Use of geo-location data for spam detection

• US 8,001,598 B1
• Filed: 02/04/2008
• Issued: 08/16/2011
• Est. Priority Date: 04/25/2003
• Status: Expired due to Fees

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Sobel, William E., McCorkendale, Bruce
• Primary Examiner(s): Parthasarathy; Pramila
• Application Number:
  US12/025,634
• Time in Patent Office: 1,289 Days
• Field of Search: None
• US Class Current: 726/22
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/222 using geographical location information, e.g. messages transmitted or received in proximity of a certain spot or area
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Computer implemented methods, apparatus, and computer-readable media for detecting suspected spam in e-mail (24) originating from a sending computer (21). A method embodiment comprises the steps of determining (11) the actual IP address (23) of the sending computer (21); converting (12) the actual IP address (23) into geo-location data; and, using the geo-location data, ascertaining (13) whether the e-mail (24) contains suspected spam.

Claims

1. A computer implemented method for detecting suspected spam in e-mail originating from a sending computer, said method comprising:

using a computer to perform steps comprising;

determining an actual Internet Protocol (IP) address of the sending computer;

converting the actual IP address into geo-location data comprising information about a geographical location associated with the sending computer; and

using the geo-location data, ascertaining whether the e-mail contains suspected spam, wherein the ascertaining comprises;

comparing the geo-location data with a claimed geo-location claimed by the sending computer, wherein the claimed geo-location is derived from a Domain Name System (DNS) address claimed by the sending computer and is a location where a domain within the DNS address has a mail transfer agent, locations where the domain has a mail transfer agent are listed in a database, and the database is compiled with respect to e-mail allegedly emanating from common domains; and

determining whether the e-mail contains suspected spam responsive to the comparison of the geo-location data with the claimed geo-location.

2. The method of claim 1 wherein the actual IP address is determined when the sending computer connects to a second mail transfer agent.

3. The method of claim 1 wherein the actual IP address is gleaned from a transport layer using the Transmission Control Protocol (TCP).

4. The method of claim 1 wherein the actual IP address is determined from a return path header associated with the e-mail.

5. The method of claim 4 wherein:

the e-mail is received by a recipient computer;

there are a plurality of mail transfer agents situated between the sending computer and the recipient computer; and

the determining the actual IP address step comprises deriving the actual IP address from the return path header associated with a mail transfer agent that is closest to the sending computer, as long as said closest mail transfer agent, and each mail transfer agent situated between said closest mail transfer agent and said recipient computer, is trusted by the recipient computer.

6. The method of claim 5 wherein a mail transfer agent is trusted by the recipient computer when at least one of the following conditions is satisfied:

the mail transfer agent is co-located with the recipient computer in a common enterprise;

the mail transfer agent appears on a list of trusted computers that is kept by the recipient computer; and

the recipient computer has never been spoofed by the mail transfer agent.

7. The method of claim 1 wherein the geo-location data has a confidence number associated therewith, and the ascertaining step is performed responsive to the confidence number exceeding a pre-selected threshold.

8. The method of claim 1 wherein the ascertaining step comprises comparing the geo-location data with an access control list.

9. The method of claim 1 wherein the claimed geo-location is derived from domain information inserted by the sending computer as part of a HELO or EHLO command pursuant to a Simple Mail Transfer Protocol (SMTP) protocol.

10. The method of claim 1 wherein:

the e-mail is received by a recipient computer; and

the claimed geo-location is further derived from a Domain Name System (DNS) address appearing in e-mail client software associated with the recipient computer.

11. The method of claim 1, wherein the database is from a group of databases consisting of at least of:

a database listing locations disclosed by an owner of the domain;

a database compiled by machine learning techniques; and

a database compiled by noticing locations from which a large amount of e-mail has emanated.

12. The method of claim 1 wherein a domain is deemed to be common during a training phase by virtue of being responsible for at least a certain preselected threshold percentage worth of total e-mail traffic observed during the training phase.

13. The method of claim 1 wherein the geo-location data comprises data giving an actual geographical location fo the sending computer.

14. The method of claim 1 wherein at least one of the determining an actual IP address, converting, and ascertaining steps is performed by a mail transfer agent computer that processes the e-mail.

15. The method of claim 1 wherein the geo-location data further comprises data identifying an actual geographical location of the sending computer.

16. A computer program product for detecting suspected spam in e-mail originating from a sending computer, comprising:

a non-transitory computer-readable storage medium; and

executable computer program code, encoded on the computer-readable medium, for;

determining an actual IP address of the sending computer;

converting the actual IP address into geo-location data comprising information about a geographical location associated with the sending computer; and

using the geo-location data, ascertaining whether the e-mail contains suspected spam, wherein the ascertaining comprises;

comparing the geo-location data with a claimed geo-location claimed by the sending computer, wherein the claimed geo-location is derived from a Domain Name System (DNS) address claimed by the sending computer and is a location where a domain within the DNS address has a mail transfer agent, locations where the domain has a mail transfer agent are listed in a database, and the database is compiled with respect to e-mail allegedly emanating from common domains; and

determining whether the e-mail contains suspected spam responsive to the comparison of the geo-location data with the claimed geo-location.

17. An apparatus for detecting suspected spam in e-mail originating from a sending computer, said apparatus comprising:

means for determining an actual IP address of the sending computer;

coupled to the determining means, means for converting the actual IP address into geo-location data comprising information about a geographical location associated with the sending computer; and

coupled to the converting means, means for ascertaining, using the geo-location data, whether the e-mail contains suspected spam, wherein the ascertaining comprises;

comparing the geo-location data with a claimed geo-location claimed by the sending computer, wherein the claimed geo-location is derived from a Domain Name System (DNS) address claimed by the sending computer and is a location where a domain within the DNS address has a mail transfer agent, locations where the domain has a mail transfer agent are listed in a database, and the database is compiled with respect to e-mail allegedly emanating from common domains; and

determining whether the e-mail contains suspected spam responsive to the comparison of the geo-location data with the claimed geo-location.