Systems and methods for classification of messaging entities

• US 20060015942A1
• Filed: 06/02/2005
• Published: 01/19/2006
• Est. Priority Date: 03/08/2002
• Status: Abandoned Application

• Current Assignee: McAfee, Inc. (McAfee, LLC)
• Original Assignee: Ciphertrust, Incorporated (McAfee, LLC)
• Inventors: Alperovitch, Dmitri, Judge, Paul, Moyer, Matt
• Application Number:
  US11/142,943
• Publication Number:
  US 20060015942A1
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 11/008 Reliability or availability analysis
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

Methods and systems for operation upon one or more data processors for assigning a reputation to a messaging entity. A method can include receiving data that identifies one or more characteristics related to a messaging entity'"'"'s communication. A reputation score is determined based upon the received identification data. The determined reputation score is indicative of reputation of the messaging entity. The determined reputation score is used in deciding what action is to be taken with respect to a communication associated with the messaging entity.

Claims

1. A method for operation upon one or more data processors to assign a reputation to a messaging entity, comprising:

receiving data that identifies one or more characteristics related to a messaging entity'"'"'s communication;

determining a reputation score based upon the received identification data;

wherein the determined reputation score is indicative of reputation of the messaging entity;

wherein the determined reputation score is used in deciding what action is to be taken with respect to a communication associated with the messaging entity.

2. The method of claim 1, wherein the determined reputation score is distributed to one or more computer systems for use in filtering transmissions.

3. The method of claim 1, wherein the determined reputation score is locally distributed to a program for use in filtering transmissions.

4. The method of claim 1, wherein reputation scores include numeric, textual or categorical reputations that are assigned to messaging entities based on characteristics of the messaging entities and their behavior;

wherein the numeric reputations fluctuate between a continuous spectrum of reputable and non-reputable classifications.

5. The method of claim 1 further comprising:

determining reputation indicative probabilities based upon the received identification data;

wherein a reputation indicative probability indicates reputability of a messaging entity based upon extent to which the identified one or more communication'"'"'s characteristics exhibit or conform to one or more reputation-related criteria;

wherein determining the reputation score includes determining the reputation score based upon aggregation of the determined probabilities.

6. The method of claim 5, wherein a type of messaging entity to which reputations are assigned is a domain name, IP address, phone number, or individual electronic address or username representing an organization, computer, or individual user that transmits electronic messages.

7. The method of claim 1 further comprising:

identifying a set of criteria for use in discriminating between reputable and non-reputable classifications;

wherein the criteria include non-reputable criteria and reputable criteria;

using statistical sampling to estimate a conditional probability that a messaging entity displays each criteria;

computing a reputation for each messaging entity, wherein the computing step comprises;

calculating probability that a messaging entity deserves a reputable reputation by computing an estimate of joint conditional probability that the messaging entity is reputable, given the set of criteria that the messaging entity exhibits or conforms to and the individual conditional probability that the messaging entity exhibits or conforms to each such criteria is actually a reputable messaging entity;

calculating the probability that the messaging entity deserves a negative reputation by computing an estimate of joint conditional probability that the messaging entity is non-reputable, given the set of criteria that the messaging entity exhibits or conforms to and the individual conditional probability that the messaging entity exhibits or conforms to each such criteria is actually a non-reputable messaging entity;

computing a reputation for a messaging entity by applying a function to the probabilities.

8. The method of claim 7, wherein the reputation of each messaging entity is encoded within the form of a 32-bit, dotted decimal IP address;

said method further comprising;

creating a domain name server (DNS) zone comprising the reputations of all messaging entities in a universe of messaging entities; and

distributing reputations of messaging entities, via the DNS protocol, to one or more computer systems that make use of the reputations for their work.

9. The method of claim 7, wherein the set of criteria are metrics selected from the group:

a mean Spam Profiler score;

a reverse domain name server lookup failure;

membership on one or more real-time blacklists (RBLs);

mail volume;

mail burstiness;

mail breadth;

a geographic location;

malware activity;

a type of address;

a classless inter-domain routing (CIDR) block comprising a number of internet protocol addresses identified to send spam;

rate of user complaints;

rate of honeypot detections;

rate of undeliverable transmissions, identified conformance with laws, regulations, and well-established standards of transmission behavior;

continuity of operation;

responsiveness to recipient demands; and

combinations thereof.

10. The method of claim 7, wherein a technique used to compute the joint conditional probabilities is based on probabilistic independence between all criteria.

11. The method of claim 7, wherein a technique used to compute the joint conditional probabilities is based on a joint probability estimation technique.

12. The method of claim 7, wherein a technique used to compute joint conditional probabilities is based on probabilistic non-independence between all criteria.

13. The method of claim 7, wherein the function used to encode the messaging entity reputation within a 32-bit dotted decimal IP address is:

14. The method of claim 7, wherein classifications of reputable and non-reputable are related to a tendency for an IP address to send unwanted transmissions or legitimate communication.

15. The method of claim 1 further comprising:

determining reputation indicative probabilities based upon the received identification data;

wherein a reputation indicative probability indicates reputability of a messaging entity based upon extent to which the identified one or more communication'"'"'s characteristics exhibit or conform to one or more reputation-related criteria;

wherein determining the reputation score includes determining the reputation score based upon aggregation of the determined probabilities.

wherein the reputation score is determined based upon applying the aggregation of the determined probabilities to a function;

wherein the function is a function of each of the probabilities that the messaging entity exhibits a reputation-related criterion.

16. A method of performing transmission filtering utilizing reputation scores of transmission sender, the method comprising:

identifying at least one characteristic about a transmission from a sender;

performing a real-time query to the reputation system that includes the transmission characteristic;

receiving a score representing reputation related to the transmission;

performing an action on the transmission from the sender corresponding to the score range of the sender'"'"'s reputation.

17. The method of claim 16, wherein the action includes at least one of the following actions:

rejecting all further transmissions from that sender for a preset period of time or number of transmissions;

silently dropping all further transmissions from that sender for a preset period of time or number of transmissions;

quarantining all further transmissions from that sender for a preset period of time or number of transmissions;

bypassing certain filtering tests for all further transmissions from that sender for a preset period of time or number of transmissions.

18. The method of claim 16, wherein the step of identifying at least one characteristic includes extracting unique identifying information about the transmission, or authenticating unique identifying information about the transmission, or combinations thereof.

19. The method of claim 18, wherein the unique identifying information includes information about the sender of the transmission.

20. A method of performing filtering of groups of transmissions utilizing reputation scores of senders of transmissions, the method comprising:

grouping multiple transmissions together based on content similarities or similarities in transmission sender behavior;

identifying at least one characteristic about each transmission in the groupings;

performing a query to the reputation system and receiving a score representing reputation of each sender;

classifying groups of transmissions based on the percentage of reputable and non-reputable senders in the group.

21. The method of claim 20, wherein the step of identifying at least one characteristic includes extracting unique identifying information about the transmission, or authenticating unique identifying information about the transmission, or combinations thereof.

22. The method of claim 21, wherein the unique identifying information includes information about the sender of a transmission.

23. A method of performing tuning and training of filtering systems utilizing reputation scores of senders of transmissions in sets of trainable transmissions, the method comprising:

identifying at least one characteristic about transmissions from senders;

performing queries to a reputation system and receiving scores representing reputations of the senders;

classifying transmissions into multiple categories based on a range a sender'"'"'s reputation score falls into;

passing on transmissions and their classification categories to a trainer of another filtering system to be used for optimization of the filtering system.

24. The method of claim 23, wherein the step of identifying at least one characteristic includes extracting unique identifying information about the transmissions, or authenticating unique identifying information about the transmissions, or combinations thereof.

25. The method of claim 24, wherein the unique identifying information includes information about the senders of the transmissions.

26. An article of manufacture comprising a digital signal for transmission using a network;

wherein the digital signal includes a query to a reputation process;

wherein the reputation process assigns a reputation to a messaging entity by receiving the query containing data related to a messaging entity'"'"'s identity;

wherein the identity data is used by the reputation process to determine reputation indicative probabilities;

wherein a reputation indicative probability indicates reputability of a messaging entity based upon extent to which the messaging entity exhibits or conforms to a reputation-related criterion;

wherein a reputation score is determined based upon aggregation of the determined probabilities;

wherein the determined reputation score is indicative of reputation of the messaging entity;

wherein the determined reputation score is used in deciding what action is to be taken with respect to a communication associated with the messaging entity.

27. The digital signal of claim 26, wherein a filtering system generates the digital signal and the reputation process receives the digital signal;

wherein the digital signal includes packetized data that is transmitted through the network.