Systems and methods for upstream threat pushback

• US 20030172294A1
• Filed: 02/24/2003
• Published: 09/11/2003
• Est. Priority Date: 03/08/2002
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: Secure Computing Corporation (McAfee, LLC)
• Inventors: Judge, Paul
• Granted Patent: US 7,213,260 B2
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

The present invention is directed to systems and methods for detecting and preventing the delivery of unsolicited communications. A communication transmitted over a communications network is received and analyzed by a system processor. The system processor can extract attributes from the communication and compare extracted attributes to information stored in a system data store. In processing the communication, the system processor may assign a confidence level) a trust level, or other indicia of content. The results of that processing, analysis, and comparison can be propagated to one or more upstream computers in the path from the communication'"'"'s origin to its destination. Such one or more upstream computers are identified from within the content of the communication, the header of the communication and/or the transfer protocol interactions in receiving the communication. The identified computers are authenticated to limit forgery. The upstream computers receiving the propagated information can selectively apply the information to reduce the flow of communications exhibiting the same threat and/or undesirable characteristics.

Claims

1. A method for identifying a back trail for an electronic communications, the method comprising the steps of:

a) receiving an electronic communication comprising a destination address;

b) identifying one or more addresses of computer systems in a path from a source to the destination address;

c) analyzing authenticity of at least one of the identified computer system addresses; and

d) outputting one or more computer system addresses analyzed to be authentic.

2. The method of claim 1, wherein the received electronic communication comprises a header that includes the destination address and wherein the step of identifying one or more addresses comprises the steps of parsing the header for computer system addresses.

3. The method of claim 2, wherein the step of analyzing authenticity comprises identifying inconsistencies in the header.

4. The method of claim 3, wherein the step of identifying inconsistencies comprises identifying inconsistencies in date information, server version information, receive from information, recipient information or combinations thereof.

5. The method of claim 2, wherein the step of analyzing authenticity comprises identifying inconsistencies between the header, transfer information associated with the communication, content of the communication, or combinations thereof.

6. The method of claim 1, wherein the step of analyzing authenticity comprises analyzing authenticity of each of the identified computer system addresses.

7. The method of claim 1, wherein the step of analyzing authenticity comprises accessing an external database of address verification information.

8. The method of claim 7, wherein the external database comprises IP addresses or ASN numbers of known originators of spam.

9. The method of claim 7, wherein the address verification information comprises IP addresses, ASN numbers, host names, domain names, e-mail addresses or combinations thereof.

10. The method of claim 1, wherein the step of analyzing authenticity comprises performing a DNS lookup based upon the at least one identified computer system addresses.

11. The method of claim 1, wherein the step of analyzing authenticity comprises assigning a confidence level to each of the at least one identified computer system addresses.

12. The method of claim 11, wherein the step of assigning a confidence level to each of the at least one identified computer system addresses comprises assigning a confidence level to each of the identified computer system addresses.

13. The method of claim 11, wherein the step of analyzing authenticity further comprises comparing the assigned confidence level with a predetermined threshold.

14. The method of claim 11, wherein the step of outputting further comprises outputting the confidence level associated with each computer system address verified as authentic.

15. The method of claim 1, and further comprising the step of outputting computer system addresses not analyzed to be authentic.

16. A system for identifying a back trail for an electronic communications, the system comprising:

a) a interface adapted to link the system with a communication network;

b) a system data store capable of storing one or more electronic communications, data associated therewith, configuration data or combinations thereof; and

c) a system processor in communication with the interface and the system data store and comprising one or more processing elements, wherein the one or more processing elements are programmed or adapted to;

i) receive an communication via the interface, wherein the received communication comprises a header having a destination address;

ii) store the received communication in the system data store;

iii) parse the header of the received communication for one or more addresses of computer systems in a path between a source and the destination address;

iv) perform a plurality of tests on each of the one or more addresses to assign a confidence value to each address;

v) determine whether each address is valid by comparing its assigned confidence value to a predetermined threshold in the system data store; and

vi) output each address determined valid.

17. The system of claim 16, wherein the system processor outputs each address determined valid with a first indicator.

18. The system of claim 17, wherein the system processor is further programmed or adapted to output each address not determined valid with a second indicator.

19. A system for identifying a back trail for an electronic communication, the system comprising:

a) interface means for receiving communications transmitted over a communication network;

b) storage means for storing at least one or more received communications, data associated therewith, configuration data or combinations thereof;

c) identification means for identifying from a received communication one or more addresses along a path between a source of a received communication and a destination of the received communication;

d) verification means for verifying each address identified by the identification means comprising means for assigning a confidence value to each address and means for comparing the confidence value assigned to each address with a predetermined threshold in the storage means; and

e) means for outputting verified addresses.

20. Computer readable media storing instruction that upon execution by a system processor cause the system processor to identify a back trail for an electronic communication by performing the steps comprising of:

a) receiving an communication via the interface, wherein the received communication comprises a header having a destination address;

b) storing the received communication in the system data store;

c) parsing the header of the received communication for one or more addresses of computer systems in a path between a source and the destination address;

d) performing a plurality of tests on each of the one or more addresses to assign a confidence value to each address;

e) determining whether each address is valid by comparing its assigned confidence value to a predetermined threshold in the system data store; and

f) outputting each address determined valid.

21. A threat push-back system within, or in communication with, an application layer security system, a threat management center or an application client, the system comprising:

a) an interface communicatively coupling the system to a communication network;

b) a system data store capable of storing an electronic communication and accumulated data associated with one or more received electronic communications; and

c) a system processor in communication with the system data store and the interface, wherein the system processor comprises one or more processing elements and wherein the system processor;

i) receives a communication via the interface;

ii) generates a threat profile associated with the received communication;

iii) stores in the system data store the generated threat profile associated with the received communication;

iv) compares the generated threat profile with threat configuration information;

v) if the comparison indicates the received communication represent a threat,

1) determines one or more computer addresses in a back path of the received communication; and

2) outputs information based upon the stored threat profile to one or more upstream computers associated with one or more of the determined addresses.

22. The system of claim 21, wherein the system processor generates the threat profile by applying one or more tests to the received communication, wherein each of the one or more tests evaluates the received communication for a particular security risk.

23. The system of claim 22, wherein the system processor generates the threat profile by further determining whether an anomaly exists with respect to the received communication based upon the applied one or more tests and accumulated data associated with received communications from the system data store.

24. The system of claim 21, wherein the system processor further provides an interface for identifying threat types, receives threat type information from the provided interface and updates threat configuration information in the system data store based upon the received threat type information.

25. The system of claim 24, wherein the system processor provides an interface for identifying threat types comprising of business email, personal email, chain letters, adult language, porn, web product offerings, newsletters, mailing lists, worms, virus, server attack or combinations thereof.

26. The system of claim 24, wherein the system processor provides an interface allowing identification of threat types and specification of a weight associated for each identified threat type.

27. The system of claim 21, wherein the system processor compares the generated threat profile with threat configuration information by calculating a threat value from the threat profile and determining whether the threat value satisfies a predetermined threat condition.

28. The system of claim 27, wherein the system processor calculates the threat value by retrieving weights associate with threat types in the configuration data and threat type values associated with the respective threat types from the threat profile and generating a weighted sum based upon the retrieved weights and threat type values.

29. The system of claim 28, wherein the system processor calculates the threat value by selecting threat types for retrieval of weights and values based upon the predetermined threat condition.

30. The system of claim 21, wherein the system processor determines one or more back path computer addresses by at least parsing a header associated with the received communication for computer system addresses to identify computer addresses.

31. The system of claim 30, wherein the system processor determines one or more back path computer addresses by at least analyzing authenticity of at least one of the identified computer system addresses.

32. The system of claim 21, wherein the system processor is further programmed or adapted to map determined addresses into upstream computers by reference to a database of security.

33. The system of claim 21, wherein the system processor outputs information based upon the stored threat profile to one or more upstream threat management computers, one or more upstream application layer security systems or combinations thereof.

34. The system of claim 21, wherein the system processor outputs information to one or more upstream computers one or more threat types, one or more threat source identifiers, one or more threat details, one or more response details or combinations thereof.

35. The system of claim 34, wherein the system processor outputs information to one or more upstream computers one or more source identifiers, wherein each source identifier is an e-mail address, a domain name, a host name, an IP address or combinations thereof.

36. The system of claim 35, wherein each source identifier includes an associated confidence value.

37. The system of claim 21, wherein the system processor outputs information according to a standardized threat information protocol.

38. The system of claim 37, wherein the system processor outputs information according to a protocol selected from the group consisting of SNMP, Intrusion Detection Message Exchange Format (IDMEF), and Intrusion Detection Exchange Protocol (IDXP).

39. The system of claim 21, wherein the system processor is further programmed or adapted to output a threat notification if the comparison indicates the received communication represent a threat.

40. The system of claim 39, wherein the system processor outputs the threat notification to one or more computer systems.

41. The system of claim 39, wherein the system processor outputs the threat notification as an e-mail message, a page, a facsimile, an telephone call, an SMS message, a WAP alert, an SNMP alert or combinations thereof.

42. The system of claim 21, wherein the system processor is further programmed or adapted to take a corrective measure if the comparison indicates the received communication represents a threat.

43. The system of claim 42, wherein the corrective measure comprises conveying a notification to one or more users, refusing acceptance of further communications from the source of the received communication, quarantine of the received communication, stripping the received communication of identified content, or throttling excessive numbers of incoming connections per second to levels manageable by internal application servers.

44. The system of claim 43, wherein the corrective measure comprises conveying a notification to one or more users and wherein each notification comprises an e-mail message, a page, a facsimile, an telephone call, an SMS message, a WAP alert or SNMP alert.

45. A computer implemented threat push-back method, the method comprising the steps of:

a) providing an interface for establishing configuration information regarding one or more threat types, wherein configuration information comprises threat types of interest and weights associated therewith;

b) receiving a communication;

c) generating a threat profile associated with the received communication by applying one or more tests to the received communication, wherein each of the one or more tests evaluates the received communication for a particular security risk;

d) comparing the generated threat profile with the configuration information by calculating a threat value from the threat profile and determining whether the threat value satisfies a predetermined threat condition; and

e) if the comparison indicates the received communication represents a threat,

i) determining one or more computer addresses in a back path of the received communication;

ii) analyzing authenticity of at least one of the determined computer system addresses;

iii) taking a corrective measure, wherein the corrective measure comprises conveying a notification to one or more users, refusing acceptance of further communications from the source of the received communication, quarantine of the received communication, stripping the received communication of identified content, or throttling excessive numbers of incoming connections per second to levels manageable by internal application servers, wherein each notification conveyed comprises an e-mail message, a page, a facsimile, an telephone call, an SMS message, a WAP alert or SNMP alert; and

iv) outputting information based upon the stored threat profile to one or more upstream application layer security system, one or more threat management system, or combinations thereof, wherein each upstream application layer security system or threat management system is associated with one or more of the determined addresses.

46. Computer readable media storing instructions that upon execution by a system processor cause the system processor to identify and push-back threat information upstream of an identified threat by performing the steps comprising of:

a) providing an interface for establishing configuration information regarding one or more threat types, wherein configuration information comprises threat types of interest and weights associated therewith;

b) receiving a communication;

c) generating a threat profile associated with the received communication by applying one or more tests to the received communication, wherein each of the one or more tests evaluates the received communication for a particular security risk;

d) comparing the generated threat profile with the configuration information by calculating a threat value from the threat profile and determining whether the threat value satisfies a predetermined threat condition; and

e) if the comparison indicates the received communication represents a threat,

i) determining one or more computer addresses in a back path of the received communication;

ii) analyzing authenticity of at least one of the determined computer system addresses;

iii) outputting a threat notification to one or more users, wherein each outputted threat notification comprises an e-mail message, a page, a facsimile, an telephone call, an SMS message, a WAP alert, or an SNMP alert; and

iv) outputting information based upon the stored threat profile to one or more upstream application layer security system, one or more threat management system, or combinations thereof, wherein each upstream application layer security system or threat management system is associated with one or more of the determined addresses.

47. A threat push-back system within, or in communication with, an application layer security system, a threat management center or an application client, the system comprising:

a) configuration means for establishing configuration information regarding one or more threat types, wherein configuration information comprises threat types of interest and weights associated therewith;

b) receiving means for receiving an electronic communication;

c) means for generating a threat profile associated with the received communication by applying one or more tests to the received communication, wherein each of the one or more tests evaluates the received communication for a particular security risk;

d) means for comparing the generated threat profile with the configuration information by calculating a threat value from the threat profile and determining whether the threat value satisfies a predetermined threat condition; and

e) back path identification means for determining one or more computer addresses in a back path of the received communication;

f) authentication means for authenticating at least one of the one or more computer addresses from the back path identification means;

g) output means for outputting information based upon the stored threat profile to one or more upstream application layer security system, one or more threat management system, or combinations thereof, wherein each upstream application layer security system or threat management system is associated with one or more of the determined addresses; and

h) means for taking a corrective measure, wherein the corrective measure comprises conveying a notification to one or more users, refusing acceptance of further communications from the source of the received communication, quarantine of the received communication, stripping the received communication of identified content, or throttling excessive numbers of incoming connections per second to levels manageable by internal application servers, wherein each notification conveyed comprises an e-mail message, a page, a facsimile, an telephone call, an SMS message, a WAP alert or SNMP alert.