Message profiling systems and methods

• US 20060015563A1
• Filed: 07/01/2005
• Published: 01/19/2006
• Est. Priority Date: 03/08/2002
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: Ciphertrust, Incorporated (McAfee, LLC)
• Inventors: Alperovitch, Dmitri, Judge, Paul, Rajan, Guru, Moyer, Matt
• Granted Patent: US 8,132,250 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

Methods and systems for operation upon one or more data processors that classify communications from messaging entities. A method can include receiving a communication that was sent from a messaging entity. A plurality of message classification techniques is used to classify the communication. Each message classification technique is associated with a confidence value which is used in generating a message classification output from the message classification technique. The message classification outputs are combined in order to generate a message profile score. The message Profile score is used in deciding what action is to be taken with respect to the communication associated with the messaging entity.

Claims

1. A method for operation upon one or more data processors to classify communications from messaging entities, comprising:

receiving a communication from a messaging entity;

using a plurality of message classification techniques to classify the communication;

combining the message classification outputs in order to generate a message profile score;

wherein the message profile score is used in deciding what action is to be taken with respect to the communication associated with the messaging entity.

2. The method of claim 1, wherein the communication is a e-mail message or VoIP communication or Instant Messaging communication.

3. The method of claim 1, wherein the communication is a legitimate e-mail message or spam or a virus or a communication that violates corporate policy.

4. The method of claim 1, wherein the message classification techniques include at least two techniques selected from the group:

a Reverse DNS (RDNS) classification technique, Real-time Black-hole Lists (RBLs) classification technique, reputation server classification technique, signature-based classification technique, fingerprinting-based classification technique, message header analysis classification technique, sender authentication set of classification techniques, Bayesian filtering statistical classification technique, clustering classification technique, and content filtering classification technique.

5. The method of claim 1, wherein each message classification technique is associated with a confidence value which is used in generating a message classification output from the message classification technique.

6. The method of claim 5, wherein a filter value from each of the classification techniques is multiplied by its associated confidence value in order to generate the message classification output.

7. The method of claim 6, further comprising:

iterating through the classification techniques and allowing each technique to attempt to classify the message;

wherein the output of each classification is a numeric value, textual value, or categorical value.

8. The method of claim 7, wherein the message profile score is determined by:

9. The method of claim 7, wherein the message P_Rofile score is determined by:

10. The method of claim 1, wherein at least one of the message classification techniques includes a reputation scoring technique;

wherein the reputation scoring technique assigns a reputation probability to a messaging entity;

wherein the reputation indicative probability indicates reputability of a messaging entity based upon extent to which the identified one or more communication'"'"'s characteristics exhibit or conform to one or more reputation-related criteria.

11. The method of claim 1, wherein the communication was sent over a network.

12. A system for operation upon one or more data processors to classify communications from messaging entities, comprising:

a plurality of message classification techniques;

wherein the plurality of message classification techniques are configured to classify a communication received from a messaging entity;

message profiling logic configured to combine the message classification outputs in order to generate a message profile score;

wherein the message profile score is used in deciding what action is to be taken with respect to the communication associated with the messaging entity.

13. The system of claim 12, wherein the communication is a e-mail message or VoIP communication or Instant Messaging communication.

14. The system of claim 12, wherein the communication is a legitimate message or unwanted communication or a communication violative of a pre-selected policy.

15. The system of claim 14, wherein an unwanted communication includes a spam or virus communication;

wherein the pre-selected policy includes a corporate communication policy, a messaging policy, a legislation or regulatory policy, or an international communication policy.

16. The system of claim 12, wherein the message classification techniques include at least two techniques selected from the group:

Reverse DNS (RDNS) classification technique, Real-time Black-hole Lists (RBLs) classification technique, reputation server classification technique, signature-based classification technique, fingerprinting-based classification technique, message header analysis classification technique, sender authentication set of classification techniques, Bayesian filtering statistical classification technique, clustering classification technique, and content filtering classification technique.

17. The system of claim 12, wherein each message classification technique is associated with a confidence value which is used in generating a message classification output from the message classification technique.

18. The system of claim 17, wherein a filter value from each of the classification techniques is multiplied by its associated confidence value in order to generate the message classification output.

19. The system of claim 18, wherein the output of each classification is a numeric value, textual value, or categorical value.

20. The system of claim 19, wherein a tuner program is used to tune the confidence values associated with the message classification techniques.

21. The system of claim 20, wherein the tuner program uses a heuristic approach in order to tune the confidence values.

22. The system of claim 20, wherein the tuner program uses a genetic algorithm to tune the confidence values.

23. The system of claim 22, wherein the genetic algorithm is designed with a fitness function that models the fitness of candidate solutions in the actual problem domain.

24. The system of claim 23, wherein the fitness function expresses the cost associated with the mistakes that a configuration made in attempting to correctly classify message vectors in the set of pre-classified data.

25. The system of claim 24, wherein the system is configured to operate with adaptive message blocking and whitelisting.

26. The system of claim 12, wherein at least one of the message classification techniques includes a reputation scoring technique;

wherein the reputation scoring technique assigns a reputation probability to a messaging entity;

wherein the reputation indicative probability indicates reputability of a messaging entity based upon extent to which the identified one or more communication'"'"'s characteristics exhibit or conform to one or more reputation-related criteria.

27. The system of claim 12, wherein the communication was sent over a network.

28. A system for operation upon one or more data processors to classify communications from messaging entities, comprising:

means for receiving a communication that was sent over a network from a messaging entity;

means for using a plurality of message classification techniques to classify the communication;

wherein each message classification technique is associated with a confidence value which is used in generating a message classification output from the message classification technique;

means for combining the message classification outputs in order to generate a message profile score;

wherein the message profile score is used in deciding what action is to be taken with respect to the communication associated with the messaging entity.

29. An article of manufacture comprising a digital signal for transmission using a network;

wherein the digital signal includes a message profile score that has been generated according to method comprising;

receiving a communication that was sent over a network from a messaging entity;

using a plurality of message classification techniques to classify the communication;

combining the message classification outputs in order to generate a message profile score;

wherein the message profile score is used in deciding what action is to be taken with respect to the communication associated with the messaging entity.

30. The article of claim 29, wherein the digital signal includes packetized data that is transmitted through the network.

31. A method for operation upon one or more data processors for tuning message classification parameters for use by one or more message classification techniques, comprising:

receiving a plurality of input data that is or is representative of a plurality of communications;

using a tuner program to tune the message classification parameters associated with the message classification techniques;

wherein a communication is received from a messaging entity;

wherein the tuned message classification parameters are used by the plurality of message classification techniques to classify the received communication;

wherein message classification outputs from the plurality of message classification techniques are combined in order to generate a message profile score;

wherein the message profile score is used in deciding what action is to be taken with respect to the communication associated with the messaging entity.

32. The method of claim 31, wherein the message classification parameters include confidence values.

33. The method of claim 32, wherein the tuner program uses a heuristic approach in order to tune the confidence values.

34. The method of claim 33, wherein the tuner program uses a genetic algorithm to tune the confidence values.

35. The method of claim 34, wherein the genetic algorithm is designed with a fitness function that models the fitness of candidate solutions in the actual problem domain.

36. The method of claim 35, wherein the fitness function expresses cost associated with the mistakes that a configuration made in attempting to correctly classify message vectors in the set of pre-classified data.

37. The method of claim 36, wherein the fitness function is:

38. The method of claim 36, wherein the method is configured to operate with adaptive message blocking and whitelisting.

39. The method of claim 31, wherein the received communication is a e-mail message or VoIP communication or Instant Messaging communication.

40. The method of claim 31, wherein the received communication is a legitimate e-mail message or spam or a virus or a communication that violates corporate policy.

41. The method of claim 31, wherein the message classification techniques include at least two techniques selected from the group:

a Reverse DNS (RDNS) classification technique, Real-time Black-hole Lists (RBLs) classification technique, reputation server classification technique, signature-based classification technique, fingerprinting-based classification technique, message header analysis classification technique, sender authentication set of classification techniques, Bayesian filtering statistical classification technique, clustering classification technique, and content filtering classification technique.

42. The method of claim 31, wherein the message classification parameters include confidence values;

wherein a message classification technique is associated with a confidence value which is used in generating a message classification output from the message classification technique.

43. The method of claim 42, wherein a filter value from each of the classification techniques is multiplied by its associated confidence value in order to generate a message classification output.

44. The method of claim 43, further comprising:

iterating through the classification techniques and allowing each technique to attempt to classify the message;

wherein the output of each classification is a numeric value, textual value, or categorical value.

45. The method of claim 31, wherein at least one of the message classification techniques includes a reputation scoring technique;

wherein the reputation scoring technique assigns a reputation probability to a messaging entity;

wherein the reputation indicative probability indicates reputability of a messaging entity based upon extent to which the identified one or more communication'"'"'s characteristics exhibit or conform to one or more reputation-related criteria.

46. The method of claim 31, wherein the communication was sent over a network.

47. A system for operation upon one or more data processors for tuning message classification parameters for use by one or more message classification techniques, comprising:

input logic to receive a plurality of input data that is or is representative of a plurality of communications;

a tuner program to tune the message classification parameters associated with the message classification techniques;

wherein a communication is received from a messaging entity;

wherein the tuned message classification parameters are used by the plurality of message classification techniques to classify the communication;

wherein message classification outputs from the plurality of message classification techniques are combined in order to generate a message profile score;

wherein the message profile score is used in deciding what action is to be taken with respect to the communication associated with the messaging entity.