NEWBORN DOMAIN SCREENING OF ELECTRONIC MAIL MESSAGES

• US 20160337394A1
• Filed: 05/11/2015
• Published: 11/17/2016
• Est. Priority Date: 05/11/2015
• Status: Abandoned Application

• Current Assignee: The Boeing Co.
• Original Assignee: The Boeing Co.
• Inventors: Crowley, Elizabeth Ann, Ahluwalia, Rajpreet, Nikkel, Kevin, Rothgeb, Daniel O.
• Application Number:
  US14/709,099
• Publication Number:
  US 20160337394A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 2463/121 Timestamp
• CPC Class Codes: H04L 51/08 Annexed information, e.g. attachments
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

An apparatus is provided for implementation of a system for screening electronic mail messages. The apparatus may receive an electronic mail message, and scan the electronic mail message for a uniform resource identifier (URI) of an Internet resource embedded therein. In an instance in which a URI is embedded in the electronic mail message, the apparatus may query a WHOIS server for a created date of the Internet resource. In this regard, the WHOIS server may be queried using a domain name of the Internet resource included in the URI. And the apparatus may determine an age of the Internet resource from the created date, and perform a remedial action in an instance in which the age of the Internet resource is less than a threshold age.

Claims

1. An apparatus for implementation of a system for screening electronic mail messages, the apparatus comprising a processor and a memory storing executable instructions that in response to execution by the processor cause the apparatus to implement at least:

a scanner configured to receive an electronic mail message, and scan the electronic mail message for a uniform resource identifier (URI) of an Internet resource embedded therein;

a WHOIS client coupled to the scanner and in an instance in which a URI is embedded in the electronic mail message, configured to query a WHOIS server for a created date of the Internet resource, the WHOIS server being queried using information contained in the URI from which the Internet resource is identifiable; and

a control coupled to the WHOIS client and configured to determine an age of the Internet resource from the created date, and perform a remedial action in an instance in which the age of the Internet resource is less than a threshold age.

2. The apparatus of claim 1, wherein the electronic mail message includes a message body, and the scanner being configured to scan the electronic mail message includes being configured to scan the message body for a URI.

3. The apparatus of claim 1, wherein the electronic mail message includes an attached file, and the scanner being configured to scan the electronic mail message includes being configured to scan the attached file for a URI.

4. The apparatus of claim 1, wherein the information is a domain name of the Internet resource included in the URL, and the WHOIS client being configured to query the WHOIS server includes being configured to query the WHOIS server for the created date corresponding to a date on which the domain name was registered with a domain name registry.

5. The apparatus of claim 1, wherein the control being configured to perform the remedial action includes being configured to block delivery of the electronic mail message to a recipient to which the electronic mail message is addressed.

6. The apparatus of claim 1, wherein the control being configured to perform the remedial action includes being configured to delete the URI from the electronic mail message before delivery of the electronic mail message to a recipient to which the electronic mail message is addressed.

7. The apparatus of claim 6, wherein the control being configured to perform the remedial action further includes being configured to add a user-notification regarding the deleted URI to the electronic mail message in place of the URI.

8. A method of screening electronic mail messages, the method comprising:

receiving an electronic mail message;

scanning the electronic mail message for a uniform resource identifier (URI) of an Internet resource embedded therein; and

in an instance in which a URI is embedded in the electronic mail message,

querying a WHOIS server for a created date of the Internet resource, the WHOIS server being queried using information contained in the URI from which the Internet resource is identifiable;

determining an age of the Internet resource from the created date; and

performing a remedial action in an instance in which the age of the Internet resource is less than a threshold age.

9. The method of claim 8, wherein the electronic mail message includes a message body, and scanning the electronic mail message includes scanning the message body for a URI.

10. The method of claim 8, wherein the electronic mail message includes an attached file, and scanning the electronic mail message includes scanning the attached file for a URI.

11. The method of claim 8, wherein the information is a domain name of the Internet resource included in the URL, and querying the WHOIS server includes querying the WHOIS server for the created date corresponding to a date on which the domain name was registered with a domain name registry.

12. The method of claim 8, wherein performing the remedial action includes blocking delivery of the electronic mail message to a recipient to which the electronic mail message is addressed.

13. The method of claim 8, wherein performing the remedial action includes deleting the URI from the electronic mail message before delivery of the electronic mail message to a recipient to which the electronic mail message is addressed.

14. The method of claim 13, wherein performing the remedial action further includes adding a user-notification regarding the deleted URI to the electronic mail message in place of the URI.

15. A computer-readable storage medium for screening electronic mail messages, the computer-readable storage medium being non-transitory and having computer-readable program code portions stored therein that in response to execution by a processor, cause an apparatus to at least:

receive an electronic mail message;

scan the electronic mail message for a uniform resource identifier (URI) of an Internet resource embedded therein; and

in an instance in which a URI is embedded in the electronic mail message,

query a WHOIS server for a created date of the Internet resource, the WHOIS server being queried using information contained in the URI from which the Internet resource is identifiable;

determine an age of the Internet resource from the created date; and

perform a remedial action in an instance in which the age of the Internet resource is less than a threshold age.

16. The computer-readable storage medium of claim 15, wherein the electronic mail message includes a message body, and the apparatus being caused to scan the electronic mail message includes being caused to scan the message body for a URI.

17. The computer-readable storage medium of claim 15, wherein the electronic mail message includes an attached file, and the apparatus being caused to scan the electronic mail message includes being caused to scan the attached file for a URI.

18. The computer-readable storage medium of claim 15, wherein the information is a domain name of the Internet resource included in the URL, and the apparatus being caused to query the WHOIS server includes being caused to query the WHOIS server for the created date corresponding to a date on which the domain name was registered with a domain name registry.

19. The computer-readable storage medium of claim 15, wherein the apparatus being caused to perform the remedial action includes being caused to block delivery of the electronic mail message to a recipient to which the electronic mail message is addressed.

20. The computer-readable storage medium of claim 15, wherein the apparatus being caused to perform the remedial action includes being caused to delete the URI from the electronic mail message before delivery of the electronic mail message to a recipient to which the electronic mail message is addressed.

21. The computer-readable storage medium of claim 20, wherein the apparatus being caused to perform the remedial action further includes being caused to add a user-notification regarding the deleted URI to the electronic mail message in place of the URI.