Proofpoint, Inc.

Angelo Starink

David Robert Knight

Methods and systems for malicious message detection and processing are provided. An example method includes detecting, via an intermediary node, a link included in a message, the link being associated with an unknown resource or a known malicious resource. The intermediary node may have a processor and a memory for storing executable instructions to perform the method. The example method further includes hashing a unique identifier for each recipient of the message; coupling each of the hashed unique identifiers with the link to create an unique updated link for each recipient; and for each recipient, replacing the link in the message with their corresponding unique updated link. The method may include causing forwarding of the updated message with the corresponding unique updated link to each recipient. If the resource is a malicious resource, the unique update link may be to a block webpage associated with a trusted resource.

Methods and systems for malicious message detection and processing

Methods and corresponding systems for malicious message detection and processing are provided herein. According to example embodiments, a method includes detecting, via an intermediary node, a link included in a message, the link being associated with an unknown resource. The intermediary node may have a processor and a memory for storing executable instructions to perform the method. The example method further includes hashing a unique identifier for a recipient of the message; coupling the hashed identifier with the link to create an updated link, and replacing the link in the message with the updated link. The method may include causing forwarding of the updated message to a recipient. Clicking on or otherwise selecting the updated link by the one or more recipients of the message may be tracked. The method may include mapping the hashed identifier to the unique identifier of each of the one or more recipients.

Systems and methods for malicious message detection and processing are provided herein. According to various embodiments, a method includes detecting, via an intermediary node, a link included in a message, the link being associated with an unknown resource, hashing a unique identifier for a recipient of the message, coupling the hashed identifier with the link, creating an updated link, and forwarding an updated message, including the updated link, to the recipient.

Malicious message detection and processing

Malicious message detection and processing systems and methods are provided herein. According to various embodiments, a method includes detecting, via an intermediary node, a link included in a message, the link being associated with an unknown resource, hashing a unique identifier for a recipient of the message, coupling the hashed identifier with the link, creating an updated link and updated message, and forwarding the updated message to the recipient.

Malicious message detection and processing systems and methods are provided herein. According to some embodiments, the messages are emails and the method for processing emails may be facilitated by way of an intermediary node which may be cloud-based. The intermediary node may be communicatively couplable with an email client and an email server. The intermediary node may execute a method that includes analyzing a link included in an email to determine if the link is associated with a potentially malicious resource, and replacing the link with an alternate link to a trusted resource if the link is associated with a potentially malicious resource.

Growing community of inventors

Morgan Hill, CA, United States of America

Angelo Starink