Determining whether e-mail messages originate from recognized domains

• US 7,496,634 B1
• Filed: 01/07/2005
• Issued: 02/24/2009
• Est. Priority Date: 01/07/2005
• Status: Active Grant

• Current Assignee: NortonLifeLock Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Cooley, Shaun
• Primary Examiner(s): Won; Michael
• Application Number:
  US11/031,114
• Time in Patent Office: 1,509 Days
• Field of Search: 709/205, 709/206, 709/207, 709/225, 709/229
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A message manager monitors incoming e-mail messages. The message manager determines whether the from field of each incoming e-mail message indicates that the e-mail message originates from a recognized domain. Responsive to determining that the from field indicates that the e-mail originates from a recognized domain, the message manager compares at least one domain associated with at least one link found embedded in the text of the e-mail message to a list of authorized domains. Based on the results of the comparison, the message manager determines whether the e-mail message originates from a recognized domain.

Claims

1. A computer implemented method for determining whether e-mail messages originate from recognized domains, the method comprising the steps of:

examining incoming e-mail messages;

for each incoming e-mail message, determining whether a from field of the e-mail message indicates that the e-mail message originates from a recognized domain;

responsive to determining that the from field of an incoming e-mail message indicates that the e-mail message originates from a recognized domain, identifying a list of authorized domains associated with the recognized domain from which the from field indicates that the e-mail message originates;

comparing at least one domain associated with at least one link embedded in the e-mail message to the list of authorized domains associated with the recognized domain; and

determining whether the e-mail message originates from the recognized domain responsive to results of the comparing step.

2. The method of claim 1 wherein the determining whether the e-mail message originates from the recognized domain further comprises:

responsive to at least one domain associated with at least one link embedded in the e-mail message not matching any domain in the list of authorized domains associated with the recognized domain, determining that the e-mail message does not originate from the recognized domain.

3. The method of claim 1 wherein the determining whether the e-mail message originates from the recognized domain further comprises:

responsive to each domain associated with each link embedded in the e-mail message matching a domain in the list of authorized domains associated with the recognized domain, determining that the e-mail message comprises an e-mail message originating from the recognized domain.

4. The method of claim 2 further comprising:

responsive to determining that the e-mail message does not originate from a recognized domain, performing a step from a group of steps consisting of;

blocking user access to the e-mail message;

limiting user access to the e-mail message;

deleting the e-mail message;

stripping at least one embedded link from the e-mail message; and

outputting an alert concerning the e-mail message.

5. The method of claim 3 further comprising:

responsive to determining that the e-mail message originates from the recognized domain, allowing user access to the e-mail message.

6. The method of claim 1 wherein the step of examining incoming e-mail further comprises:

scanning an e-mail stream targeted to an e-mail client.

7. The method of claim 1 wherein the step of examining incoming e-mail further comprises:

filtering incoming e-mail messages on an e-mail client.

8. At least one computer-readable storage medium containing an executable computer program product for determining whether e-mail messages originate from a recognized domain, the computer program product comprising:

program code for examining incoming e-mail messages;

program code for determining, for each incoming e-mail message, whether a from field of the e-mail message indicates that the e-mail message originates from a recognized domain;

program code for identifying a list of authorized domains associated with the recognized domain from which the from field indicates that the e-mail message originates responsive to a determination that the from field of the e-mail message indicates that the e-mail message originates from a recognized domain;

comparing at least one domain associated with at least one link embedded in the e-mail message to the list of authorized domains associated with the recognized domain; and

program code for determining whether the e-mail message originates from the recognized domain responsive to results of the comparing step.

9. The computer program product of claim 8 wherein the program code for determining whether the e-mail message originates from the recognized domain further comprises:

program code for determining that the e-mail message does not originate from the recognized domain responsive to at least one domain associated with at least one link embedded in the e-mail message not matching any domain in the list of authorized domains associated with the recognized domain.

10. The computer program product of claim 8 wherein the program code for determining whether the e-mail message originates from the recognized domain further comprises:

program code for determining that the e-mail message comprises an e-mail message originating from the recognized domain responsive to each domain associated with each link embedded in the e-mail message matching a domain in the list of authorized domains associated with the recognized domain.

11. The computer program product of claim 9 further comprising:

program code for performing, responsive to determining that the e-mail message does not originate from the recognized domain, a step from a group of steps consisting of;

blocking user access to the e-mail message;

limiting user access to the e-mail message;

deleting the e-mail message;

stripping at least one embedded link from the e-mail message; and

outputting an alert concerning the e-mail message.

12. The computer program product of claim 10 further comprising:

program code for allowing user access to the e-mail message responsive to determining that the e-mail message comprises an e-mail message originating from the recognized domain.

13. The computer program product of claim 8 wherein the program code for examining incoming e-mail further comprises:

program code for scanning an e-mail stream targeted to an e-mail client.

14. The computer program product of claim 8 wherein the program code for examining incoming e-mail further comprises:

program code for filtering incoming e-mail messages on an e-mail client.

15. A computer system for determining whether e-mail messages originate from a recognized domain, the computer system comprising:

a computer-readable storage medium containing an executable computer program product comprising;

a software portion configured to examine incoming e-mail messages;

a software portion configured to determine, for each incoming e-mail message, whether a from field of that e-mail message indicates that the e-mail message originates from a recognized domain;

a software portion configured, responsive to determining that the from field of an incoming e-mail message indicates that the e-mail message originates from a recognized domain, to identify a list of authorized domains associated with the recognized domain from which the from field indicates that the e-mail message originates;

a software portion configured to compare at least one domain associated with at least one link embedded in the e-mail message to the list of authorized domains associated with the recognized domain; and

a software portion configured to determine whether the e-mail message comprises a phishing e-mail message responsive to results of the comparing step.

16. The computer system of claim 15 wherein the software portion configured to determine whether the e-mail message comprises a phishing e-mail message is further configured to:

determine that the e-mail message is a phishing e-mail message responsive to at least one domain associated with at least one link embedded in the e-mail message not matching any domain in the list of authorized domains associated with the recognized domain.

17. The computer system of claim 15 wherein the software portion configured to determine whether the e-mail message comprises a phishing e-mail message is further configured to:

determine that the e-mail message is not a phishing e-mail message responsive to each domain associated with each link embedded in the e-mail message matching a domain in the list of authorized domains associated with the recognized domain.

18. The computer system of claim 16 further comprising:

a software portion configured to perform, responsive to determining that the e-mail message is a phishing e-mail message, a step from a group of steps consisting of;

blocking user access to the e-mail message;

limiting user access to the e-mail message;

deleting the e-mail message;

stripping at least one embedded link from the e-mail message; and

outputting an alert concerning the e-mail message.

19. The computer system of claim 17 further comprising:

a software portion configured to allow user access to the e-mail message responsive to determining that the e-mail message is not a phishing e-mail message.

20. The computer system of claim 15 wherein the software portion configured to examine incoming e-mail is further configured to:

scan an e-mail stream targeted to an e-mail client.

21. The computer system of claim 15 wherein the software portion configured to examine incoming e-mail is further configured to:

filter incoming e-mail messages on an e-mail client.