HIERARCHICAL STATISTICAL MODEL OF INTERNET REPUTATION

• US 20110055923A1
• Filed: 09/02/2009
• Published: 03/03/2011
• Est. Priority Date: 09/02/2009
• Status: Active Grant

• Current Assignee: Sophos Limited (Sophos Group Ltd.)
• Original Assignee: Sophos Limited (Sophos Group Ltd.)
• Inventors: Thomas, Ross G.
• Granted Patent: US 7,890,627 B1
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

In embodiments of the present invention improved capabilities are described for predicting the reputation of a communication identifier, such as a web address, a domain name, an IP address, host name, email address, IM address, telephone number, VoIP telephony address, and the like. In embodiments, the present invention may receive a communication from a first communication identifier, parse the first communication identifier into its components, and assign the components to a hierarchical tree structure, where the hierarchical tree structure maintains the hierarchical relationship between the components of the communication identifier. The present invention may monitor and keep count of a number of communications from the first communication identifier, wherein the number of communications may be kept for both malicious and/or unwanted communications and non-malicious and/or unwanted communications. Attributes may then be provided to the number of communications for each appropriate component of the hierarchical tree, and a statistical measure may be calculated as related to the number of communications for each component of the hierarchical tree. The present invention may then receive a communication from a second communication identifier, where the second communication identifier may be previously unknown and have a common component with the hierarchical tree. The statistical measure of the common component may then be assigned to the second communication identifier, and utilizing the statistical measure assigned to the second communication identifier, may provide a prediction of reputation of the second communication identifier.

Claims

1. A computer program product embodied in a computer readable medium that, when executing on one or more computers, performs the steps of:

receiving a communication from a first communication identifier;

parsing the first communication identifier into its components and assigning the components to a hierarchical tree structure, wherein the hierarchical tree structure maintains the hierarchical relationship between the components of the communication identifier;

monitoring and keeping count of a number of communications from the first communication identifier, wherein the number of communications includes both a count of at least one of malicious and unwanted communications and a count of at least one of non-malicious and unwanted communications;

attributing the number of communications to each appropriate component of the hierarchical tree;

calculating a statistical measure related to the number of communications for each component of the hierarchical tree;

receiving a communication from a second communication identifier, wherein the second communication identifier is previously unknown and has a common component with the hierarchical tree;

assigning the statistical measure of the common component to the second communication identifier; and

utilizing the statistical measure assigned to the second communication identifier to provide a prediction of reputation of the second communication identifier.

2. The computer program product of claim 1, wherein the communication identifier is in the form of a web address.

3. The computer program product of claim 1, wherein the communication identifier is in the form of a domain name.

4. The computer program product of claim 2, wherein the components are domain name components.

5. The computer program product of claim 1, wherein the communication identifier is in the form of an IP address.

6. The computer program product of claim 4, wherein the components are IP address components.

7. The computer program product of claim 1, wherein the communication identifier is in the form of an email address.

8. The computer program product of claim 1, wherein the communication identifier is in the form of an IM address.

9. The computer program product of claim 1, wherein the communication identifier is in the form of a telephone number.

10. The computer program product of claim 1, wherein the communication identifier is in the form of a VoIP telephony address.

11. The computer program product of claim 1, wherein the component is at a root level.

12. The computer program product of claim 1, wherein the component is at a lower level.

13. The computer program product of claim 1, wherein the at least one of malicious and unwanted communication is spam.

14. The computer program product of claim 1, wherein the at least one of malicious and unwanted communication is from a computer that is part of a botnet.

15. The computer program product of claim 1, wherein the statistical measure relates the number of at least one of malicious and unwanted communications to the number of total communications.

16. The computer program product of claim 1, wherein the reputation is related to how much spam a website communicates.