Monitoring the flow of messages received at a server

• US 20060059238A1
• Filed: 05/27/2005
• Published: 03/16/2006
• Est. Priority Date: 05/29/2004
• Status: Active Grant

• Current Assignee: IronPort Systems Inc (Cisco Systems, Inc.)
• Original Assignee: IronPort Systems Inc (Cisco Systems, Inc.)
• Inventors: Slater, Charles S., Schlampp, Peter, Evans, Brennan H., Clegg, Paul J.
• Granted Patent: US 7,870,200 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/214 using selective forwarding

Abstract

An approach for monitoring electronic messages received at a server is disclosed. Message information for a plurality of electronic messages received at the server: is determined and stored in a queue. Based on the queue, aggregate information is generated for a particular network address of a plurality of network addresses. The aggregate information is generated for each time interval of a plurality of time intervals and displayed for the plurality of time intervals. In some implementations, input from a user is received, and based on the input, a modification is made regarding how future electronic messages from the particular network address are handled by the server. In some implementations, combined aggregate information is generated for two or more network addresses and then displayed. In some implementations, aggregate policy information indicating which policies have been applied to the electronic messages is generated and displayed for the time intervals.

Claims

1. A method for monitoring electronic messages received at a server, comprising:

determining message information for a plurality of electronic messages that is received at said server;

storing said message information in a queue;

based on said queue, generating aggregate information for a particular network address of a plurality of network addresses, wherein said aggregate information is generated for each time interval of a plurality of time intervals, and wherein said particular network address is included in said message information for one or more electronic messages of said plurality of electronic messages; and

displaying said aggregate information for said plurality of time intervals.

2. A method as recited in claim 1, wherein said plurality of electronic messages is a first plurality of electronic messages, and the method further comprises:

determining additional message information for a second plurality of electronic messages that is received at said server after said first plurality of electronic messages is received at said server;

storing said additional message information in said queue;

based on said queue, generating additional aggregate information for said particular network address of said plurality of network addresses, wherein said additional aggregate information is generated for an additional time interval, and wherein said particular network address is included in said additional message information for one or more electronic messages of said second plurality of electronic messages; and

displaying both at least a portion of said aggregate information for one or more time intervals of said plurality of time intervals and said additional aggregate information for said additional time interval.

3. A method as recited in claim 1, further comprising:

receiving, from a user, input that is associated with said particular network address; and

based on said input, modifying how one or more future electronic messages received at said server from said particular network address are handled by said server.

4. A method as recited in claim 3, wherein modifying how said one or more future electronic messages are handled by said server includes performing one action selected from the group consisting of (a) blocking future electronic messages received at said server from said particular network address, (b) allowing future electronic messages received at said server from said particular network address, and (c) allowing some future electronic messages received at said server from said particular network address and blocking other future electronic messages received at said server from said particular network address.

5. A method as recited in claim 1, wherein said message information includes a particular counter that is selected from the group consisting of (a) a first counter that indicates how many electronic messages are received at said server from said particular network address, (b) a second counter that indicates how many bytes are received at said server from said particular network address, (c) a third counter that indicates how many recipients are identified in electronic messages that are received at said server from said particular network address, and (d) a counter that indicates how many connections are received by said server from said particular network address.

6. A method as recited in claim 1, further comprising:

determining that a policy has been applied to one or more electronic messages of said plurality of electronic messages;

generating aggregate policy information for said particular network address, wherein 5 said aggregate policy information is generated for each time interval of said plurality of time intervals, and wherein said aggregate policy information indicates how many times said policy has been applied to electronic messages from said particular network address; and

displaying said aggregate policy information for said plurality of time intervals.

7. A method as recited in claim 6, wherein said policy is selected from the group consisting of a blacklist policy, a whitelist policy, a greylist policy, a spam policy, and a virus policy.

8. A method as recited in claim 1, further comprising:

based on said message information, generating combined aggregate information for at least two network addresses of said plurality of network addresses over each time interval of said plurality of time intervals, wherein said combined aggregate information is based on said aggregate information for each network address of said at least two network addresses; and

displaying said combined aggregate information for said plurality of time intervals.

9. A method as recited in claim 8, wherein:

each IP address of said at least two network addresses is associated with an identifier that is determined based on said message information for said each network address of said at least two network addresses; and

said identifier is selected from the group consisting of a network address, an Internet Protocol (IP) address, a partial IP address, a first range of IP addresses, a primary domain, a subdomain, a fully qualified domain name (FQDN), a partial FQDN, a classless inter-domain routing (CIDR) block, a partial CIDR block, a subnet, an organization identifier, a network owner, a reputation score, and a second range of reputation scores.

10. A method as recited in claim 1, further comprising:

for said particular network address of said plurality of network addresses, determining an average number of electronic messages received at said server from said particular network address over a specified time interval, based on aggregate information for said particular network address for two or more previous specified time intervals;

for said particular network address, determining a current number of electronic messages received at said server from said particular network address over said specified time interval; and

displaying a comparison of said average number of electronic messages to said current number of electronic messages.

11. A machine-readable medium carrying one or more sequences of instructions for monitoring electronic messages received at a server, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of:

determining message information for a plurality of electronic messages that is received at said server;

storing said message information in a queue;

based on said queue, generating aggregate information for a particular network address of a plurality of network addresses, wherein said aggregate information is generated for each time interval of a plurality of time intervals, and wherein said particular network address is included in said message information for one or more electronic messages of said plurality of electronic messages; and

displaying said aggregate information for said plurality of time intervals.

12. A machine-readable medium as recited in claim 11, wherein said plurality of electronic messages is a first plurality of electronic messages, and the machine-readable medium further comprises instructions which, when executed by the one or more processors, cause the one or more processors to perform the steps of:

determining additional message information for a second plurality of electronic messages that is received at said server after said first plurality of electronic messages is received at said server;

storing said additional message information in said queue;

based on said queue, generating additional aggregate information for said particular network address of said plurality of network addresses, wherein said additional aggregate information is generated for an additional time interval, and wherein said particular network address is included in said additional message information for one or more electronic messages of said second plurality of electronic messages; and

displaying both at least a portion of said aggregate information for one or more time intervals of said plurality of time intervals and said additional aggregate information for said additional time interval.

13. A machine-readable medium as recited in claim 11, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to perform the steps of:

receiving, from a user, input that is associated with said particular network address; and

based on said input, modifying how one or more future electronic messages received at said server from said particular network address are handled by said server.

14. A machine-readable medium as recited in claim 13, wherein the instructions for modifying how said one or more future electronic messages are handled by said server further comprise instructions which, when executed by the one or more processors, cause the one or more processors to perform the step of performing one action selected from the group consisting of (a) blocking future electronic messages received at said server from said particular network address, (b) allowing future electronic messages received at said server from said particular network address, and (c) allowing some future electronic messages received at said server from said particular network address and blocking other future electronic messages received at said server from said particular network address.

15. A machine-readable medium as recited in claim 11, wherein said message information includes a particular counter that is selected from the group consisting of (a) a first counter that indicates how many electronic messages are received at said server from said particular network address, (b) a second counter that indicates how many bytes are received at said server from said particular network address, (c) a third counter that indicates how many recipients are identified in electronic messages that are received at said server from said particular network address, and (d) a counter that indicates how many connections are received by said server from said particular network address.

16. A machine-readable medium as recited in claim 11, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to perform the steps of:

determining that a policy has been applied to one or more electronic messages of said plurality of electronic messages;

generating aggregate policy information for said particular network address, wherein said aggregate policy information is generated for each time interval of said plurality of time intervals, and wherein said aggregate policy information indicates how many times said policy has been applied to electronic messages from said particular network address; and

displaying said aggregate policy information for said plurality of time intervals.

17. A machine-readable medium as recited in claim 16, wherein said policy is selected from the group consisting of a blacklist policy, a whitelist policy, a greylist policy, a spam policy, and a virus policy.

18. A machine-readable medium as recited in claim 11, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to perform the steps of:

based on said message information, generating combined aggregate information for at least two network addresses of said plurality of network addresses over each time interval of said plurality of time intervals, wherein said combined aggregate information is based on said aggregate information for each network address of said at least two network addresses; and

displaying said combined aggregate information for said plurality of time intervals.

19. A machine-readable medium as recited in claim 18, wherein:

each IP address of said at least two network addresses is associated with an identifier that is determined based on said message information for said each network address of said at least two network addresses; and

said identifier is selected from the group consisting of a network address, an Internet Protocol (IP) address, a partial IP address, a first range of IP addresses, a primary domain, a subdomain, a fully qualified domain name (FQDN), a partial FQDN, a classless inter-domain routing (CIDR) block, a partial CIDR block, a subnet, an organization identifier, a network owner, a reputation score, and a second range of reputation scores.

20. A machine-readable medium as recited in claim 11, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to perform the steps of:

for said particular network address of said plurality of network addresses, determining an average number of electronic messages received at said server from said particular network address over a specified time interval, based on aggregate information for said particular network address for two or more previous specified time intervals;

for said particular network address, determining a current number of electronic messages received at said server from said particular network address over said specified time interval; and

displaying a comparison of said average number of electronic messages to said current number of electronic messages.

21. An apparatus comprising:

a processor; and

a memory coupled to the processor, the memory containing one or more sequences of instructions for monitoring electronic messages received at a server, wherein execution of the one or more sequences of instructions by the processor causes the processor to perform the steps of;

determining message information for a plurality of electronic messages that is received at said server;

storing said message information in a queue;

based on said queue, generating aggregate information for a particular network address of a plurality of network addresses, wherein said aggregate information is generated for each time interval of a plurality of time intervals, and wherein said particular network address is included in said message information for one or more electronic messages of said plurality of electronic messages; and

displaying said aggregate information for said plurality of time intervals.

22. An apparatus as recited in claim 21, wherein said plurality of electronic messages is a first plurality of electronic messages, and wherein the memory further contains one or more sequences of instructions which, when executed by the processor, cause the processor to perform the steps of:

determining additional message information for a second plurality of electronic messages that is received at said server after said first plurality of electronic messages is received at said server;

storing said additional message information in said queue;

based on said queue, generating additional aggregate information for said particular network address of said plurality of network addresses, wherein said additional aggregate information is generated for an additional time interval, and wherein said particular network address is included in said additional message information for one or more electronic messages of said second plurality of electronic messages; and

displaying both at least a portion of said aggregate information for one or more time intervals of said plurality of time intervals and said additional aggregate information for said additional time interval.

23. An apparatus as recited in claim 21, wherein the memory further contains one or more sequences of instructions which, when executed by the processor, cause the processor to perform the steps of:

receiving, from a user, input that is associated with said particular network address; and

based on said input, modifying how one or more future electronic messages received at said server from said particular network address are handled by;

said server.

24. An apparatus as recited in claim 23, wherein the instructions for modifying how said one or more future electronic messages are handled by said server further comprise instructions which, when executed by the processor, cause the processor to perform the step of performing one action selected from the group consisting of (a) blocking future electronic messages received at said server from said particular network address, (b) allowing future electronic messages received at said server from said particular network address, and (c) allowing some future electronic messages received at said server from said particular network address and blocking other future electronic messages received at said server from said particular network address.

25. An apparatus as recited in claim 21, wherein said message information includes a particular counter that is selected from the group consisting of (a) a first counter that indicates how many electronic messages are received at said server from said particular network address, (b) a second counter that indicates how many bytes are received at said server from said particular network address, (c) a third counter that indicates how many recipients are identified in electronic messages that are received at said server from said particular network address, and (d) a counter that indicates how many connections are received by said server from said particular network address.

26. An apparatus as recited in claim 21, wherein the memory further contains one or more sequences of instructions which, when executed by the processor, cause the processor to perform the steps of:

determining that a policy has been applied to one or more electronic messages of said plurality of electronic messages;

generating aggregate policy information for said particular network address, wherein said aggregate policy information is generated for each time interval of said plurality of time intervals, and wherein said aggregate policy information indicates how many times said policy has been applied to electronic messages from said particular network address; and

displaying said aggregate policy information for said plurality of time intervals.

27. An apparatus as recited in claim 26, wherein said policy is selected from the group consisting of a blacklist policy, a whitelist policy, a greylist policy, a spam policy, and a virus policy.

28. An apparatus as recited in claim 21, wherein the memory further contains one or more sequences of instructions which, when executed by the processor, cause the processor to perform the steps of:

based on said message information, generating combined aggregate information for at least two network addresses of said plurality of network addresses over each time interval of said plurality of time intervals, wherein said combined aggregate information is based on said aggregate information for each network address of said at least two network addresses; and

displaying said combined aggregate information for said plurality of time intervals.

29. An apparatus as recited in claim 28, wherein:

each IP address of said at least two network addresses is associated with an identifier that is determined based on said message information for said each network address of said at least two network addresses; and

said identifier is selected from the group consisting of a network address, an Internet Protocol (IP) address, a partial IP address, a first range of IP addresses, a primary domain, a subdomain, a fully qualified domain name (FQDN), a partial FQDN, a classless inter-domain routing (CIDR) block, a partial CIDR block, a subnet, an organization identifier, a network owner, a reputation score, and a second range of reputation scores.

30. An apparatus as recited in claim 21, wherein the memory further contains one or more sequences of instructions which, when executed by the processor, cause the processor to perform the steps of:

for said particular network address of said plurality of network addresses,;

determining an average number of electronic messages received at said server from said particular network address over a specified time interval, based on aggregate information for said particular network address for two or more previous specified time intervals;

for said particular network address, determining a current number of electronic messages received at said server from said particular network address over said specified time interval; and

displaying a comparison of said average number of electronic messages to said current number of electronic messages.