SYSTEM AND METHOD FOR ANALYSIS OF ELECTRONIC INFORMATION DISSEMINATION EVENTS

• US 20090241197A1
• Filed: 03/19/2008
• Published: 09/24/2009
• Est. Priority Date: 03/19/2008
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Forcepoint LLC
• Inventors: Troyansky, Lidror
• Granted Patent: US 8,370,948 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/234 for tracking messages
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A system and method for determining an intent of a sender in transmitting electronic information in order to prevent unauthorized dissemination of electronic information is disclosed. The system and method facilitate cost-effective handling of dissemination events and comprise a traffic analyzer configured to analyze descriptors of the electronic information and parameters of the transmission of the electronic information in order to determine the intent of the sender. By determining the intent of the sender, it is possible to effectively quarantine the electronic information before it is disseminated.

Claims

1. A system for determining an intent of a sender in transmitting electronic information in order to prevent unauthorized dissemination of the electronic information and facilitate cost-effective handling of dissemination events, the system comprising a traffic analyzer configured to analyze descriptors of the electronic information and parameters of the transmission of the electronic information in order to determine the intent of the sender.

2. The system of claim 1, wherein the descriptors comprise at least one of the content of the message, the sender of the message, and the recipient of the message.

3. The system of claim 1, wherein the traffic analyzer comprises an intention assessment unit for analyzing the descriptors and parameters of the electronic information.

4. The system of claim 3, wherein the intention assessment unit determines if the intent in sending the electronic information is malicious or a mistake.

5. The system of claim 3, wherein the intention assessment unit is configured to determine whether the electronic information should be disseminated.

6. The system of claim 3, wherein the intention assessment unit is configured to determine whether the decision about dissemination of the information should be made by the sender.

7. The system of claim 6, wherein the intention assessment unit evaluates a confidence level and severity of the electronic information being disseminated in determining whether to disseminate the electronic information.

8. The system of claim 3, wherein the intention assessment unit compares the descriptors and parameters of the electronic information to predefined scenarios in order to determine whether the electronic information should be disseminated.

9. The system of claim 8, wherein the predefined scenarios are generated from previous electronic information dissemination events.

10. A computer-implemented method for determining an intent of a sender in transmitting electronic information in order to prevent unauthorized dissemination of the electronic information, the method comprising:

determining descriptors and parameters of the electronic information;

analyzing the descriptors and parameters of the electronic information; and

determining the intent of the sender from the analysis of the descriptors and parameters of the electronic information.

11. The method of claim 10, further comprising determining whether the intent of the sender is malicious.

12. The method of claim 10, further comprising determining whether the sender mistakenly transmitted the electronic information.

13. The method of claim 10, further comprising determining a confidence level and severity of the electronic information in deciding the intent of the sender.

14. The method of claim 13, further comprising using the intent of the sender in determining whether the electronic information should be quarantined.

15. The method of claim 14, further comprising using the intent of the sender in determining whether the decision about releasing the electronic information from the quarantine should be made by the sender.

16. The method of claim 10, further comprising comparing the descriptors and parameters of the electronic information to predefined scenarios in order to determine the intent of the sender.

17. The method of claim 16, wherein comparing the descriptors and parameters of the electronic information to predefined scenarios comprises finding a nearest neighbor between the descriptors and parameters and the predefined scenarios.

18. The method of claim 10, further comprising applying heuristics based on the email addresses of the senders and the recipients to assess the intention of the sender.

19. The method of claim 10, further comprising using the intent of the sender in determining whether the electronic information should be disseminated.

20. The method of claim 10, further comprising using the intent of the sender in determining whether the decision about dissemination of the information should be made by the sender.

21. The method of claim 14, further comprising informing the sender the actions required to release the message from quarantine.

22. A computer-implemented method for identifying a problematic business policy in the transmission of electronic messages, the method comprising:

determining the number of electronic messages that were transmitted that violated a prescribed business policy;

identifying the senders who sent the electronic messages;

analyzing recipients of the electronic messages; and

determining whether the business policy for the transmission of the electronic message is problematic in response to the number of electronic messages, the senders of the electronic messages and the analysis of recipients of the electronic messages.

23. The method of claim 22, wherein analyzing recipients of the electronic messages further comprises analyzing the recipients addresses for positive and negative indicators that the recipient should be receiving the electronic message.

24. The method of claim 23, wherein positive indicators of receipt comprise the recipient'"'"'s affiliation and negative indicators or receipt comprise the recipients address belongs to a domain of low reputation.