Message profiling systems and methods

• US 8,132,250 B2
• Filed: 07/01/2005
• Issued: 03/06/2012
• Est. Priority Date: 03/08/2002
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Judge, Paul, Rajan, Guru, Alperovitch, Dmitri, Moyer, Matt, Krasser, Sven
• Primary Examiner(s): Abrishamkar, Kaveh
• Application Number:
  US11/173,941
• Publication Number:
  US 20060015563A1
• Time in Patent Office: 2,440 Days
• Field of Search: 726/13
• US Class Current: 726/13
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

Methods and systems for operation upon one or more data processors that classify communications from messaging entities. A method can include receiving a communication that was sent from a messaging entity. A plurality of message classification techniques is used to classify the communication. Each message classification technique is associated with a confidence value which is used in generating a message classification output from the message classification technique. The message classification outputs are combined in order to generate a message profile score. The message profile score is used in deciding what action is to be taken with respect to the communication associated with the messaging entity.

Claims

1. A computer-implemented method for operation upon one or more data processors to classify communications from messaging entities, comprising:

receiving a communication from a messaging entity via a communication network interface;

storing the communication in computer memory;

using a plurality of message classification techniques executed by a data processor to classify the stored communication; and

combining the outputs of the message classification techniques using the data processor to generate a message profile score;

wherein the message profile score is used by a communication filter in deciding what action is to be taken with respect to the communication associated with the messaging entity;

wherein a tuner is used to adjust confidence values associated with the message classification outputs, the tuner operating upon the data processor using a genetic algorithm including a fitness function modeling the fitness of candidate solutions to a problem domain associated with the message classification techniques, the fitness function comprising the equation;

2. The computer-implemented method of claim 1, wherein the communication is a e-mail message or VoIP communication or Instant Messaging communication.

3. The computer-implemented method of claim 1, wherein the communication is a legitimate e-mail message or spam or a virus or a communication that violates corporate policy.

4. The computer-implemented method of claim 1, wherein the message classification techniques include at least two techniques selected from the group:

a Reverse DNS (RDNS) classification technique, Real-time Black-hole Lists (RBLs) classification technique, reputation server classification technique, signature-based classification technique, fingerprinting-based classification technique, message header analysis classification technique, sender authentication set of classification techniques, Bayesian filtering statistical classification technique, clustering classification technique, and content filtering classification technique.

5. The computer-implemented method of claim 1, wherein each message classification technique is associated with a confidence value which is used in generating a message classification output from the message classification technique.

6. The computer-implemented method of claim 5, wherein a filter value from each of the classification techniques is multiplied by its associated confidence value in order to generate the message classification output.

7. The computer-implemented method of claim 6, further comprising:

iterating through the classification techniques and allowing each technique to attempt to classify the message;

wherein the output of each classification is a numeric value, textual value, or categorical value.

8. The computer-implemented method of claim 7, wherein the message profile score is determined by:

9. The computer implemented method of claim 7, wherein the message profile score is determined by:

10. The computer-implemented method of claim 1, wherein at least one of the message classification techniques includes a reputation scoring technique;

wherein the reputation scoring technique assigns a reputation probability to a messaging entity;

wherein the reputation indicative probability indicates reputability of a messaging entity based upon extent to which the identified one or more communication'"'"'s characteristics exhibit or conform to one or more reputation-related criteria.

11. The computer-implemented method of claim 1, wherein the communication was sent over a network.

12. A system for operation upon one or more data processors to classify communications from messaging entities, comprising:

a plurality of message classification engines stored in one or more computer readable media and causing one or more data processors to classify a communication received from a messaging entity;

a message profiling engine stored in any of the one or more computer readable media and causing one or more of the data processors to combine the message classification outputs from the classification engines, thereby generating a message profile score;

wherein the message profile score is used by message filtering systems in deciding what action is to be taken with respect to the communication associated with the messaging entity;

wherein a tuner is used to adjust confidence values associated with the message classification outputs, the tuner using a genetic algorithm including a fitness function modeling the fitness of candidate vector solutions for the confidence values, the fitness function expressing cost associated with the mistakes that a candidate vector solution made in attempting to correctly classify messages in a set of pre-classified data.

13. The system of claim 12, wherein the communication is a e-mail message or VoIP communication or Instant Messaging communication.

14. The system of claim 12, wherein the communication is a legitimate message or unwanted communication or a communication violative of a pre-selected policy.

15. The system of claim 14, wherein an unwanted communication includes a spam or virus communication;

wherein the pre-selected policy includes a corporate communication policy, a messaging policy, a legislation or regulatory policy, or an international communication policy.

16. The system of claim 12, wherein the message classification engines include at least two techniques selected from the group:

Reverse DNS (RDNS) classification technique, Real-time Black-hole Lists (RBLs) classification technique, reputation server classification technique, signature-based classification technique, fingerprinting-based classification technique, message header analysis classification technique, sender authentication set of classification techniques, Bayesian filtering statistical classification technique, clustering classification technique, and content filtering classification technique.

17. The system of claim 12, wherein each message classification engine is associated with a confidence value which is used in generating a message classification output from the message classification engine.

18. The system of claim 17, wherein a filter value from each of the classification engines is multiplied by its associated confidence value in order to generate the message classification output.

19. The system of claim 18, wherein the output of each classification engine is a numeric value, textual value, or categorical value.

20. The system of claim 12, wherein the fitness function comprises:

21. The system of claim 12, wherein the system is configured to operate with adaptive message blocking and whitelisting.

22. The system of claim 12, wherein at least one of the message classification engines includes a reputation scoring technique;

wherein the reputation scoring technique assigns a reputation probability to a messaging entity;

wherein the reputation indicative probability indicates reputability of a messaging entity based upon extent to which the identified one or more communication'"'"'s characteristics exhibit or conform to one or more reputation-related criteria.

23. The system of claim 12, wherein the communication was sent over a network.

24. A system for operation upon one or more data processors to classify communications from messaging entities, comprising:

means for receiving a communication that was sent over a network from a messaging entity;

means for using a plurality of message classification techniques to classify the communication;

wherein each message classification technique is associated with a confidence value which is used in generating a message classification output for the message classification technique;

means for combining the message classification outputs in order to generate a message profile score;

wherein the message profile score is used in deciding what action is to be taken with respect to the communication associated with the messaging entity; and

wherein a tuner is used to adjust confidence values associated with the message classification outputs, the tuner using a genetic algorithm including a fitness function modeling the fitness of candidate vector solutions for the confidence values, the fitness function expressing cost associated with the mistakes that a candidate vector solution made in attempting to correctly classify messages in a set of pre-classified data.

25. An article of manufacture comprising instructions stored in one or more computer readable storage media and executable by a processing system, and upon such execution causing the processing system to perform operations comprising:

receiving a communication that was sent over a network from a messaging entity;

using a plurality of message classification techniques to classify the communication;

combining the message classification outputs from the classification techniques in order to generate a message profile score;

wherein the message profile score is used in deciding what action is to be taken with respect to the communication associated with the messaging entity;

wherein a tuner is used to adjust confidence values associated with the message classification outputs, the tuner using a genetic algorithm including a fitness function modeling the fitness of candidate vector solutions for the confidence values, the fitness function expressing cost associated with the mistakes that a candidate vector solution made in attempting to correctly classify messages in a set of pre-classified data.

26. The article of claim 25, wherein the digital signal includes packetized data that is transmitted through the network.

27. A computer-implemented method for operation upon one or more data processors for tuning message classification parameters for use by a plurality of message classification techniques, comprising:

receiving a plurality of input data via a communication network interface that is representative of a plurality of communications;

storing the data in computer memory;

using a tuner program operating on the one or more data processors to tune the message classification parameters associated with the message classification techniques;

wherein a communication is received via the communications interface from a messaging entity;

wherein the tuned message classification parameters are used by the plurality of message classification techniques executed by the one or more data processors to classify the received communication;

wherein message classification outputs from the plurality of message classification techniques executed by the one or more data processors are combined by the one or more data processors in order to generate a message profile score;

wherein the message profile score is used by a messaging filter in deciding what action is to be taken with respect to the communication associated with the messaging entity;

wherein the tuner program operating on the one or more data processors is used to adjust confidence values associated with the message classification outputs, the tuner program using a genetic algorithm including a fitness function modeling the fitness of candidate vector solutions for the confidence values, the fitness function expressing cost associated with the mistakes that a candidate vector solution made in attempting to correctly classify messages in a set of pre-classified data.

28. The computer-implemented method of claim 27, wherein the message classification parameters include confidence values.

29. The computer-implemented method of claim 28, wherein the tuner program uses a heuristic approach in order to tune the confidence values.

30. The computer-implemented method of claim 27, wherein the fitness function is:

31. The computer-implemented method of claim 27, wherein the method is configured to operate with adaptive message blocking and whitelisting.

32. The computer-implemented method of claim 27, wherein the received communication is a e-mail message or VoIP communication or Instant Messaging communication.

33. The computer-implemented method of claim 27, wherein the received communication is a legitimate e-mail message or spam or a virus or a communication that violates corporate policy.

34. The computer-implemented method of claim 27, wherein the message classification techniques include at least two techniques selected from the group:

a Reverse DNS (RDNS) classification technique, Real-time Black-hole Lists (RBLs) classification technique, reputation server classification technique, signature-based classification technique, fingerprinting-based classification technique, message header analysis classification technique, sender authentication set of classification techniques, Bayesian filtering statistical classification technique, clustering classification technique, and content filtering classification technique.

35. The computer-implemented method of claim 27, wherein the message classification parameters include confidence values;

wherein a message classification technique is associated with a confidence value which is used in generating a message classification output from the message classification technique.

36. The computer-implemented method of claim 35, wherein a filter value from each of the classification techniques is multiplied by its associated confidence value in order to generate a message classification output.

37. The computer-implemented method of claim 36, further comprising:

iterating through the classification techniques and allowing each technique to attempt to classify the message;

wherein the output of each classification is a numeric value, textual value, or categorical value.

38. The computer-implemented method of claim 27, wherein at least one of the message classification techniques includes a reputation scoring technique;

wherein the reputation scoring technique assigns a reputation probability to a messaging entity;

wherein the reputation indicative probability indicates reputability of a messaging entity based upon extent to which the identified one or more communication'"'"'s characteristics exhibit or conform to one or more reputation-related criteria.

39. The computer-implemented method of claim 27, wherein the communication was sent over a network.

40. A system for operation upon one or more data processors for tuning message classification parameters for use by one or more message classification techniques, comprising:

a communication network interface to receive a plurality of input data that is or is representative of a plurality of communications;

storing the data in computer memory;

a tuner program operating on the one or more data processors to tune the message classification parameters associated with the message classification techniques;

wherein a communication is received from a messaging entity via a communications interface;

wherein the tuned message classification parameters are used by the plurality of message classification techniques executed by the one or more data processors to classify the communication;

wherein message classification outputs from the plurality of message classification techniques executed by the one or more data processors are combined in order to generate a message profile score;

wherein the message profile score is used by a communications filter in deciding what action is to be taken with respect to the communication associated with the messaging entity;

wherein the tuner program operating on the one or more data processors is used to adjust confidence values associated with the message classification outputs, the tuner program using a genetic algorithm including a fitness function modeling the fitness of candidate vector solutions for the confidence values, the fitness function expressing cost associated with the mistakes that a candidate vector solution made in attempting to correctly classify messages in a set of pre-classified data.