Use of global intelligence to make local information classification decisions

• US 8,103,727 B2
• Filed: 08/30/2007
• Issued: 01/24/2012
• Est. Priority Date: 08/30/2007
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Lin, Kunhua
• Primary Examiner(s): Chankong, Dohm
• Assistant Examiner(s): UTREJA, NEERAJ K
• Application Number:
  US11/847,334
• Publication Number:
  US 20090064323A1
• Time in Patent Office: 1,608 Days
• Field of Search: 709/206
• US Class Current: 709/206
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]

Abstract

Methods and systems are provided for delaying local information classification until global intelligence has an opportunity to be gathered. According to one embodiment, an initial information identification process, e.g., an initial spam detection, is performed on received electronic information, e.g., an e-mail message. Based on the initial information identification process, classification of the received electronic information is attempted. If the received electronic information cannot be unambiguously classified as being within one of a set of predetermined categories (e.g., spam or clean), then an opportunity is provided for global intelligence to be gathered regarding the received electronic information by queuing the received electronic information for re-evaluation. The electronic information is subsequently classified by performing a re-evaluation information identification process, e.g., re-evaluation spam detection, which provides a more accurate categorization result than the initial information identification process. Handling the electronic information in accordance with a policy associated with the categorization result.

Claims

1. A method comprising:

performing, by an anti-spam engine of a network of a plurality of anti-spam engines participating in a global intelligence network, an initial spam detection process on an electronic mail (e-mail) message received from a sender, the initial spam detection process including (i) considering a spam score associated with the e-mail message by forming a signature of the e-mail message based on attributes extracted from the e-mail message and querying a remote server associated with the global intelligence network that maintains and updates spam score information based on direct or indirect observations and analysis of queries from the plurality of anti-spam engines, (ii) considering a sender Internet Protocol (IP) reputation associated with the sender by evaluating reputation information supplied by a remote reputation server associated with the global intelligence network and (iii) applying, to the e-mail message, heuristic rules, which are updated by a remote heuristic rule update server associated with the global intelligence network to adapt to changes in spam trends observed by the global intelligence network based on direct or indirect observations and analysis of query volume or patterns for e-mail message signatures received from the plurality of anti-spam engines;

attempting to classify the received e-mail message, by the anti-spam engine, as clean or spam based on the initial spam detection process;

if the received e-mail message cannot be unambiguously classified as being clean or spam in real-time based on the initial spam detection process, then providing, by the anti-spam engine, an opportunity for global intelligence to be gathered by the global intelligence network regarding the e-mail message or e-mail messages having similar attributes by queuing the e-mail message for a re-evaluation spam detection process to be performed at a later time;

classifying, by the anti-spam engine, the queued e-mail message by performing the re-evaluation spam detection process, including re-evaluation of the spam score, re-evaluation of the sender IP reputation and reapplication of the heuristic rules, the re-evaluation spam detection process providing a more accurate categorization result than the initial spam detection process;

handling the queued e-mail message, by the anti-spam engine, in accordance with a policy associated with the more accurate categorization result; and

wherein the anti-spam engine is implemented in one or more processors and one or more computer-readable storage media of one or more computer systems, the one or more computer-readable storage media having instructions tangibly embodied therein representing the anti-spam engine that are executable by the one or more processors.

2. The method of claim 1, wherein the initial spam detection process is performed by an e-mail server.

3. The method of claim 2, wherein the re-evaluation spam detection process is performed by an e-mail client.

4. The method of claim 1, wherein the initial spam detection process is performed by a network gateway.

5. The method of claim 4, wherein the re-evaluation spam detection process is performed by an e-mail client.

6. The method of claim 1, wherein said performing the re-evaluation spam detection process is triggered responsive to a re-evaluation event.

7. The method of claim 6, wherein the re-evaluation event comprises one or more of:

existence of updated spam score information within the global intelligence network;

existence of updated sender reputation information within the global intelligence network;

availability of updated heuristic rules;

passing of a predetermined amount of time since the initial spam detection process was performed; and

expiration of an interval timer.

8. A non-transitory program storage device readable by one or more processors of a computer system, tangibly embodying a program of instructions executable by the one or more processors to perform method steps for performing spam detection, said method steps comprising:

performing, by an anti-spam engine of a network of a plurality of anti-spam engines participating in a global intelligence network, an initial spam detection process on an electronic mail (e-mail) message received from a sender, the initial spam detection process including (i) considering a spam score associated with the e-mail message by forming a signature of the e-mail message based on attributes extracted from the e-mail message and querying a remote server associated with the global intelligence network that maintains and updates spam score information based on direct or indirect observations and analysis of queries from the plurality of anti-spam engines, (ii) considering a sender Internet Protocol (IP) reputation associated with the sender by evaluating reputation information supplied by a remote reputation server associated with the global intelligence network and (iii) applying, to the e-mail message, heuristic rules, which are updated by a remote heuristic rule update server associated with the global intelligence network to adapt to changes in spam trends observed by the global intelligence network based on direct or indirect observations and analysis of query volume or patterns for e-mail message signatures received from the plurality of anti-spam engines;

attempting to classify the received e-mail message as clean or spam based on the initial spam detection process;

if the received e-mail message cannot be unambiguously classified as being clean or spam in real-time based on the initial spam detection process, then providing an opportunity for global intelligence to be gathered by the global intelligence network regarding the e-mail message or e-mail messages having similar attributes by queuing the e-mail message for a re-evaluation spam detection process to be performed at a later time;

classifying the queued e-mail message by performing the re-evaluation spam detection process, including re-evaluation of the spam score, re-evaluation of the sender IP reputation and reapplication of the heuristic rules, the re-evaluation spam detection process providing a more accurate categorization result than the initial spam detection process; and

handling the queued e-mail message in accordance with a policy associated with the more accurate categorization result.

9. The program storage device of claim 8, wherein the initial spam detection process is performed by an e-mail server.

10. The program storage device of claim 9, wherein the re-evaluation spam detection process is performed by an e-mail client.

11. The program storage device of claim 8, wherein the initial spam detection process is performed by a network gateway.

12. The program storage device of claim 11, wherein the re-evaluation spam detection process is performed by an e-mail client.

13. The program storage device of claim 8, wherein said performing the re-evaluation spam detection process is triggered responsive to a re-evaluation event.

14. The program storage device of claim 13, wherein the re-evaluation event comprises one or more of:

existence of updated spam score information within the global intelligence network;

existence of updated sender reputation information within the global intelligence network;

availability of updated heuristic rules;

passing of a predetermined amount of time since the initial spam detection process was performed; and

expiration of an interval timer.