REPUTATION BASED MESSAGE PROCESSING

• US 20080184366A1
• Filed: 01/25/2008
• Published: 07/31/2008
• Est. Priority Date: 11/05/2004
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: Secure Computing Corporation (McAfee, LLC)
• Inventors: Krasser, Sven, Alperovitch, Dmitri
• Granted Patent: US 8,635,690 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 11/008 Reliability or availability analysis
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

Methods and systems for processing electronic communications based upon reputation. Reputation of an entity associated with the electronic communication can be generated. The communication can be placed in a queue based upon the reputation. The queued communication can be processed based upon updated information about the entity.

Claims

1. A computer-implemented method, comprising:

receiving a message through a communications interface, the message comprising information about an entity;

identifying a reputation for the entity associated with the message;

queuing the message based upon the reputation associated with the entity or based upon a message profile associated with the message, thereby delaying delivery of the message; and

processing the queued message based upon updated reputation or message profile information.

2. The computer-implemented method of claim 1, wherein processing the queued message comprises performing anomaly testing on the queued message if it is determined that the entity is non-reputable.

3. The computer-implemented method of claim 2, wherein processing the queued message comprises forwarding the queued message to a recipient if it is determined that the entity is reputable.

4. The computer-implemented method of claim 1, further comprising collecting updated reputation or message profile information for a period of time before processing the queued message.

5. The computer-implemented method of claim 1, wherein analyzing subsequent communications associated with the entity comprises identifying minutiae features associated with the entity.

6. The computer-implemented method of claim 5, further comprising analyzing other communications associated with the entity to identifying relationships between the entity and known reputable entities or known non-reputable entities.

7. The computer-implemented method of claim 6, wherein identifying relationships between the entity and known reputable or non-reputable entities comprises identifying similar minutiae features between the entity and the known reputable or non-reputable entities.

8. The computer-implemented method of claim 1, wherein a non-reputable reputation associated with the entity indicates a tendency by the entity to participate in one or more non-legitimate activities, and processing the electronic communication based upon the reputation associated with the entity comprises sending the electronic communication for further evaluation at one or more of a plurality of queues based upon the one or more non-legitimate activities in which the entity has exhibited a tendency to participate.

12. The computer-implemented method of claim 1, wherein analyzing subsequent communications associated with the entity comprises identifying minutiae features associated with the entity.

9. A computer-implemented method, comprising:

receiving an electronic communication;

identifying a reputation associated with an entity associated with the electronic communication;

if the reputation of the entity associated with the electronic communication is indeterminate, labeling the electronic communication as a suspicious electronic communication;

delaying delivery of the suspicious electronic communication;

collecting additional information associated with the entity; and

processing the electronic communication based upon the collected additional information associated the entity.

10. The computer-implemented method of claim 9, wherein processing the electronic communication comprises performing further testing on the electronic communication if it is determined that the entity is a non-reputable entity.

11. The computer-implemented method of claim 10, wherein processing the electronic communication comprises forwarding the electronic communication to a recipient if it is determined that the entity is reputable.

13. The computer-implemented method of claim 9, further comprising identifying relationships between the entity and known reputable entities or known non-reputable entities.

14. The computer-implemented method of claim 13, wherein identifying relationships between the entity and known reputable or non-reputable entities comprises identifying common features shared by the entity and the known reputable or known non-reputable entities, including communications between the entities, identifying similar communications patterns, identifying similar communications sent independently from the entity and at least one of the known reputable or known non-reputable entities, and similar domains.

15. The computer-implemented method of claim 9, wherein a non-reputable reputation associated with the entity indicates a tendency by the entity to participate in one or more non-legitimate activities, and processing the electronic communication based upon the reputation associated with the entity comprises sending the electronic communication for further evaluation at one or more of a plurality of queues based upon the one or more non-legitimate activities in which the entity has exhibited a tendency to participate.

16. A message interrogation system comprising:

a communications interface operable to receive a query associated with a message;

a reputation module operable to retrieve reputation information associated with the sender or recipient of the message, the reputation engine being further operable to identify an entity having an indeterminate reputation;

a flagging module operable to instruct a message processing module to queue the message, wherein the queue is operable to hold the message without delivery;

a reputation information collection module being operable to collect reputation information related to the entity associated with the suspicious communication; and

the reputation module being further operable derive an updated reputation based upon the collected reputation information and to communicate the updated reputation to a message transfer agent through the communications interface;

wherein the message processing module is operable to process the message based upon the updated reputation.

17. The system of claim 16, wherein the message processing module is operable to forward the message to a dedicated message interrogation engine based upon the reputation, and the dedicated interrogation engine is operable to analyze the message for anomalies.

18. The system of claim 17, wherein the message processing module is operable to forward the message to a recipient if it is determined that the entity associated with the message is reputable.

19. The system of claim 16, wherein the reputation engine is operable to analyze communication patterns associated with the entity.

20. The system of claim 19, wherein the reputation engine is operable to compare the communication patterns associated with the entity to known behavioral profiles of reputable and non-reputable entities, and to identify the reputation based upon identifying a closest match between the communication patterns associated with the entity and the behavioral profiles of reputable and non-reputable entities.

21. The system of claim 16, wherein the reputation engine is operable to analyze the entity based upon minutiae attributes associated with the entity.

22. The system of claim 21, wherein the reputation engine is operable to identify relationships between the entity and known reputable entities or known non-reputable entities.

23. The system of claim 22, wherein relationships between the entity and known reputable or non-reputable entities are identified based upon identification of communications between the entities, identification of similar communications patterns, identification of similar communications sent independently from the entity and at least one of the known reputable or known non-reputable entities, and identification of similar domains.

24. The system of claim 16, wherein a non-reputable reputation associated with the entity indicates a tendency by the entity to participate in one or more non-legitimate activities, and the message transfer agent is operable to forward the electronic communication to a particular one or more communication evaluation engines based upon the one or more non-legitimate activities in which the entity has exhibited a tendency to participate.

25. A system comprising:

a communications interface operable to receive electronic messages, the electronic messages being associated with an entity;

a message processing module operable to process the electronic message to identify the entity and to send a reputation query to a reputation module to identify a reputation of the entity associated with the electronic message;

a queuing module operable to place electronic messages into a queue based upon the reputation of the entity associated with the electronic message; and

reprocessing module operable to periodically query the reputation module for an updated reputation for the entity associated with the electronic message, the reprocessing module being further operable to process the electronic message based upon the updated reputation of the entity associated with the electronic message.