Fraudulent message detection

• US 7,665,140 B2
• Filed: 10/29/2007
• Issued: 02/16/2010
• Est. Priority Date: 09/08/2003
• Status: Active Grant

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Eikenberry, Scott D., Kim, Brian, Oliver, Jonathan, Budman, Gleb
• Primary Examiner(s): Revak; Christopher A
• Application Number:
  US11/927,483
• Publication Number:
  US 20080168555A1
• Time in Patent Office: 841 Days
• Field of Search: None
• US Class Current: 726/24
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A technique for classifying a message is disclosed. In some embodiments, the technique comprises extracting a plurality of reference points, classifying the plurality of reference points, and detecting that the message is a phish message based on the classified reference points. In some embodiments, the technique comprises identifying a plurality of fraud indicators in the message, applying a statistical analysis on the plurality of fraud indicators; and determining whether the message is a fraudulent message based on the analysis.

Claims

1. A method for classifying a message, comprising:

identifying a plurality of fraud indicators in the message;

classifying the plurality of fraud indicators;

applying a statistical analysis on the plurality of classified fraud indicators, wherein each fraud indicator is associated with a weight and a score;

determining whether the message is a fraudulent message based on the analysis; and

processing the message based on the determination that the message is a fraudulent message.

2. The method of claim 1, wherein identifying the plurality of fraud indicators includes identifying a raw Internet Protocol (IP) address.

3. The method of claim 1, wherein identifying the plurality of fraud indicators includes identifying non-standard encoding in the message.

4. The method of claim 1, wherein identifying the plurality of fraud indicators includes identifying a link with an embedded user name.

5. The method of claim 1, wherein identifying the plurality of fraud indicators includes identifying a link including a reference to an entity but not linking to the entity.

6. The method of claim 1, wherein identifying the plurality of fraud indicators includes identifying a mismatched link name, the mismatched link name displaying a uniform resource locator (URL) but linking to a different URL.

7. The method of claim 1, wherein identifying the plurality of fraud indicators includes identifying a form in the message.

8. The method of claim 7, wherein the form in the message requests personal information from the user.

9. The method of claim 1, wherein identifying the plurality of fraud indicators includes identifying content known to be associated with fraudulent messages.

10. The method of claim 1, wherein determining whether the message is a fraudulent message further includes:

counting the plurality of fraud indicators; and

computing a probability of the message being a fraudulent message based on the count wherein the message is determined to be fraudulent if the probability meets a predefined threshold.

11. The method of claim 1, wherein determining whether the message is a fraudulent message further includes calculating a score based on the weight and score associated with each of the plurality of fraud indicators, wherein the message is determined to be fraudulent if the score meets a predefined threshold.

12. The method of claim 1, wherein determining whether the message is a fraudulent message further includes:

identifying at least one reference point for contacting a source that has been determined to be illegitimate; and

detecting a divergence between a legitimate reference point in the message and the identified illegitimate reference point, wherein the message is determined to be fraudulent based on the detected divergence.

13. An apparatus for classifying a message, comprising:

a memory configured to store a plurality of fraud indicators, each fraud indicator associated with a weight and a score; and

a processor for executing instructions stored in memory, wherein execution of instructions by the processor;

identifies a plurality of fraud indicators in the message;

classifies the plurality of fraud indicators;

applies a statistical analysis based on the weight and score associated with each of the plurality of classified fraud indicators;

determines whether the message is a fraudulent message based on the analysis, and

processes the message based on the determination that the message is a fraudulent message.

14. The apparatus of claim 13, wherein execution of the instructions by the processor:

counts the plurality of fraud indicators, and

computes a probability of the message being a fraudulent message based on the count, wherein the message is determined to be fraudulent if the probability meets a predefined threshold.

15. The apparatus of claim 13, wherein execution of the instructions by the processor further:

calculates a score based on the weight and score associated with each of the plurality of fraud indicators, and

determines the message to be fraudulent if the score meets a predefined threshold.

16. The apparatus of claim 13, wherein execution of the instructions by the processor further:

identifies at least one reference point for contacting an illegitimate source,

detects a divergence between a legitimate reference point in the message and the identified reference point to the source determined to be not legitimate,

determines the message to be fraudulent based on the detected divergence.

17. A computer-readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for classifying a message, the method comprising:

identifying a plurality of fraud indicators in the message;

classifying the plurality of fraud indicators;

applying a statistical analysis on the plurality of classified fraud indicators, wherein each fraud indicator is associated with a weight and a score;

determining whether the message is a fraudulent message based on the analysis; and

processing the message based on the determination that the message is a fraudulent message.

18. The computer-readable storage medium of claim 17, wherein the program is further executable to:

count the plurality of fraud indicators;

compute a probability of the message being a fraudulent message based on the count; and

determine the message to be fraudulent if the probability meets a predefined threshold.

19. The computer-readable storage medium of claim 18, wherein the program is further executable to:

calculate a score based on the weight and score associated with each of the plurality of fraud indicators; and

determine the message to be fraudulent if the score meets a predefined threshold.

20. The computer-readable storage medium of claim 18, wherein the program is further executable to:

identify at least one reference point for contacting an illegitimate source;

detect a divergence between a legitimate reference point in the message and the identified reference point to the illegitimate source; and

determine the message to be fraudulent based on the detected divergence.