Systems and methods for message threat management

• US 7,225,466 B2
• Filed: 03/24/2006
• Issued: 05/29/2007
• Est. Priority Date: 03/08/2002
• Status: Expired due to Term

• Current Assignee: McAfee, LLC
• Original Assignee: Secure Computing Corporation (McAfee, LLC)
• Inventors: Judge, Paul
• Primary Examiner(s): Vu; Kim
• Assistant Examiner(s): TO, BAOTRAN N
• Application Number:
  US11/388,575
• Publication Number:
  US 20060174341A1
• Time in Patent Office: 431 Days
• Field of Search: 726 22- 25, 726/6, 713/188, 370/20, 370/230, 709223-225
• US Class Current: 726/22
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

The present invention is directed to systems and methods for detecting unsolicited and threatening communications and communicating threat information related thereto. Threat information is received from one or more sources; such sources can include external security databases and threat information data from one or more application and/or network layer security systems. The received threat information is reduced into a canonical form. Features are extracted from the reduced threat information; these features in conjunction with configuration data such as goals are used to produce rules. In some embodiments, these rules are tested against one or more sets of test data and compared against the same or different goals; if one or more tests fail, the rules are refined until the tests succeed within an acceptable margin of error. The rules are then propagated to one or more application layer security systems.

Claims

1. A management system for generating and distributing threat detection rules to application layer security systems, the system comprising:

a. a communication interface adapted to allow communication between the management system and at least one application layer security system;

b. a system data store comprising one or more data storage elements, wherein the system data store is capable of storing;

i. one or more sets of threat management goals; and

ii. threat information; and

c. a system processor in communication with the communication interface and the system data store, wherein the system processor comprises one or more processing elements and the one or more processing elements are programmed or adapted to;

i. receive threat information from one or more sources;

ii. reduce the received threat information into a canonical form;

iii. extract features from the reduced threat information;

iv. generate a rule set of one or more threat rules based upon the extracted features and a goal set of one or more threat management goals in the system data store; and

v. transmit the generated rule set to at least one of the plurality of application layer security systems.

2. The system of claim 1, wherein the system data store is further capable of storing one or more sets of test data, wherein the system processor is further programmed or adapted to evaluate the generated rule set against one or more sets of test data in the system data store and to refine the rule set if the evaluation of the rule set fails to satisfy a predetermined confidence level.

3. The system of claim 2, wherein the system processor evaluates the generated rule set against one or more sets of test data based upon the goal set used to generate the rule set.

4. The system of claim 3, wherein the second goal set comprises one or more values of a type selected from the group of effectiveness values, accuracy values, efficiency values and false positive values.

5. The system of claim 2, wherein the system processor evaluates the generated rule set against one or more sets of test data based upon a second goal set of one or more goals from the system data store that differs from the goal set used to generate the rule set.

6. The system of claim 5, wherein the second goal set comprises one or more values of a type selected from the group of effectiveness values, accuracy values, efficiency values and false positive values.

7. The system of claim 1, wherein the goal set comprises one or more attributes selected from the group consisting of effectiveness values, accuracy values, efficiency values and false positive values.

8. The system of claim 1, wherein the goal set comprises one or more undesirable message types, wherein each undesirable message type is selected from the group consisting of business email, personal email, chain letters, adult language, porn, web product offerings, newsletters, mailing lists, Trojans, worms and viruses.

9. The system of claim 8, wherein associated with each undesirable message type is a value corresponding to a level of undesirability for the message type.

10. The system of claim 1, wherein the system processor is further programmed or adapted to select the goal set from the system data store.

11. The system of claim 10, wherein the system processor'"'"'s programming or adaptation to select the goal set includes programming or adaptation to select the goal set based at least in part upon a selected application layer security system from the plurality of application layer security systems.

12. The system of claim 11, wherein the system processor transmits the generated rule set to at least the selected application layer security system.

13. The system of claim 1, wherein the system processor receives threat information from a selected application layer security system via the communication interface.

14. The system of claim 1, wherein the system processor receives threat information from a spam database, a virus information database, an intrusion information database or combinations thereof.

15. The system of claim 14, wherein the system processor receives further threat information from a selected application layer security system via the communication interface.

16. The system of claim 1, wherein the system processor extracts features that each correspond to an interrogation type available on at least one of the plurality of application layer security systems.

17. The system of claim 1, wherein the system processor extracts features by applying one or more regular expression filters.

18. The system of claim 1, wherein the system processor is further programmed or adapted to receive at least one rules and policy application programming interface.

19. The system of claim 18, wherein the system processor generates the rule set based upon the at least one rules and policy application programming interface.

20. A method for generating and distributing threat detection rules to application layer security systems, the method comprising:

receiving threat information from one or more sources comprising application layer security systems, spam databases, a virus information databases, intrusion information databases, or combinations thereof;

reducing the received threat information into a canonical form;

extracting features from the reduced threat information by applying one or more regular expressions;

selecting a goal set of one or more threat management goals based at least in part upon a selected application layer security system from the plurality of application layer security systems, wherein the goal set comprises one or more values of a type comprising effectiveness values, accuracy values, efficiency values, false positive values, or combinations thereof;

generating a candidate rule set of one or more threat rules based upon the extracted features and the goal set;

testing the candidate rule set against one or more sets of test data;

refining the candidate rule set if the evaluation of the rule set fails to satisfy a predetermined confidence level; and

transmitting the candidate or refined rule set to at least one application layer security system.