Method and apparatus for creating predictive filters for messages

• US 20090006569A1
• Filed: 06/28/2007
• Published: 01/01/2009
• Est. Priority Date: 06/28/2007
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Morss, Dylan, Cassidy, Emmet
• Granted Patent: US 8,849,921 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method and apparatus for creating predictive filters for messages. In one embodiment, filter information is coupled to a reputation database. One or more filters for a message feature are generated if a reputation of the message feature is associated with one or more portions of the filter information. In one embodiment, SPAM filters are generated. In yet another embodiment, one or more message features are tested using heuristics. One or more message features are blacklisted based on a determination of the heuristics. One or more additional message filters are generated if a reputation of the message feature is associated with a blacklisted feature.

Claims

1. A method for predictive creating filters for messages, comprising:

coupling filter information to a reputation database; and

generating at least one filter for a message feature if a reputation of the message feature is associated with at least a portion of the filter information.

2. The method of claim 1, wherein the step of generating at least one filter further comprises comparing the filter information to reputation information within the reputation database.

3. The method of claim 1, further comprising altering the at least one portion of the filter information if a reputation of the at least one portion of the filter information is no longer associated with a particular reputation.

4. The method of claim 1, further comprising testing at least one message feature of the reputation database using heuristics.

5. The method of claim 4, further comprising blacklisting the at least one message feature based on a determination of the heuristics.

6. The method of claim 1, updating the reputation database using statistics produced by various messaging clients and filtering applications.

7. The method of claim 1, wherein the message feature comprises at least one of an information regarding web site content, a number of web sites hosting at least one of malware, spyware and SPAM, a name server, a host IP address, a country of origin, a country of residence of a domain registrant, a time to live of a domain zone file record, a number of name servers associated with a domain, a whois data, a number of times the name server has been changed for the domain, a value indicating whether the name server has the same name as the domain, a value indicating whether the domain is being used for domain tasting, a country location of at least one of the host IP address, email, SPAM, and virus volume being sent from at least one of the domain and the host IP address based on customer field statistics, a number of host IP addresses and domains known for sending tracked categories of SPAM, open relays, IP address allocation, and an use history of at least one of IP addresses and ranges of IP addresses.

8. The method of claim 1, wherein the filter information comprises at least one filter for at least one of a name server, a domain name, a country of origin, and a host IP address, wherein the at least one filter is keyed on recent SPAM.

9. The method of claim 4, wherein the heuristics comprises at least one of a determining if the host IP address of the domain is already blacklisted, determining if a content of a web page contains previously identified SPAM or malware content, determining if a name server has a configurable percentage of SPAM web sites, determining if a domain registration date is more recent than a definable threshold of time, determining if there is an overlap between the host IP address and at least one of a known zombie and a bot net, and comparing message features to a profile of words common to SPAM for determining if filters should be generated.

10. The method of claim 6, wherein the statistics comprises information regarding at least one of web site content, country of origin data, overall SPAM presence, overall email usage, trends in SPAM, common words in SPAM, and firing characteristics of filters.

11. An apparatus for creating predictive filters for messages, comprising:

a reputation database; and

a filter generation module for coupling filter information to the reputation database and generating at least one filter for a message feature associated with at least one portion of the filter information based on a reputation of the message feature.

12. The apparatus of claim 11, further comprising means for comparing the filter information to reputation information within the reputation database.

13. The apparatus of claim 11, further comprising a means for altering at least one portion of the filter information if a reputation of the at least one portion of the filter information is no longer associated with a particular reputation.

14. The apparatus of claim 11, further comprising a means for testing at least one message feature of the reputation database against heuristics.

15. The apparatus of claim 14, further comprising a means for blacklisting the at least one feature based on a determination of the heuristics.

16. The apparatus of claim 11, further comprising means for updating the reputation database using statistics produced by various messaging clients and filtering applications.

17. A system for creating predictive filters, comprising:

at least one of a recipient computer and a mail server to provide filter information;

a backend system for coupling the filter information to a reputation database, the backend system including a filter generation module to generate at least one filter for a message feature associated with at least one portion of the filter information based on a reputation of the message feature.

18. The system of claim 17, wherein the at least one of the mail server and the recipient computer to provide statistics to update the reputation of the message feature.