Method of determining network addresses of senders of electronic mail messages

• US 20070070921A1
• Filed: 05/05/2006
• Published: 03/29/2007
• Est. Priority Date: 05/05/2005
• Status: Active Grant

• Current Assignee: Ironport Systems (Cisco Systems, Inc.)
• Original Assignee: Ironport Systems (Cisco Systems, Inc.)
• Inventors: Quinlan, Daniel, Wescott, Jeffrey
• Granted Patent: US 7,548,544 B2
• Time in Patent Office: Days
• US Class Current: 370/254
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/234 for tracking messages
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

In one embodiment, a method comprises computer-implemented steps of receiving a plurality of electronic mail messages containing sender address information that is non-trusted; for each particular one of the electronic mail messages: storing information about the particular message in a database record; creating one or more receiving node identifiers in association with respective connected node identifiers, wherein the receiving node identifiers identify mail servers that received the particular message and the connected node identifiers identify mail servers that connected to the receiving node identifiers to send the particular message; selecting one particular receiving node identifier that has a largest number of connected node identifiers associated therewith; selecting one particular connected node identifier that is associated with the one particular receiving node identifier that sent the particular message to the associated receiving node; storing in a sender field that identifies a sender of the particular message, the particular connected node identifier.

Claims

1. A method, comprising the computer-implemented steps of:

receiving a plurality of electronic mail messages containing sender address information that is non-trusted;

for each particular one of the electronic mail messages;

storing information about the particular message in a database record;

creating and storing one or more receiving node identifiers in association with respective connected node identifiers, wherein the receiving node identifiers identify mail servers that received the particular message and the connected node identifiers identify mail servers that connected to the receiving node identifiers to send the particular message;

selecting one particular receiving node identifier that has a largest number of connected node identifiers associated therewith;

selecting one particular connected node identifier that is associated with the one particular receiving node identifier that sent the particular message to the associated receiving node;

storing, in the database record, in a sender field that identifies a sender of the particular message, the one particular connected node identifier.

2. The method of claim 1, wherein the receiving node identifiers and connected node identifiers are IP addresses.

3. The method of claim 1, wherein the receiving node identifiers and connected node identifiers are stored in a logical tree data structure that represents a network topology that includes the receiving nodes and the connected nodes.

4. The method of claim 3, wherein nodes in the tree represent network elements involved in sending, receiving or forwarding the electronic mail messages and branches in the tree represent mail transfer protocol connections that were established between the network elements.

5. The method of claim 1, further comprising:

retrieving the database record;

determining whether a value of the sender field is found in a blacklist;

creating and storing a poor reputation score value when the value of the sender field is found in the blacklist and creating and storing another reputation score value indicating a reputation other than a good reputation when the value of the sender field is not found in the blacklist.

9. The computer-readable medium of claim 3, wherein nodes in the tree represent network elements involved in sending, receiving or forwarding the electronic mail messages and branches in the tree represent mail transfer protocol connections that were established between the network elements.

14. The apparatus of claim 3, wherein nodes in the tree represent network elements involved in sending, receiving or forwarding the electronic mail messages and branches in the tree represent mail transfer protocol connections that were established between the network elements.

6. A computer-readable tangible storage medium comprising one or more sequences of instructions which, when executed by one or more processors, cause the one or more processors to perform:

receiving a plurality of electronic mail messages containing sender address information that is non-trusted;

for each particular one of the electronic mail messages;

storing information about the particular message in a database record;

creating and storing one or more receiving node identifiers in association with respective connected node identifiers, wherein the receiving node identifiers identify mail servers that received the particular message and the connected node identifiers identify mail servers that connected to the receiving node identifiers to send the particular message;

selecting one particular receiving node identifier that has a largest number of connected node identifiers associated therewith;

selecting one particular connected node identifier that is associated with the one particular receiving node identifier that sent the particular message to the associated receiving node;

storing, in the database record, in a sender field that identifies a sender of the particular message, the one particular connected node identifier.

7. The computer-readable medium of claim 6, wherein the receiving node identifiers and connected node identifiers are IP addresses.

8. The computer-readable medium of claim 6, wherein the receiving node identifiers and connected node identifiers are stored in a logical tree data structure that represents a network topology that includes the receiving nodes and the connected nodes.

10. The computer-readable medium of claim 6, further comprising:

retrieving the database record;

determining whether a value of the sender field is found in a blacklist;

creating and storing a poor reputation score value when the value of the sender field is found in the blacklist and creating and storing another reputation score value indicating a reputation other than a good reputation when the value of the sender field is not found in the blacklist.

11. An apparatus, comprising:

means for receiving a plurality of electronic mail messages containing sender address information that is non-trusted;

means for storing information about each particular one of the electronic mail messages in a database record;

means for creating and storing one or more receiving node identifiers in association with respective connected node identifiers, wherein the receiving node identifiers identify mail servers that received the particular message and the connected node identifiers identify mail servers that connected to the receiving node identifiers to send the particular message;

means for selecting one particular receiving node identifier that has a largest number of connected node identifiers associated therewith;

means for selecting one particular connected node identifier that is associated with the one particular receiving node identifier that sent the particular message to the associated receiving node;

means for storing, in the database record, in a sender field that identifies a sender of the particular message, the one particular connected node identifier.

12. The apparatus of claim 11, wherein the receiving node identifiers and connected node identifiers are IP addresses.

13. The apparatus of claim 11, wherein the receiving node identifiers and connected node identifiers are stored in a logical tree data structure that represents a network topology that includes the receiving nodes and the connected nodes.

15. The apparatus of claim 11, further comprising:

means for retrieving the database record;

means for determining whether a value of the sender field is found in a blacklist;

means for creating and storing a poor reputation score value when the value of the sender field is found in the blacklist and creating and storing another reputation score value indicating a reputation other than a good reputation when the value of the sender field is not found in the blacklist.

16. An apparatus, comprising:

one or more processors coupled to a network interface;

a computer-readable tangible storage medium coupled to the one or more processors and carrying one or more sequences of instructions which, when executed by the processors, cause the one or more processors to perform;

receiving a plurality of electronic mail messages containing sender address information that is non-trusted;

for each particular one of the electronic mail messages;

storing information about the particular message in a database record;

creating and storing one or more receiving node identifiers in association with respective connected node identifiers, wherein the receiving node identifiers identify mail servers that received the particular message and the connected node identifiers identify mail servers that connected to the receiving node identifiers to send the particular message;

selecting one particular receiving node identifier that has a largest number of connected node identifiers associated therewith;

selecting one particular connected node identifier that is associated with the one particular receiving node identifier that sent the particular message to the associated receiving node;

storing, in the database record, in a sender field that identifies a sender of the particular message, the one particular connected node identifier.

17. The apparatus of claim 16, wherein the receiving node identifiers and connected node identifiers are IP addresses.

18. The apparatus of claim 16, wherein the receiving node identifiers and connected node identifiers are stored in a logical tree data structure that represents a network topology that includes the receiving nodes and the connected nodes.

19. The apparatus of claim 18, wherein nodes in the tree represent network elements involved in sending, receiving or forwarding the electronic mail messages and branches in the tree represent mail transfer protocol connections that were established between the network elements.

20. The apparatus of claim 16, further comprising sequences of instructions which, when executed by the processors, cause the one or more processors to perform:

retrieving the database record;

determining whether a value of the sender field is found in a blacklist;

creating and storing a poor reputation score value when the value of the sender field is found in the blacklist and creating and storing another reputation score value indicating a reputation other than a good reputation when the value of the sender field is not found in the blacklist.