DETECTION OF SUSPICIOUS TRAFFIC PATTERNS IN ELECTRONIC COMMUNICATIONS

• US 20100095377A1
• Filed: 12/14/2009
• Published: 04/15/2010
• Est. Priority Date: 01/11/2008
• Status: Abandoned Application

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Krywaniuk, Andrew
• Application Number:
  US12/637,101
• Publication Number:
  US 20100095377A1
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Methods and systems for detecting suspicious traffic patterns in electronic communications are provided. According to one embodiment, an electronic mail (email) message is received by a mail filter (milter), which evaluates a traffic pattern represented by the email message by scanning information associated with the email message and comparing it to information associated with one or more traffic analysis profiles. If the email message is identified by the milter as being inconsistent with normal email traffic patterns as represented by the one or more traffic analysis profiles, then the milter causes the email message to be handled in accordance with an email security policy associated with suspicious traffic patterns. For example, in the context of an outbound message, the originator may be alerted to a factor contributing to the identification and the originator may be provided with an opportunity to address the factor.

Claims

1. A method comprising

receiving an electronic mail (email) message by a mail filter (milter);

evaluating, by the milter, a traffic pattern represented by the email message by scanning information associated with all or a portion of the email message and comparing all or a portion of the scanned information to information associated with one or more traffic analysis profiles;

if the milter identifies the email message as being inconsistent with normal email traffic patterns as represented by the one or more traffic analysis profiles, then the milter causing the email message to be handled in accordance with an email security policy associated with suspicious traffic patterns; and

wherein the milter is implemented in one or more processors and one or more computer-readable storage media of one or more computer systems, the one or more computer-readable storage media having instructions tangibly embodied therein representing the milter that are executable by the one or more processors.

2. The method of claim 1, wherein at least one of the one or more traffic analysis profiles comprises a Bayesian database and the method further comprises training the Bayesian database based on normal email traffic patterns.

3. The method of claim 2, wherein spam email messages and email messages containing viruses are excluded from said training.

4. The method of claim 2, wherein the one or more traffic analysis profiles comprise a multi-tier Bayesian filter.

5. The method of claim 4, wherein the multi-tier Bayesian filter comprises an enterprise-level database, a per-server database and a per-user database and the method further comprises:

monitoring email traffic between email addresses/domains at multiple levels of specificity; and

in connection with making a determination regarding normalcy of a given email traffic pattern, allowing results associated with a more specific database of the multi-tier Bayesian filter to overrule results of a less specific database of the multi-tier Bayesian filter.

6. The method of claim 1, further comprising causing one or more Bayesian filters to be applied to the email message or a portion thereof.

7. The method of claim 6, wherein the one or more Bayesian filters include one or more of a global database based on traffic analysis of observed email traffic, a per-server database based on traffic analysis of observed email traffic for a particular email server and a per-user database based on traffic analysis of observed email for a particular user email account.

8. The method of claim 1, further comprising identifying the email message as being inconsistent with normal email traffic patterns based upon a source email address or a destination email addresses being inconsistent with normal email traffic patterns reflected by the one or more traffic analysis profiles.

9. The method of claim 1, further comprising, the milter concurrently performing one or more of anti-spam processing, anti-phishing processing, anti-virus processing and other email security functions.

10. The method of claim 1, wherein said email message comprises an outbound email message originated by an end user and wherein said causing the email message to be handled in accordance with an email security policy associated with suspicious traffic patterns comprises:

alerting the end user to one or more factors contributing to the identification of the email message as being inconsistent with normal email traffic patterns by causing the outbound email message to be displayed with the one or more factors highlighted; and

allowing the end user an opportunity to address the one or more factors.

11. A program storage device readable by an electronic mail (email) processing computer system, tangibly embodying a program of instructions executable by the email processing computer system to perform method steps for evaluating email messages, said method steps comprising:

receiving an email message;

evaluating a traffic pattern represented by the email message by scanning information associated with all or a portion of the email message and comparing all or a portion of the scanned information to information associated with one or more traffic analysis profiles;

if the email message is identified as being inconsistent with normal email traffic patterns as represented by the one or more traffic analysis profiles, then causing the email message to be handled in accordance with an email security policy associated with suspicious traffic patterns.

12. The program storage device of claim 11, wherein the method further comprises causing one or more Bayesian filters to be applied to the email message or a portion thereof.

13. The program storage device of claim 12, wherein the one or more Bayesian filters include one or more of a global database based on traffic analysis of observed email traffic, a per-server database based on traffic analysis of observed email traffic for a particular email server and a per-user database based on traffic analysis of observed email for a particular user email account.

14. The program storage device of claim 11, wherein the email processing computer system comprises an email firewall.

15. The program storage device of claim 11, wherein the email processing computer system comprises an email security platform.

16. The program storage device of claim 11, wherein the email processing computer system comprises a network security appliance.

17. The program storage device of claim 11, wherein the email processing computer system comprises a gateway.