STOPPING AND REMEDIATING OUTBOUND MESSAGING ABUSE

• US 20110197275A1
• Filed: 04/20/2011
• Published: 08/11/2011
• Est. Priority Date: 02/28/2005
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Lin, Wei, Chasin, C. Scott, Kincaid-Smith, Paul
• Granted Patent: US 8,363,793 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Systems and methods are provided for allowing subscriber message sending profiles to be maintained and used in conjunction with behavior-based anomaly detection techniques and traditional content-based spam signature filtering to enable application of appropriate message disposition policies to outbound subscriber message traffic. According to one embodiment, subscriber profiles are constructed for multiple subscriber accounts associated with a service provider based on outbound message flow originated from the subscriber accounts. Then, possible subscriber account misuse may be discovered by performing behavior-based anomaly detection, including a comparison of a subscriber profile associated with the subscriber account with recent subscriber account usage information, to identify one or more behavioral anomalies in outbound message flow originated from a subscriber account, the behavior-based anomaly detection.

Claims

1. A method comprising:

constructing a subscriber profile based on outbound message flow originated from a corresponding subscriber account associated with a service provider; and

identifying a behavior-based anomaly in the outbound message flow originated from the subscriber account, based on a comparison of the subscriber profile associated with the subscriber account to recent subscriber account usage information.

2. The method of claim 1, wherein constructing the subscriber profile comprises measuring and recording on a per subscriber account basis behavior attributes including one or more of:

one or more metrics relating to size of outbound messages originated from the subscriber account;

one or more metrics number of recipients specified by outbound messages originated from the subscriber account;

one or more metrics relating to presence of attachments to outbound messages originated from the subscriber account; and

one or more metrics relating to timing of typical outbound message origination from the subscriber account.

3. The method of claim 1, further comprising responsive to identifying the behavior-based anomaly, alerting a network operations analyst of the service provider regarding the behavior-based anomaly.

4. The method of claim 1, further comprising applying a predetermined set of message disposition policies to outbound message flow originated from the subscriber account based upon subscriber reputation data associated with the subscriber profile.

5. A method comprising:

identifying subscriber email account misuse with behavior-based anomaly detection including both stationary and nonstationary models; and

redirecting suspect email traffic identified by the behavior-based anomaly detection based on application of a set of predefined message disposition policies.

6. A method comprising:

extracting behavior data from outbound messages originated from a subscriber account, wherein the behavior data includes attributes that are indicative of misuse of the subscriber account;

building a profile for the subscriber account based on the behavior data;

tracking said behavior data; and

detecting a behavior-based anomaly for the outbound messages by comparing recent outbound messages originated from the subscriber account to the profile of the subscriber account to detect changes in the recent outbound messages in comparison to the profile of the subscriber account.

7. The method of claim 6, further comprising determining reputation data for the subscriber account based on the detected behavior-based anomaly, wherein the reputation data is added to the profile to determine a reputation score, and wherein if the reputation score falls below a threshold, then any subsequent outbound messages from the subscriber account are redirected.

8. The method of claim 6, further comprising determining reputation data for the subscriber account based on the detected behavior-based anomaly, wherein the reputation data is added to the profile to determine a reputation score, and wherein if the reputation score falls below a threshold, then any subsequent outbound messages from the subscriber account are redirected for a specific time interval.

9. The method of claim 6 wherein said behavior data comprises at least one of a group consisting of:

metrics relating to a size of the outbound messages, metrics relating to a number of recipients specified in the outbound messages, metrics relating to presence of attachments to the outbound messages, metrics relating to timing of the outbound messages, a total number of the outbound messages, a total number of the outbound messages suspected of being spam, a total number of the outbound messages suspected of containing a virus, an average number of the outbound messages, an average size of the outbound messages, a largest size of the outbound messages, a maximum size permitted for the outbound messages, an average number of recipients for the outbound messages, a largest number of recipients for the outbound messages, a maximum number of recipients permitted for the outbound messages, a frequency of repetition of recipients for the outbound messages, an address format employed for the outbound messages, an average number of message header lines for the outbound messages, an average Bayesian spam filter score for the outbound messages, a number of the outbound messages originated with attachments, a number of the outbound messages originated with particular attachment types, a number of the outbound messages originated by a particular mailer, a number of the outbound messages containing a particular character set, and standard deviations of various measurements of the outbound messages.

10. The method of claim 6 further comprising alerting a network operations analyst of potential account misuse based on the detected behavior-based anomaly.

11. The method of claim 7 comprising applying a predetermined set of message disposition policies to messages originated from the subscriber account based upon the reputation score.

12. The method of claim 7 further comprising:

combining said reputation data with content-based spam signature filtering to construct combined reputation data for the subscriber account;

taking an immediate action on one of the outbound messages in response to the combined reputation data; and

taking a long term action on the subscriber account in response to said combined reputation data.

13. The method of claim 7 wherein the building of the profile is performed until there is sufficient behavior data to identify an anomaly prior to the detecting of the behavior-based anomalies.

14. A sender reputation gateway system, comprising:

a service and response system that services and responds to requests from at least one subscriber account;

a behavior data extraction system that extracts behavior data of said at least one subscriber account from outbound messages originated from the subscriber account, the behavior data including attributes of the subscriber account that are indicative of misuse of the subscriber account;

a profile builder system that builds a profile for the subscriber account based on the behavior data extracted from the outbound messages;

a tracking system that tracks the behavior data; and

an anomaly detection system that detects behavior-based anomalies for the outbound messages by comparing recent outbound messages originated from the subscriber account to the profile of the subscriber account to detect changes in the recent outbound messages in comparison to the profile of the subscriber account.

15. The sender reputation gateway system of claim 14, further comprising:

a reputation data determination system that determines reputation data for the subscriber account based on the detected behavior-based anomalies, wherein the reputation data is added to the profile to determine a reputation score, and wherein if the reputation score falls below a threshold, then any subsequent outbound messages from the subscriber account are redirected.

16. The sender reputation gateway system of claim 14, further comprising:

a reputation data determination system that determines reputation data for the subscriber account based on the detected behavior-based anomalies, wherein the reputation data is added to the profile to determine a reputation score, and wherein if the reputation score falls below a threshold, then any subsequent outbound messages from the subscriber account are redirected for a specific time interval.

17. The sender reputation gateway system of claim 14 wherein said behavior data comprises at least one of a group consisting of:

metrics relating to a size of the outbound messages, metrics relating to a number of recipients specified in the outbound messages, metrics relating to presence of attachments to the outbound messages, metrics relating to timing of the outbound messages, a total number of the outbound messages, a total number of the outbound messages suspected of being spam, a total number of the outbound messages suspected of containing a virus, an average number of the outbound messages, an average size of the outbound messages, a largest size of the outbound messages, a maximum size permitted for the outbound messages, an average number of recipients for the outbound messages, a largest number of recipients for the outbound messages, a maximum number of recipients permitted for the outbound messages, a frequency of repetition of recipients for the outbound messages, an address format employed for the outbound messages, an average number of message header lines for the outbound messages, an average Bayesian spam filter score for the outbound messages, a number of the outbound messages originated with attachments, a number of the outbound messages originated with particular attachment types, a number of the outbound messages originated by a particular mailer, a number of the outbound messages containing a particular character set, and standard deviations of various measurements of the outbound messages.

18. The sender reputation gateway system of claim 14 further comprising an alert system that alerts a network operations analyst of potential subscriber account misuse based on the behavior-based anomalies.

19. The sender reputation gateway system of claim 15 further comprising a disposition policy system that applies a predetermined set of message disposition policies to the messages originated by the subscriber account based upon the reputation data for the subscriber account.

20. The sender reputation gateway system of claim 15 wherein the reputation data determination system further combines the reputation data with content-based spam signature filtering to construct combined reputation data for the subscriber account;

takes an immediate action on a particular message originated by the subscriber account in response to the combined reputation data; and

takes a long term action on the subscriber account in response to the combined reputation data.

21. The sender reputation gateway system of claim 15 wherein the profile builder system operates until there is sufficient behavior data to identify anomalies prior to operating the anomaly detection system.

22. Logic encoded in one or more tangible media that includes code for execution and when executed by one or more processors is operable to perform operations comprising:

extracting behavior data from outbound messages originated from a subscriber account, wherein the behavior data includes attributes that are indicative of misuse of the subscriber account;

building a profile for the subscriber account based on the behavior data;

tracking said behavior data; and

detecting a behavior-based anomaly for the outbound messages by comparing recent outbound messages originated from the subscriber account to the profile of the subscriber account to detect changes in the recent outbound messages in comparison to the profile of the subscriber account.

23. The encoded logic of claim 22, further comprising determining reputation data for the subscriber account based on the detected behavior-based anomaly, wherein the reputation data is added to the profile to determine a reputation score, and wherein if the reputation score falls below a threshold, then any subsequent outbound messages from the subscriber account are redirected.

24. The encoded logic of claim 22, further comprising determining reputation data for the subscriber account based on the detected behavior-based anomaly, wherein the reputation data is added to the profile to determine a reputation score, and wherein if the reputation score falls below a threshold, then any subsequent outbound messages from the subscriber account are redirected for a specific time interval.

25. The encoded logic of claim 23 wherein said behavior data comprises at least one of a group consisting of:

metrics relating to a size of the outbound messages, metrics relating to a number of recipients specified in the outbound messages, metrics relating to presence of attachments to the outbound messages, metrics relating to timing of the outbound messages, a total number of the outbound messages, a total number of the outbound messages suspected of being spam, a total number of the outbound messages suspected of containing a virus, an average number of the outbound messages, an average size of the outbound messages, a largest size of the outbound messages, a maximum size permitted for the outbound messages, an average number of recipients for the outbound messages, a largest number of recipients for the outbound messages, a maximum number of recipients permitted for the outbound messages, a frequency of repetition of recipients for the outbound messages, an address format employed for the outbound messages, an average number of message header lines for the outbound messages, an average Bayesian spam filter score for the outbound messages, a number of the outbound messages originated with attachments, a number of the outbound messages originated with particular attachment types, a number of the outbound messages originated by a particular mailer, a number of the outbound messages containing a particular character set, and standard deviations of various measurements of the outbound messages.

26. The encoded logic of claim 22 further comprising alerting a network operations analyst of potential account misuse based on the detected behavior-based anomaly.

27. The encoded logic of claim 23 comprising applying a predetermined set of message disposition policies to messages originated from the subscriber account based upon the reputation score.

28. The encoded logic of claim 23 further comprising:

combining said reputation data with content-based spam signature filtering to construct combined reputation data for the subscriber account;

taking an immediate action on one of the outbound messages in response to the combined reputation data; and

taking a long term action on the subscriber account in response to said combined reputation data.

29. The encoded logic of claim 23 wherein the building of the profile is performed until there is sufficient behavior data to identify an anomaly prior to the detecting of the behavior-based anomalies.

30. A method comprising:

extracting behavior data from outbound messages originated from a subscriber account;

building a profile for the subscriber account based on the behavior data; and

detecting a sending behavior anomaly in the outbound messages by comparing the outbound messages with the profile of the subscriber account.

31. The method of claim 30, further comprising taking a policy action on the outbound messages based on the sending behavior anomaly.

32. The method of claim 30, further comprising rejecting at least one of the outbound messages based on the sending behavior anomaly.

33. The method of claim 30, further comprising adding a recipient to at least one of the outbound messages based on the sending behavior anomaly.

34. The method of claim 30, further comprising adding a blind copy recipient to at least one of the outbound messages based on the sending behavior anomaly.

35. The method of claim 30, further comprising taking a policy action on the subscriber account based on the behavior anomaly.

36. The method of claim 30, further comprising redirecting subsequent outbound messages originating from the subscriber account to a relay pool based on the behavior anomaly.

37. The method of claim 30, further comprising reducing privileges associated with the subscriber account based on the behavior anomaly.

38. The method of claim 30, further comprising:

adding a reputation score to the profile, wherein the reputation score is based on the sending behavior anomaly; and

routing the outbound messages based on the reputation score.

39. The method of claim 30, further comprising:

adding a reputation score to the profile, wherein the reputation score is based on the sending behavior anomaly; and

redirecting subsequent outbound messages for a specific time interval if the reputation score falls below a threshold.

40. The method of claim 30, further comprising:

adding a reputation score to the profile, wherein the reputation score is based on the sending behavior anomaly; and

routing the outbound messages to a transient mail server if the reputation score falls below a threshold.

41. The method of claim 30, further comprising:

adding a reputation score to the profile, wherein the reputation score is based on the sending behavior anomaly; and

routing the outbound messages to a dirty address if the reputation score falls below a threshold.

42. The method of claim 30, further comprising:

adding a reputation score to the profile, wherein the reputation score is based on the sending behavior anomaly and security software installed on a computer associated with the subscriber account; and

routing the outbound messages to a dirty address if the reputation score falls below a threshold.

43. The method of claim 30, wherein:

the profile includes a short-term sending profile based on the outbound messages;

the profile includes a long-term sending profile based on the behavior data; and

detecting the sending behavior anomaly comprises comparing the short-term sending profile to the long-term sending profile.

44. The method of claim 43, further comprising:

routing the outbound messages based on the reputation score.

45. The method of claim 30, further comprising authenticating a sender associated with the outbound messages and correlating the sender with a subscriber in a subscriber database.