Tertiary classification of communications

• US 10,129,194 B1
• Filed: 08/11/2016
• Issued: 11/13/2018
• Est. Priority Date: 02/13/2012
• Status: Active Grant

• Current Assignee: ZapFraud, Inc. (Bjorn Markus Jakobsson)
• Original Assignee: ZapFraud, Inc. (Bjorn Markus Jakobsson)
• Inventors: Jakobsson, Bjorn Markus
• Primary Examiner(s): Khan, Aftab N.
• Application Number:
  US15/235,058
• Time in Patent Office: 824 Days
• Field of Search: 709206
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

Information associated with a plurality of electronic communications associated with an entity is obtained. An entry including information associated with a given email address is generated in a whitelist. The entry including the information associated with the given email address is generated based at least in part on a determination, from the obtained information associated with the plurality of electronic communication associated with the entity, that at least a threshold number of electronic communications have been exchanged between the entity and the given email address, and that the at least threshold number of emails were exchanged during a period of time that exceeds a threshold period of time. Subsequent to generating the whitelist entry, an electronic communication to be classified is received. A classification of the received electronic communication is performed based at least in part on a determination of whether the received electronic communication corresponds to an entry in the whitelist.

Claims

1. A system, comprising:

one or more processors configured to;

obtain information associated with a plurality of electronic communications associated with an entity;

generate, in a whitelist, an entry including information associated with a given email address, wherein the entry including the information associated with the given email address is generated based at least in part on a determination, from the obtained information associated with the plurality of electronic communications associated with the entity, that at least a threshold number of electronic communications have been exchanged between the entity and the given email address, and that the at least threshold number of emails were exchanged during a period of time that exceeds a threshold period of time;

subsequent to generating the whitelist entry, receive an electronic communication to be classified; and

perform a classification of the received electronic communication based at least in part on a determination of whether the received electronic communication corresponds to an entry in the whitelist, wherein performing the classification includes assigning to the received electronic communication a single one of three different classifications according to a tertiary classification scheme, wherein the three classifications include good, bad, and undetermined;

based at least in part on the bad or undetermined classification, change the appearance of the received electronic communication by at least one of;

redacting a first portion of the received electronic communication, textually or visually clarifying the received electronic communication, highlighting a second portion of the received electronic communication, and marking the message as highly suspicious;

wherein the one or more processors are further configured to perform an action based at least in part on the bad or undetermined classification, wherein the action comprises at least one of;

delivering the received electronic communication in a folder selected based at least in part on the classification,

delivering the received electronic communication to an account selected based at least in part on the classification,

holding the received electronic communication in a repository,

forwarding the received electronic communication to a remote classifier, and

forwarding the received electronic communication for human review, wherein a reputation score is maintained for a human reviewer, and wherein the reputation score indicates a review accuracy of the human reviewer; and

a memory coupled to the one or more processors and configured to provide the one or more processors with instructions.

2. The system of claim 1, wherein the generated entry includes the given email address.

3. The system of claim 1, wherein at least one entry in the whitelist is associated with a benign service provider.

4. The system of claim 1, wherein the classification is performed based at least in part on whether the received electronic communication is associated with an indication of sender spoofing.

5. The system of claim 1, wherein the classification is performed based at least in part on information associated with a honeypot engine, wherein the honeypot engine is configured to collect fraudulent messages and corresponding sender information at least in part by generating traffic from one or more honeypot accounts, collecting the traffic, and evaluating the traffic.

6. The system of claim 1, wherein the generated entry includes a friendly location.

7. The system of claim 6, wherein the friendly location is associated with a friendly email address.

8. The system of claim 6, wherein the friendly location is indicated at least in part by at least one of IP blocks or subnets, a political designation, and a distance from a given location.

9. A method, comprising:

obtaining information associated with a plurality of electronic communications associated with an entity;

generating, in a whitelist, an entry including information associated with a given email address, wherein the entry including the information associated with the given email address is generated based at least in part on a determination, from the obtained information associated with the plurality of electronic communications associated with the entity, that at least a threshold number of electronic communications have been exchanged between the entity and the given email address, and that the at least threshold number of emails were exchanged during a period of time that exceeds a threshold period of time;

subsequent to generating the whitelist entry, receiving an electronic communication to be classified; and

performing, using one or more processors, a classification of the received electronic communication based at least in part on a determination of whether the received electronic communication corresponds to an entry in the whitelist, wherein performing the classification includes assigning to the received electronic communication a single one of three different classifications according to a tertiary classification scheme, wherein the three classifications include good, bad, and undetermined;

based at least in part on the bad or undetermined classification, changing the appearance of the received electronic communication by at least one of;

redacting a first portion of the received electronic communication, textually or visually clarifying the received electronic communication, highlighting a second portion of the received electronic communication, and marking the message as highly suspicious;

wherein the one or more processors are further configured to perform an action based at least in part on the bad or undetermined classification, wherein the action comprises at least one of;

delivering the received electronic communication in a folder selected based at least in part on the classification,

delivering the received electronic communication to an account selected based at least in part on the classification,

holding the received electronic communication in a repository,

forwarding the received electronic communication to a remote classifier, and

forwarding the received electronic communication for human review, wherein a reputation score is maintained for a human reviewer, and wherein the reputation score indicates a review accuracy of the human reviewer.

10. The method of claim 9, wherein the generated entry includes the given email address.

11. The method of claim 9, wherein at least one entry in the whitelist is associated with a benign service provider.

12. The method of claim 9, wherein the classification is performed based at least in part on whether the received electronic communication is associated with an indication of sender spoofing.

13. The method of claim 9, wherein the classification is performed based at least in part on information associated with a honeypot engine, wherein the honeypot engine is configured to collect fraudulent messages and corresponding sender information at least in part by generating traffic from one or more honeypot accounts, collecting the traffic, and evaluating the traffic.

14. The method of claim 9, wherein the generated entry includes a friendly location.

15. The method of claim 14, wherein the friendly location is associated with a friendly email address.

16. The method of claim 14, wherein the friendly location is indicated at least in part by at least one of IP blocks or subnets, a political designation, and a distance from a given location.

17. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

obtaining information associated with a plurality of electronic communications associated with an entity;

generating, in a whitelist, an entry including information associated with a given email address, wherein the entry including the information associated with the given email address is generated based at least in part on a determination, from the obtained information associated with the plurality of electronic communications associated with the entity, that at least a threshold number of electronic communications have been exchanged between the entity and the given email address, and that the at least threshold number of emails were exchanged during a period of time that exceeds a threshold period of time;

subsequent to generating the whitelist entry, receiving an electronic communication to be classified; and

performing, using one or more processors, a classification of the received electronic communication based at least in part on a determination of whether the received electronic communication corresponds to an entry in the whitelist, wherein performing the classification includes assigning to the received electronic communication a single one of three different classifications according to a tertiary classification scheme, wherein the three classifications include good, bad, and undetermined;

based at least in part on the bad or undetermined classification, changing the appearance of the received electronic communication by at least one of;

redacting a first portion of the received electronic communication, textually or visually clarifying the received electronic communication, highlighting a second portion of the received electronic communication, and marking the message as highly suspicious;

wherein the one or more processors are further configured to perform an action based at least in part on the bad or undetermined classification, wherein the action comprises at least one of;

delivering the received electronic communication in a folder selected based at least in part on the classification,

delivering the received electronic communication to an account selected based at least in part on the classification,

holding the received electronic communication in a repository,

forwarding the received electronic communication to a remote classifier, and

forwarding the received electronic communication for human review, wherein a reputation score is maintained for a human reviewer, and wherein the reputation score indicates a review accuracy of the human reviewer.