Source reputation information system with blocking of TCP connections from sources of electronic messages

• US 20070208817A1
• Filed: 05/04/2007
• Published: 09/06/2007
• Est. Priority Date: 05/25/2004
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Postini, Inc. (Alphabet Inc.)
• Inventors: Lund, Peter, Carroll, Dorion, Petry, Scott, Croteau, Craig, Okumura, Kenneth
• Granted Patent: US 7,788,359 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context

Abstract

Disclosed herein are filtering systems and methods that employ an electronic message source reputation system. The source reputation system maintains a pool of source Internet Protocol (IP) address information, in the form of a Real-Time Threat Identification Network (“RTIN”) database, which can provide the reputation of source IP addresses, which can be used by customers for filtering network traffic. The source reputation system provides for multiple avenues of access to the source reputation information. Examples of such avenues can include Domain Name Server (DNS) -type queries, servicing routers with router-table data, or other avenues.

Claims

1. A method of providing source information for real-time filtering of incoming electronic messages, the method comprising:

receiving a query from a subscriber for reputation data associated with a source requesting a TCP connection with the subscriber'"'"'s computer network;

retrieving reputation data associated with the source; and

providing the reputation data associated with the source to the subscriber substantially as the source is requesting the TCP connection, wherein the provided reputation data determines whether the subscriber'"'"'s computer network allows the TCP connection.

2. A method according to claim 1, wherein retrieving the reputation data comprises retrieving the reputation data associated with the source from a source reputation profile generated on the source.

3. A method according to claim 2, wherein providing the reputation data associated with the source comprises providing the source reputation profile.

4. A method according to claim 1, wherein retrieving the reputation data comprises querying data sources for reputation data associated with the source substantially as the source is requesting the TCP connection.

5. A method according to claim 4, wherein the data source comprises a network traffic monitoring system.

6. A method according to claim 4, wherein the data source comprises a system identifying message sources by detecting messages sent to a deliberately established invalid destination address.

7. A method according to claim 4, wherein the data source comprises a system determining whether a predetermined amount of time has elapsed since a first suspect message was sent from a particular source when a second suspect message is detected being sent from that source.

8. A method according to claim 4, further comprising generating a source reputation profile on the source using the reputation data retrieved from the data sources.

9. A method according to claim 1, wherein the reputation data comprises at least one selected from the group consisting of:

the number of messages considered spam sent from the source;

the number of recipients on a message sent from the source;

the number of connection attempts from the source;

the number of connection successes from the source;

the number of connection failures from the source;

the number of connection currently open from the source;

the number of 400-class errors caused by messaging attempts by the source;

the number of 500-class errors caused by messaging attempts by the source;

the average message size in bytes sent from the source;

the average connection duration from the source;

the number of messages containing viruses sent from the source;

the number of message delivered from the source; and

an overall number of messages sent from the source.

10. A method according to claim 1, wherein providing the reputation data comprises providing an evaluation of the reputation data.

11. A method according to claim 10, wherein the evaluation of the reputation data is done in accordance with the subscriber'"'"'s preferences.

12. A method according to claim 11, wherein the subscriber'"'"'s preferences comprise a list of previously approved and/or unapproved sources.

13. A method according to claim 10, wherein the evaluation comprises generating a reputation score for the source, the reputation score indicating a likelihood that electronic messages from the source are unwanted.

14. A method according to claim 13, further comprising changing the reputation score based on new reputation data associated with the source.

15. A method according to claim 1, further comprising first authenticating the subscriber in response to receiving the query.

16. A method according to claim 15, wherein the query comprises a security key for use in the authenticating.

17. A method according to claim 1, wherein the source comprises a source IP address.

18. An engine for providing source information for real-time filtering of incoming electronic messages, the engine comprising:

a server configured to receive a query from a subscriber for reputation data associated with a source requesting a TCP connection with the subscriber'"'"'s computer network;

a controller configured to retrieve reputation data associated with the source; and

wherein the server is further configured to provide the reputation data associated with the source to the subscriber substantially as the source is requesting the TCP connection, wherein the provided reputation data determines whether the subscriber'"'"'s computer network allows the TCP connection.

19. An engine according to claim 18, further comprising a reputation database associated with the controller, wherein the controller retrieves the reputation data associated with the source from the reputation database.

20. An engine according to claim 19, wherein the controller is further configured to generate a source reputation profile on the source based on the reputation data, and to store the source reputation profile in the reputation database.

21. An engine according to claim 20, wherein the server is configured to provide the source reputation profile as the reputation data provided to the subscriber.

22. An engine according to claim 18, wherein the controller is configured to retrieve the reputation data associated with the source by querying data sources for reputation data associated with the source substantially as the source is requesting the TCP connection.

23. An engine according to claim 22, wherein the data source comprise a network traffic monitoring system.

24. An engine according to claim 22, wherein the data source comprises a system identifying message sources by detecting messages sent to a deliberately established invalid destination address.

25. An engine according to claim 22, wherein the data source comprises a system determining whether a predetermined amount of time has elapsed since a first suspect message was sent from a particular source when a second suspect message is detected being sent from that source.

26. An engine according to claim 18, wherein the reputation data comprises at least one selected from the group consisting of:

the number of messages considered spam sent from the source;

the number of recipients on a message sent from the source;

the number of connection attempts from the source;

the number of connection successes from the source;

the number of connection failures from the source;

the number of connection currently open from the source;

the number of 400-class errors caused by messaging attempts by the source;

the number of 500-class errors caused by messaging attempts by the source;

the average message size in bytes sent from the source;

the average connection duration from the source;

the number of messages containing viruses sent from the source;

the number of message delivered from the source; and

an overall number of messages sent from the source.

27. An engine according to claim 18, wherein the controller is further configured to evaluate the reputation data, and the server is further configured to provide the evaluation to the subscriber as the reputation data associated with the source.

28. An engine according to claim 27, wherein the controller evaluates the reputation data in accordance with the subscriber'"'"'s preferences.

29. An engine according to claim 28, wherein the subscriber'"'"'s preferences comprise a list of previously approved and/or unapproved sources.

30. An engine according to claim 27, wherein the evaluation comprises the controller generating a reputation score for the source, the reputation score indicating a likelihood that electronic messages from the source are unwanted.

31. An engine according to claim 30, wherein the controller is further configured to change the reputation score based on new reputation data associated with the source.

32. An engine according to claim 18, wherein the server is further configured to first authenticate the subscriber in response to receiving the query.

33. An engine according to claim 32, wherein the query comprises a security key for use by the server in the authenticating.

34. An engine according to claim 18, wherein the source comprises a source IP address.