by a processor, cause the processor to perform a method for protecting a digital data processing device from attack, the method comprising:
- receiving a first electronic mail;
- sending the first electronic mail to a first computing device that opens at least a first attachment in the first electronic mail, determines whether anomalous behavior occurs subsequent to opening the first attachment, and generates feedback when anomalous behavior is determined to have occurred;
- receiving a second electronic mail at a second computing device;
- and
- based on the feedback:
- determining that a second attachment in the second electronic mail matches the first attachment in the first electronic mail;
- and
- in response to determining that the second attachment matches the first attachment, performing filtering on the second electronic mail.
Dependencies are inferred from the claim text.