Tertiary classification of communications

• US 10,129,195 B1
• Filed: 10/17/2017
• Issued: 11/13/2018
• Est. Priority Date: 02/13/2012
• Status: Active Grant

• Current Assignee: ZapFraud, Inc. (Bjorn Markus Jakobsson)
• Original Assignee: ZapFraud, Inc. (Bjorn Markus Jakobsson)
• Inventors: Jakobsson, Bjorn Markus
• Primary Examiner(s): Khan, Aftab N.
• Application Number:
  US15/786,172
• Time in Patent Office: 392 Days
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

Information associated with a plurality of electronic communications between a first entity and a second entity is obtained. First and second determinations are performed that the number of communications in the plurality of electronic communications exceeds a first threshold, and that the plurality of electronic communications were exchanged during a period of time that exceeds a second threshold. A classification is performed on a received electronic communication based at least in part on the first determination and the second determination, the electronic communication is assigned one of three different classifications: good, bad, and undetermined. At least one action is performed based at least in part on the performed classification.

Claims

1. A system, comprising:

one or more processors configured to;

obtain information associated with a plurality of electronic communications between a first entity and a second entity;

perform a first determination that the number of communications in the plurality of electronic communications exceeds a first threshold;

perform a second determination that the plurality of electronic communications were exchanged during a period of time that exceeds a second threshold;

receive an electronic communication to be classified; and

perform a classification of the received electronic communication based at least in part on the first determination and the second determination, wherein performing the classification includes assigning to the received electronic communication a single one of three different classifications according to a tertiary classification scheme, wherein the three classifications include good, bad, and undetermined;

based at least in part on the bad or undetermined classification, change the appearance of the received electronic communication by at least one of;

redacting a first portion of the received electronic communication, textually or visually clarifying the received electronic communication, highlighting a second portion of the received electronic communication, and marking the message as highly suspicious;

wherein the one or more processors are further configured to perform an action based at least in part on the bad or undetermined classification, wherein the action comprises at least one of;

delivering the received electronic communication in a folder selected based at least in part on the classification, delivering the received electronic communication to an account selected based at least in part on the classification,

holding the received electronic communication in a repository,

forwarding the received electronic communication to a remote classifier, and

forwarding the received electronic communication for human review, wherein a reputation score is maintained for a human reviewer, and wherein the reputation score indicates a review accuracy of the human reviewer; and

a memory coupled to the one or more processors and configured to provide the one or more processors with instructions.

2. The system of claim 1, wherein the classification is performed based at least in part on a given email address.

3. The system of claim 1, wherein the classification is performed based at least in part on whether the received electronic communication is associated with a benign service provider.

4. The system of claim 1, wherein the classification is performed based at least in part on whether the received electronic communication is associated with an indication of sender spoofing.

5. The system of claim 1, wherein the classification is performed based at least in part on information associated with a honeypot engine, wherein the honeypot engine is configured to collect fraudulent messages and corresponding sender information at least in part by generating traffic from one or more honeypot accounts, collecting the traffic, and evaluating the traffic.

6. The system of claim 1, wherein the classification is performed based at least in part on a friendly location.

7. The system of claim 6, wherein the classification is performed based at least in part on a friendly email address.

8. The system of claim 6, wherein the friendly location is indicated at least in part by at least one of IP blocks or subnets, a political designation, and a distance from a given location.

9. A method, comprising:

obtaining information associated with a plurality of electronic communications between a first entity and a second entity;

perform a first determination that the number of communications in the plurality of electronic communications exceeds a first threshold;

perform a second determination that the plurality of electronic communications were exchanged during a period of time that exceeds a second threshold;

receive an electronic communication to be classified; and

performing, using one or more processors, a classification of the received electronic communication based at least in part on a determination of whether the received electronic communication corresponds to an entry in the whitelist, wherein performing the classification includes assigning to the received electronic communication a single one of three different classifications according to a tertiary classification scheme, wherein the three classifications include good, bad, and undetermined;

based at least in part on the bad or undetermined classification, changing the appearance of the received electronic communication by at least one of;

redacting a first portion of the received electronic communication, textually or visually clarifying the received electronic communication, highlighting a second portion of the received electronic communication, and marking the message as highly suspicious;

wherein the one or more processors are further configured to perform an action based at least in part on the bad or undetermined classification, wherein the action comprises at least one of;

delivering the received electronic communication in a folder selected based at least in part on the classification, delivering the received electronic communication to an account selected based at least in part on the classification,

holding the received electronic communication in a repository,

forwarding the received electronic communication to a remote classifier, and

forwarding the received electronic communication for human review, wherein a reputation score is maintained for a human reviewer, and wherein the reputation score indicates a review accuracy of the human reviewer.

10. The method of claim 9, wherein the classification is based at least in part on a given email address.

11. The method of claim 9, wherein the classification is performed based at least in part on whether the received electronic communication is associated with a benign service provider.

12. The method of claim 9, wherein the classification is performed based at least in part on whether the received electronic communication is associated with an indication of sender spoofing.

13. The method of claim 9, wherein the classification is performed based at least in part on information associated with a honeypot engine, wherein the honeypot engine is configured to collect fraudulent messages and corresponding sender information at least in part by generating traffic from one or more honeypot accounts, collecting the traffic, and evaluating the traffic.

14. The method of claim 9, wherein the classification is based at least in part on a friendly location.

15. The method of claim 14, wherein the friendly location is associated with a friendly email address.

16. The method of claim 14, wherein the friendly location is indicated at least in part by at least one of IP blocks or subnets, a political designation, and a distance from a given location.

17. A system, comprising:

one or more processors configured to;

receive at least one whitelist entry;

receive an electronic communication to be classified; and

perform a classification of the received electronic communication based at least in part on a determination of whether the received electronic communication corresponds to an entry in the whitelist, wherein performing the classification includes assigning to the received electronic communication a single one of three different classifications according to a tertiary classification scheme, wherein the three classifications include good, bad, and undetermined;

based at least in part on the bad or undetermined classification, change the appearance of the received electronic communication by at least one of;

redacting a first portion of the received electronic communication, textually or visually clarifying the received electronic communication, highlighting a second portion of the received electronic communication, and marking the message as highly suspicious;

wherein the one or more processors are further configured to perform an action based at least in part on the bad or undetermined classification, wherein the action comprises at least one of;

delivering the received electronic communication in a folder selected based at least in part on the classification, delivering the received electronic communication to an account selected based at least in part on the classification,

holding the received electronic communication in a repository,

forwarding the received electronic communication to a remote classifier, and

forwarding the received electronic communication for human review, wherein a reputation score is maintained for a human reviewer, and wherein the reputation score indicates a review accuracy of the human reviewer; and

a memory coupled to the one or more processors and configured to provide the one or more processors with instructions.

18. The system of claim 17 wherein the at least one whitelist entry is provided by at least one of a user and an administrator.

19. The system of claim 17 wherein the at least one whitelist entry is automatically generated by obtaining information associated with a plurality of electronic communications between a first entity and a second entity;

performing a first determination that the number of communications in the plurality of electronic communications exceeds a first threshold;

performing a second determination that the plurality of electronic communications were exchanged during a period of time that exceeds a second threshold; and

creating the at least one whitelist entry from information associated with the first entity.

20. A method, comprising:

receiving at least one whitelist entry;

receiving an electronic communication to be classified; and

performing, using one or more processors, a classification of the received electronic communication based at least in part on a determination of whether the received electronic communication corresponds to an entry in the whitelist, wherein performing the classification includes assigning to the received electronic communication a single one of three different classifications according to a tertiary classification scheme, wherein the three classifications include good, bad, and undetermined;

based at least in part on the bad or undetermined classification, changing the appearance of the received electronic communication by at least one of;

redacting a first portion of the received electronic communication, textually or visually clarifying the received electronic communication, highlighting a second portion of the received electronic communication, and marking the message as highly suspicious;

wherein the one or more processors are further configured to perform an action based at least in part on the performed bad or undetermined classification, wherein the action comprises at least one of;

delivering the received electronic communication in a folder selected based at least in part on the classification, delivering the received electronic communication to an account selected based at least in part on the classification,

holding the received electronic communication in a repository,

forwarding the received electronic communication to a remote classifier, and

forwarding the received electronic communication for human review, wherein a reputation score is maintained for a human reviewer, and wherein the reputation score indicates a review accuracy of the human reviewer.

21. The method of claim 20 wherein the at least one whitelist entry is provided by at least one of a user and an administrator.

22. The method of claim 20 wherein the at least one whitelist entry is automatically generated by obtaining information associated with a plurality of electronic communications between a first entity and a second entity;

performing a first determination that the number of communications in the plurality of electronic communications exceeds a first threshold;

performing a second determination that the plurality of electronic communications were exchanged during a period of time that exceeds a second threshold; and

creating the at least one whitelist entry from information associated with the first entity.

23. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

obtaining information associated with a plurality of electronic communications between a first entity and a second entity;

perform a first determination that the number of communications in the plurality of electronic communications exceeds a first threshold;

perform a second determination that the plurality of electronic communications were exchanged during a period of time that exceeds a second threshold;

receive an electronic communication to be classified; and

performing, using one or more processors, a classification of the received electronic communication based at least in part on a determination of whether the received electronic communication corresponds to an entry in the whitelist, wherein performing the classification includes assigning to the received electronic communication a single one of three different classifications according to a tertiary classification scheme, wherein the three classifications include good, bad, and undetermined;

based at least in part on the bad or undetermined classification, changing the appearance of the received electronic communication by at least one of;

redacting a first portion of the received electronic communication, textually or visually clarifying the received electronic communication, highlighting a second portion of the received electronic communication, and marking the message as highly suspicious;

wherein the one or more processors are further configured to perform an action based at least in part on the bad or undetermined classification, wherein the action comprises at least one of;

delivering the received electronic communication in a folder selected based at least in part on the classification, delivering the received electronic communication to an account selected based at least in part on the classification,

holding the received electronic communication in a repository,

forwarding the received electronic communication to a remote classifier, and

forwarding the received electronic communication for human review, wherein a reputation score is maintained for a human reviewer, and wherein the reputation score indicates a review accuracy of the human reviewer.