A Spoofed E-Mail Countermeasure Method by Scoring the Reliability of DKIM Signature Using Communication Data

Recently, spoofed e-mails become sophisticated and the messages that cannot be identified by visual confirmation have been increasing. DKIM is one of the most famous methods as countermeasure of spoofed e-mail. However, since DKIM allows a signature by third party domains, a recipient server can be unable to determine whether the attached signature is the legitimate. To solve the problem, although a method using data of DKIM signature domain passed DKIM verification is proposed, this method only verifies the existence of the past deliveries, therefore it has an issue in reliability. To overcome the issue, in this paper, we propose a method to score the reliability of combinations of sender's Header-From domain and DKIM signature domain by analyzing fluctuation of the existence of e-mail delivery obtained from the past communication data. By utilizing this method, the recipients can obtain the reliability score for each message including spoofed e-mail which was uniformly verified successfully in the ordinary DKIM verification, and can utilize our mechanism to spoofed e-mails countermeasure system.